- Devel - libvirt List Archives

[libvirt] polkit-auth question
by Jim Fehlig 19 Dec '11

19 Dec '11

While debugging a PolicyKit issue I noticed that libvirt would proceed with authentication even though polkit-auth failed: testusr@xen134:~> virsh list --all Attempting to obtain authorization for org.libvirt.unix.manage. polkit-grant-helper: given auth type (8 -> yes) is bogus Failed to obtain authorization for org.libvirt.unix.manage. Id Name State ---------------------------------- 0 Domain-0 running - sles11sp1-pv shut off Hmm, authorization failed but domains listed anyway. testusr@xen134:~> virsh start sles11sp1-pv Attempting to obtain authorization for org.libvirt.unix.manage. polkit-grant-helper: given auth type (8 -> yes) is bogus Failed to obtain authorization for org.libvirt.unix.manage. Domain sles11sp1-pv started Ok, authorization failed but testusr was able to start the domain! Checking virConnectAuthGainPolkit() in src/libvirt.c cmd = virCommandNewArgList(POLKIT_AUTH, "--obtain", privilege, NULL); if (virCommandRun(cmd, &status) < 0 || status > 1) goto cleanup; Why the check for status > 1? I looked at polkit-auth source in PolicyKit 0.9 and AFAICT it sets its default return code to 1, only changing it to 0 in success code paths. Unfortunately, the polkit-auth docs make no mention of return codes. Thanks, Jim

1 0

[libvirt] [PATCH] docs: document <qemu:commandline> xml
by Eric Blake 19 Dec '11

19 Dec '11

Even though we technically don't support <qemu:commandline> (as in, if you mis-use things, you get to keep the pieces), we should at least document how to use it. * docs/drvqemu.html.in (qemucommand): New section. --- I wrote this in response to an IRC comment lamenting that the only existing documentation was reading the examples in the testsuite. docs/drvqemu.html.in | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 61 insertions(+), 0 deletions(-) diff --git a/docs/drvqemu.html.in b/docs/drvqemu.html.in index 4da3817..d6effb5 100644 --- a/docs/drvqemu.html.in +++ b/docs/drvqemu.html.in @@ -513,6 +513,67 @@ $ virsh domxml-to-native qemu-argv demo.xml -serial none -parallel none -usb </pre> + <h2><a name="qemucommand">Pass-through of arbitrary qemu + commands</a></h2> + + <p>Libvirt provides an optional + library <code>libvirt-qemu.so</code> for dealing specifically + with qemu. This library is <b>unsupported</b>, in that it is + not guaranteed to have a stable API, and that mis-using the + library may result in inconsistent state the crashes libvirtd. + However, when used correctly, this library allows testing + specific qemu features that have not yet been ported to the + generic libvirt XML and API interfaces. + </p> + <p>The library provides two + API: <code>virDomainQemuMonitorCommand</code>, for sending an + arbitrary monitor command (in either HMP or QMP format) to a + qemu guest (<span class="since">Since 0.8.3</span>), + and <code>virDomainQemuAttach</code>, for registering a qemu + domain that was manually started so that it can then be managed + by libvirtd (<span class="since">Since 0.9.4</span>). + </p> + <p>Additionally, the following XML additions allow fine-tuning of + the command line given to qemu when starting a domain + (<span class="since">Since 0.8.3</span>). In order to use the + XML additions, it is necessary to issue an XML namespace request + (the special <code>xmlns:<i>name</i></code> attribute) that + pulls in <code>http://libirt.org/schemas/domain/qemu/1.0</code>; + typically, the namespace is given the name + of <code>qemu</code>. With the namespace in place, it is then + possible to add an element <code><qemu:commandline></code> + under <code>driver</code>, with the following sub-elements + repeated as often as needed: + <dl> + <dt><code>qemu:arg</code></dt> + <dd>Add an additional command-line argument to the qemu + process when starting the domain, given by the value of the + attribute <code>value</code>. + </dd> + <dt><code>qemu:env</code></dt> + <dd>Add an additional environment variable to the qemu + process when starting the domain, given with the name-value + pair recorded in the attributes <code>name</code> + and <code>value</code>.</dd> + </dl> + + <p>Example:</p><pre> +<domain type='qemu' xmlns:qemu='http://libirt.org/schemas/domain/qemu/1.0'> + <name>QEmu-fedora-i686</name> + <memory>219200</memory> + <os> + <type arch='i686' machine='pc'>hvm</type> + </os> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + </devices> + <qemu:commandline> + <qemu:arg value='-newarg'/> + <qemu:env name='QEMU_ENV' value='VAL'/> + </qemu:commandline> +</domain> +</pre> + <h2><a name="xmlconfig">Example domain XML config</a></h2> <h3>QEMU emulated guest on x86_64</h3> -- 1.7.7.4

2 2

[libvirt] [PATCH] python: plug memory leak on libvirt_virConnectOpenAuth
by ajia＠redhat.com 19 Dec '11

19 Dec '11

From: Alex Jia <ajia(a)redhat.com> * Detected by valgrind. Leak introduced in commit 5ab109f. * python/libvirt-override.c: avoid memory leak on libvirt_virConnectOpenAuth. * How to reproduce? % valgrind -v --leak-check=full virt-clone --print-xml Note: it can hit the issue although options are incomplete. * Actual valgrind result: ==1801== 12 bytes in 1 blocks are definitely lost in loss record 25 of 3,270 ==1801== at 0x4A05FDE: malloc (vg_replace_malloc.c:236) ==1801== by 0xCF1F60E: libvirt_virConnectOpenAuth (libvirt-override.c:1507) ==1801== by 0x3AFEEDE7F3: PyEval_EvalFrameEx (ceval.c:3794) ==1801== by 0x3AFEEDF99E: PyEval_EvalFrameEx (ceval.c:3880) ==1801== by 0x3AFEEDF99E: PyEval_EvalFrameEx (ceval.c:3880) ==1801== by 0x3AFEEDF99E: PyEval_EvalFrameEx (ceval.c:3880) ==1801== by 0x3AFEEDF99E: PyEval_EvalFrameEx (ceval.c:3880) ==1801== by 0x3AFEEE0466: PyEval_EvalCodeEx (ceval.c:3044) ==1801== by 0x3AFEEE0541: PyEval_EvalCode (ceval.c:545) ==1801== by 0x3AFEEFB88B: run_mod (pythonrun.c:1351) ==1801== by 0x3AFEEFB95F: PyRun_FileExFlags (pythonrun.c:1337) ==1801== by 0x3AFEEFCE4B: PyRun_SimpleFileExFlags (pythonrun.c:941) Signed-off-by: Alex Jia <ajia(a)redhat.com> --- python/libvirt-override.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/python/libvirt-override.c b/python/libvirt-override.c index 4aee628..8a643a3 100644 --- a/python/libvirt-override.c +++ b/python/libvirt-override.c @@ -1520,6 +1520,7 @@ libvirt_virConnectOpenAuth(PyObject *self ATTRIBUTE_UNUSED, PyObject *args) { c_retval = virConnectOpenAuth(name, &auth, flags); LIBVIRT_END_ALLOW_THREADS; + free(auth.credtype); py_retval = libvirt_virConnectPtrWrap((virConnectPtr) c_retval); return(py_retval); } -- 1.7.1

3 2

[libvirt] [PATCH 0/2] Introduce two new virsh commands
by Osier Yang 19 Dec '11

19 Dec '11

These two patches is to introduce two new virsh commands, one is eject-media, which is to eject media from CD or floppy drive, the other is insert-media, which is to insert media into CD or floppy drive. There are commands existed can be used to eject/insert media, such as "update-device", but it's not quite easy to use. That's the original intention of these patches. Both of the two commands only allow to operate on CDROM or floppy disk. [PATCH 1/2] virsh: Introduce two new commands to insert or eject media [PATCH 2/2] doc: Add docs for two new introduced commands Regards Osier

3 6

[libvirt] [PATCH] Fix typo in storage pool documentation
by Christophe Fergeau 19 Dec '11

19 Dec '11

Remove 2 words that shouldn't be here. --- docs/formatstorage.html.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/docs/formatstorage.html.in b/docs/formatstorage.html.in index f13ca6a..0dcf6df 100644 --- a/docs/formatstorage.html.in +++ b/docs/formatstorage.html.in @@ -13,7 +13,7 @@ volumes. Some may have constraints on volume size, or placement. </p> <p> - The is the top level tag for a storage pool document is 'pool'. It has + The top level tag for a storage pool document is 'pool'. It has a single attribute <code>type</code>, which is one of <code>dir</code>, <code>fs</code>,<code>netfs</code>,<code>disk</code>,<code>iscsi</code>, <code>logical</code>. This corresponds to the storage backend drivers -- 1.7.7.4

2 1

[libvirt] [PATCHv2] build: let autobuild check more code
by Eric Blake 19 Dec '11

19 Dec '11

Many times, we don't notice a bug in src/libvirt_private.syms until someone attempts a build with modules enabled. Likewise, some gcc warnings about no % in a printf format string only appear under --disable-nls. And configure.ac should automatically be excluding modules on mingw without us having to be explicit. Improving autobuild.sh to stress more combinations can only help. * autobuild.sh: Add --with-driver-modules and --disable-nls. Update mingw build to rely more on configure.ac detection. --- Wow, I've been sitting on this one for a while, and dusted it off from one of my side branches. This might not address all of Daniel's comments on v1, but it is better than nothing. v1: https://www.redhat.com/archives/libvir-list/2011-March/msg01072.html v2: in response to: https://www.redhat.com/archives/libvir-list/2011-December/msg00620.html autobuild.sh | 23 ++++++----------------- 1 files changed, 6 insertions(+), 17 deletions(-) diff --git a/autobuild.sh b/autobuild.sh index 9853287..eef67f4 100755 --- a/autobuild.sh +++ b/autobuild.sh @@ -15,8 +15,12 @@ rm -rf build mkdir build cd build +# Run with options not normally exercised by the rpm build, for +# more complete code coverage. ../autogen.sh --prefix="$AUTOBUILD_INSTALL_ROOT" \ + --with-driver-modules \ --enable-test-coverage \ + --disable-nls \ --enable-compile-warnings=error # If the MAKEFLAGS envvar does not yet include a -j option, @@ -61,6 +65,7 @@ if [ -f /usr/bin/rpmbuild ]; then -ba --clean libvirt.spec fi +# Test mingw cross-compile if [ -x /usr/bin/i686-pc-mingw32-gcc ]; then make distclean @@ -71,23 +76,7 @@ if [ -x /usr/bin/i686-pc-mingw32-gcc ]; then --host=i686-pc-mingw32 \ --prefix="$AUTOBUILD_INSTALL_ROOT/i686-pc-mingw32/sys-root/mingw" \ --enable-compile-warnings=error \ - --without-xen \ - --without-qemu \ - --without-openvz \ - --without-lxc \ - --without-vbox \ - --without-xenapi \ - --without-uml \ - --without-sasl \ - --without-avahi \ - --without-polkit \ - --without-python \ - --without-libvirtd \ - --without-phyp \ - --without-hyperv \ - --without-netcf \ - --without-audit \ - --without-dtrace \ + --without-libvirtd make make install -- 1.7.7.4

2 9

[libvirt] ANNOUNCE: libvirt-glib release 0.0.3
by Daniel P. Berrange 19 Dec '11

19 Dec '11

I am pleased to announce that a new release of the libvirt-glib package, version 0.0.3 is now available from ftp://libvirt.org/libvirt/glib/ The packages are GPG signed with Key fingerprint: DAF3 A6FD B26B 6291 2D0E 8E3F BE86 EBB4 1510 4FDF (4096R) New in this release: - Flesh out API in libvirt-gconfig to allow basic domain configuration - Don't memset private data fields, since glib already ensures this - Fix VPATH builds - Add syntax-check rules ensuring coding style compliance - Describe coding style in HACKING file - Expand libvirt-gobject API to allow watches on streams - Simplify debug system with new glib - Fix libvirt-gobject pkg-config file - Fix domain event handlig wrt transient guests - Don't crash if given a NULL uri to connect to - Expand libvirt-gobject API for storage pools & volumes - Fix some crashes in error paths where GError instance was NULL - Add vala files to the RPM - Add binding for open domain consoles & graphics libvirt-glib comprises three distinct libraries: - libvirt-glib - Integrate with the GLib event loop and error handling - libvirt-gconfig - Representation of libvirt XML documents as GObjects - libvirt-gobject - Mapping of libvirt APIs into the GObject type system NB: While libvirt aims to be API/ABI stable, for the first few releases, we are *NOT* guaranteeing that libvirt-glib libraries are API/ABI stable. ABI stability will only be guaranteed once the bulk of the APIs have been fleshed out and proved in non-trivial application usage. We anticipate this will be within the next 6 months in order to line up with Fedora 17. Follow up comments about libvirt-glib should be directed to the regular libvir-list(a)redhat.com development list. Thanks to all the people involved in contributing to this release. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

1 0

[libvirt] [PATCH 0/8] Refactor event state handling to fix crash
by Daniel P. Berrange 19 Dec '11

19 Dec '11

When running while true ; do date ; ../tools/virsh -q -c test:///default 'shutdown test; undefine test; dominfo test' ; done we often experiance hangs or crashes or memory corruption in glibc. The reason is that when the virConnectPtr is free'd this in turn frees the event state, which in turn unregisters the event timer. The timer may, however, still fire one last time and it is possible this occurs after the event state has been freed. The solution in this series is to only register the timer when the first callback is added and unregister the timer, when the last callback is removed. In doing this patch, I decide to unify more of the event handling across drivers, and simplify the API usage by drivers, and hide all the impl details.

4 25

[libvirt] [PATCH] [TCK] nwfilter: Add tests to detect unnecessarily created ebtables chains
by Stefan Berger 17 Dec '11

17 Dec '11

This patch adds a couple of test to detect unnecessarily created ebtables chains in the case where only iptables chains should have been created. Stefan --- scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 4 ++++ scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall | 4 ++++ scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 4 ++++ scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall | 4 ++++ scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall | 4 ++++ scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall | 4 ++++ 6 files changed, 24 insertions(+) Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall =================================================================== --- libvirt-tck.orig/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall @@ -28,3 +28,7 @@ FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [got ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 #iptables -L libvirt-out -n | grep vnet0 | tr -s " " FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#ebtables -t nat -L libvirt-O-vnet0 2>/dev/null | grep -v "table:" | grep -v "^$" +#ebtables -t nat -L libvirt-I-vnet0 2>/dev/null | grep -v "table:" | grep -v "^$" +#ebtables -t nat -L PREROUTING | grep vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall =================================================================== --- libvirt-tck.orig/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall @@ -26,3 +26,7 @@ FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV ma ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 #ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#ebtables -t nat -L libvirt-O-vnet0 2>/dev/null | grep -v "table:" | grep -v "^$" +#ebtables -t nat -L libvirt-I-vnet0 2>/dev/null | grep -v "table:" | grep -v "^$" +#ebtables -t nat -L PREROUTING | grep vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall =================================================================== --- libvirt-tck.orig/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall @@ -24,3 +24,7 @@ FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [got ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 #iptables -L libvirt-out -n | grep vnet0 | tr -s " " FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#ebtables -t nat -L libvirt-O-vnet0 2>/dev/null | grep -v "table:" | grep -v "^$" +#ebtables -t nat -L libvirt-I-vnet0 2>/dev/null | grep -v "table:" | grep -v "^$" +#ebtables -t nat -L PREROUTING | grep vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall =================================================================== --- libvirt-tck.orig/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall @@ -26,3 +26,7 @@ FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV ma ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 #ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#ebtables -t nat -L libvirt-O-vnet0 2>/dev/null | grep -v "table:" | grep -v "^$" +#ebtables -t nat -L libvirt-I-vnet0 2>/dev/null | grep -v "table:" | grep -v "^$" +#ebtables -t nat -L PREROUTING | grep vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall =================================================================== --- libvirt-tck.orig/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall @@ -26,3 +26,7 @@ FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV ma ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 #ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#ebtables -t nat -L libvirt-O-vnet0 2>/dev/null | grep -v "table:" | grep -v "^$" +#ebtables -t nat -L libvirt-I-vnet0 2>/dev/null | grep -v "table:" | grep -v "^$" +#ebtables -t nat -L PREROUTING | grep vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall =================================================================== --- libvirt-tck.orig/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall @@ -24,3 +24,7 @@ FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [got ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 #iptables -L libvirt-out -n | grep vnet0 | tr -s " " FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#ebtables -t nat -L libvirt-O-vnet0 2>/dev/null | grep -v "table:" | grep -v "^$" +#ebtables -t nat -L libvirt-I-vnet0 2>/dev/null | grep -v "table:" | grep -v "^$" +#ebtables -t nat -L PREROUTING | grep vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0

2 2

[libvirt] [PATCH] nwfilter: do not create ebtables chain unnecessarily
by Stefan Berger 17 Dec '11

17 Dec '11

If only iptables rules are created then two unnecessary ebtables chains are also created. This patch fixes this. The chains had been cleaned up properly when the interface disappeared, though. --- src/nwfilter/nwfilter_ebiptables_driver.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) Index: libvirt-iterator/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-iterator.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-iterator/src/nwfilter/nwfilter_ebiptables_driver.c @@ -3622,10 +3622,12 @@ ebiptablesApplyNewRules(const char *ifna NWFILTER_SET_EBTABLES_SHELLVAR(&buf); /* create needed chains */ - if (ebtablesCreateTmpRootAndSubChains(&buf, ifname, chains_in_set , 1, - &ebtChains, &nEbtChains) < 0 || - ebtablesCreateTmpRootAndSubChains(&buf, ifname, chains_out_set, 0, - &ebtChains, &nEbtChains) < 0) { + if ((virHashSize(chains_in_set) > 0 && + ebtablesCreateTmpRootAndSubChains(&buf, ifname, chains_in_set , 1, + &ebtChains, &nEbtChains) < 0) || + (virHashSize(chains_out_set) > 0 && + ebtablesCreateTmpRootAndSubChains(&buf, ifname, chains_out_set, 0, + &ebtChains, &nEbtChains) < 0)) { goto tear_down_tmpebchains; }

2 2