- Devel - libvirt List Archives

[PATCH] security_selinux.c: Relabel existing mode="bind" UNIX sockets
by David Michael 01 Jul '22

01 Jul '22

This supports sockets created by libvirt and passed by FD using the same method as in security_dac.c. Signed-off-by: David Michael <david(a)bigbadwolfsecurity.com> --- Hi, Custom SELinux labels are not applied to sockets when they have mode="bind", but other security models (DAC) allow changing these sockets. Can the same method be used to support SELinux? Thanks. David src/security/security_selinux.c | 6 ++++-- tests/securityselinuxlabeldata/chardev.txt | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index e2f34a27dc..8b258c9e36 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -2541,7 +2541,9 @@ virSecuritySELinuxSetChardevLabel(virSecurityManager *mgr, break; case VIR_DOMAIN_CHR_TYPE_UNIX: - if (!dev_source->data.nix.listen) { + if (!dev_source->data.nix.listen || + (dev_source->data.nix.path && + virFileExists(dev_source->data.nix.path))) { if (virSecuritySELinuxSetFilecon(mgr, dev_source->data.nix.path, imagelabel, @@ -2618,7 +2620,7 @@ virSecuritySELinuxRestoreChardevLabel(virSecurityManager *mgr, case VIR_DOMAIN_CHR_TYPE_UNIX: if (!dev_source->data.nix.listen) { if (virSecuritySELinuxRestoreFileLabel(mgr, - dev_source->data.file.path, + dev_source->data.nix.path, true) < 0) goto done; } diff --git a/tests/securityselinuxlabeldata/chardev.txt b/tests/securityselinuxlabeldata/chardev.txt index 3f4b6302b9..bdb367f7a5 100644 --- a/tests/securityselinuxlabeldata/chardev.txt +++ b/tests/securityselinuxlabeldata/chardev.txt @@ -2,6 +2,6 @@ /plain.dev;system_u:object_r:svirt_image_t:s0:c41,c264 /plain.fifo;system_u:object_r:svirt_image_t:s0:c41,c264 /nolabel.sock; -/plain.sock; +/plain.sock;system_u:object_r:svirt_image_t:s0:c41,c264 /yeslabel.sock;system_u:object_r:svirt_image_t:s0:c41,c264 /altlabel.sock;system_u:object_r:svirt_image_custom_t:s0:c41,c264 -- 2.36.1

4 7

Release of libvirt-8.5.0
by Jiri Denemark 01 Jul '22

01 Jul '22

The 8.5.0 release of both libvirt and libvirt-python is tagged and signed tarballs and source RPMs are available at https://libvirt.org/sources/ https://libvirt.org/sources/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * New features * qemu: Introduce support for network backed NVRAM Users can now use remote store NVRAM image by specifying newly introduced attribute `type='network'` with `<nvram>` element. * qemu: Add support for post-copy migration recovery A new ``VIR_MIGRATE_POSTCOPY_RESUME`` flag (``virsh migrate --postcopy-resume``) was introduced for recovering from a failed post-copy migration. * Introduce thread_pool_min and thread_pool_max attributes to IOThread New attributes ``thread_pool_min`` and ``thread_pool_max`` were introduced to ``<iothread/>`` as well as new ``<defaultiothread/>`` element with the same attributes. This way it's possible to instruct QEMU to spawn enough worker threads for an IOThread upfront, resulting in predictable time needed to process an I/O request. * Improvements * Define a TFTP server without a DHCP server in network configuration It's now possible to define a network with no DHCP server but with a TFTP server. This may be useful when DHCP service is provided by other entity on the network than libvirt spawned dnsmasq. * Bug fixes * qemu: Restore label to temp file in qemuDomainScreenshot() When virDomainScreenshot() is called, libvirt instructs QEMU to save the screenshot into a temporary file. This file needs to be labelled correctly, so that QEMU can access it. And since the file is temporary (it's deleted after the screenshot was taken) the corresponding label restore was missing. This proven to be problematic for profile based models, like AppArmor, where the temporary files were added into the profile but never removed, which resulted in longer profile recalculation times. * qemuBuildInterfaceConnect: Initialize @tapfd array Due to an uninitialized array, unsuccessful attempt to start a guest with an ``<interface/>`` might have resulted in closing of a random FD and thus sudden disconnect of a client or other random failures. * qemu: Fix hotplug of network interfaces A logic bug introduced in a recent refactor was fixed. The bug caused a problem when hot-adding a network interface, which failed with the following error:: error: internal error: unable to execute QEMU command 'netdev_add': File descriptor named '(null)' has not been found * Fix ``startupPolicy`` validation for ``block`` disks Setting of ``startupPolicy`` for a block disk would result in an error due to a logic bug in a recent refactor. * qemu: Fix crash when overriding device properties via ``<qemu:override>`` element Adding an override for a device property would result in a crash of the qemu driver. Enjoy. Jirka

1 0

[PATCH for 8.5.0] qemu_hotplug: Don't skip cleanup in qemuDomainAttachNetDevice()
by Michal Privoznik 01 Jul '22

01 Jul '22

Introduced in v8.4.0-rc1~183 but the first real problem introduced in v8.4.0-rc1~170, there's a qemuBuildInterfaceConnect() call inside of qemuDomainAttachNetDevice(). If the former fails, then the function is immediately returned from instead of jumping onto the cleanup label. This is crucial, because at this point the domain definition contains 'borrowed' net definition, which is then freed, since an error was met. The domain definition is then left with a dangling pointer which leads to all sorts of different crashes. Fixes: 29d022b1eb7b2330ed224a08509e6d3a5eeecc53 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2102009 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_hotplug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index ee44649d48..27e68370cf 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1265,7 +1265,7 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver, VIR_APPEND_ELEMENT_COPY(vm->def->nets, vm->def->nnets, net); if (qemuBuildInterfaceConnect(vm, net, VIR_NETDEV_VPORT_PROFILE_OP_CREATE) < 0) - return -1; + goto cleanup; iface_connected = true; -- 2.35.1

3 2

[PATCH 0/3] qemu: add an API for "query-stats" QMP command
by Amneesh Singh 30 Jun '22

30 Jun '22

QEMU is gaining introspectable statistics which can be queried via the "query-stats" QMP command. This patchset aims to add an API for the same. The returned JSON for "query-stats" is an array of objects containing their own respective array of statistics. Patch 1 adds the API which returns the deserialized JSON in the form of a GPtrArray of GHashTables. Patch 2 adds the "query-stats" to QEMU capabilities. Patch 3 uses the API to query the halt poll success time and the halt poll failure time. Relevant QEMU patches can be found here: https://lore.kernel.org/all/20220523150509.349412-1-pbonzini@redhat.com/ This patchset is part of the 2022 GSOC contributor project. All reviews and comments are appreciated :). Amneesh Singh (3): qemu_monitor: add qemuMonitorQueryStats qemu_capabilities: add "query-stats" QMP command to the QEMU capabilities qemu_driver: use qemuMonitorQueryStats to extract halt poll time src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_driver.c | 48 +++++++++++-- src/qemu/qemu_monitor.c | 46 +++++++++++++ src/qemu/qemu_monitor.h | 36 ++++++++++ src/qemu/qemu_monitor_json.c | 128 +++++++++++++++++++++++++++++++++++ src/qemu/qemu_monitor_json.h | 6 ++ 7 files changed, 263 insertions(+), 4 deletions(-) -- 2.36.1

3 11

[libvirt PATCH 0/4] qemu_migration: Apply max-postcopy-bandwidth on post-copy resume
by Jiri Denemark 30 Jun '22

30 Jun '22

Resolves: https://gitlab.com/libvirt/libvirt/-/issues/333 Jiri Denemark (4): qemu: Pass migration flags to qemuMigrationParamsApply qemu_migration_params: Replace qemuMigrationParamTypes array qemu_migration: Pass migParams to qemuMigrationSrcResume qemu_migration: Apply max-postcopy-bandwidth on post-copy resume src/qemu/qemu_driver.c | 6 +- src/qemu/qemu_migration.c | 26 ++++-- src/qemu/qemu_migration_params.c | 131 ++++++++++++++++++--------- src/qemu/qemu_migration_params.h | 3 +- src/qemu/qemu_migration_paramspriv.h | 3 +- tests/qemumigparamstest.c | 2 +- tests/qemumigrationcookiexmltest.c | 2 +- 7 files changed, 116 insertions(+), 57 deletions(-) -- 2.35.1

2 5

[PATCH 0/2] virnettlscontext: Don't set DH parameters ourselves
by Michal Privoznik 30 Jun '22

30 Jun '22

Suggested by Dan here: https://listman.redhat.com/archives/libvir-list/2022-January/226681.html Since we can bump min gnutls version we don't have to care about pre-3.6.0 release he mentions in the e-mail. Michal Prívozník (2): meson: Require gnutls-3.6.0 or newer virnettlscontext: Don't set DH parameters ourselves meson.build | 2 +- src/rpc/virnettlscontext.c | 41 -------------------------------------- tests/virrandommock.c | 36 --------------------------------- 3 files changed, 1 insertion(+), 78 deletions(-) -- 2.35.1

2 3

[PATCH for 8.5.0] API: Remove internal impl detail from VIR_DOMAIN_IOTHREAD_THREAD_POOL_{MIN, MAX} description
by Michal Privoznik 30 Jun '22

30 Jun '22

When introducing VIR_DOMAIN_IOTHREAD_THREAD_POOL_MIN and VIR_DOMAIN_IOTHREAD_THREAD_POOL_MAX typed parameters, I've made a shortcut. Since at the monitor level these two are set in two separate calls and minimum has to be always smaller than maximum (or equal to it), it may happen that one of the values we want to set violates this restriction. So I've put a little note in the public API description warning users about this. However, the proper solution is to have a logic that checks the current values and based on that set either minimum or maximum value first. But until we get there, remove that note from the public API before it gets released. Related: https://gitlab.com/libvirt/libvirt/-/issues/339 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- include/libvirt/libvirt-domain.h | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-domain.h index 05344aaa95..7430a08619 100644 --- a/include/libvirt/libvirt-domain.h +++ b/include/libvirt/libvirt-domain.h @@ -2513,9 +2513,7 @@ int virDomainDelIOThread(virDomainPtr domain, * * Sets the lower bound for thread pool size. A value of -1 disables this bound * leaving hypervisor use its default value, though this value is not accepted - * for running domains. Due to internal implementation it's recommended to set - * VIR_DOMAIN_IOTHREAD_THREAD_POOL_MIN and VIR_DOMAIN_IOTHREAD_THREAD_POOL_MAX - * separately. Accepted type is VIR_TYPED_PARAM_INT. + * for running domains. Accepted type is VIR_TYPED_PARAM_INT. * * Since: 8.5.0 */ @@ -2527,9 +2525,7 @@ int virDomainDelIOThread(virDomainPtr domain, * Sets the upper bound for thread pool size. A value of -1 disables this bound * leaving hypervisor use its default value, though this value is not accepted * for running domains. Since the upper band has to be equal to or greater than - * lower bound value of 0 is not accepted. Due to internal implementation it's - * recommended to set VIR_DOMAIN_IOTHREAD_THREAD_POOL_MIN and - * VIR_DOMAIN_IOTHREAD_THREAD_POOL_MAX separately. Accepted type is + * lower bound value of 0 is not accepted. Accepted type is * VIR_TYPED_PARAM_INT. * * Since: 8.5.0 -- 2.35.1

2 1

[PATCH v3 00/15] qemu: Allow setting EventLoopBaseProperties
by Michal Privoznik 30 Jun '22

30 Jun '22

v3 of: https://listman.redhat.com/archives/libvir-list/2022-June/232288.html diff to v2: - More validation checks (e.g. max != 0, min <= max), - Disallow -1 for virDomainSetIOThreadParams on a live VM, - Extended docs, - Reworded some commit messages. Michal Prívozník (15): virml: Introduce VIR_XML_PROP_NONNEGATIVE flag virDomainDefParseIOThreads: Use g_autoptr() for @iothrid virDomainIOThreadIDDefArrayInit: Decrease scope of @iothrid conf: Move iothread formatter into a separate function conf: Introduce allocator for virDomainIOThreadIDDef conf: Introduce thread_pool_min and thread_pool_max attributes to IOThread qemu: Introduce QEMU_CAPS_IOTHREAD_THREAD_POOL_MAX qemu_validate: Check if QEMU's capable of setting iothread pool size qemu: Generate command line for IOThread pool size include: Introduce typed params for virDomainSetIOThreadParams wrt pool size qemu: Wire up new virDomainSetIOThreadParams parameters virsh: Wire up new virDomainSetIOThreadParams parameters conf: Introduce <defaultiothread/> qemu_validate: Check if QEMU's capable of setting <defaultiothread/> pool size qemu: Generate command line for <defaultiothread/> pool size docs/formatdomain.rst | 17 +- docs/manpages/virsh.rst | 13 +- include/libvirt/libvirt-domain.h | 28 +++ src/conf/domain_conf.c | 162 +++++++++++++++--- src/conf/domain_conf.h | 11 ++ src/conf/domain_validate.c | 45 +++++ src/conf/schemas/domaincommon.rng | 25 +++ src/conf/virconftypes.h | 2 + src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 26 ++- src/qemu/qemu_driver.c | 140 ++++++++++++++- src/qemu/qemu_monitor.h | 4 + src/qemu/qemu_monitor_json.c | 2 + src/qemu/qemu_validate.c | 36 ++++ src/util/virxml.c | 7 + src/util/virxml.h | 3 + .../caps_7.1.0.x86_64.xml | 1 + ...othreads-ids-pool-sizes.x86_64-latest.args | 45 +++++ .../iothreads-ids-pool-sizes.xml | 62 +++++++ tests/qemuxml2argvtest.c | 1 + ...iothreads-ids-pool-sizes.x86_64-latest.xml | 1 + tests/qemuxml2xmltest.c | 1 + tools/virsh-domain.c | 24 ++- 24 files changed, 621 insertions(+), 38 deletions(-) create mode 100644 tests/qemuxml2argvdata/iothreads-ids-pool-sizes.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/iothreads-ids-pool-sizes.xml create mode 120000 tests/qemuxml2xmloutdata/iothreads-ids-pool-sizes.x86_64-latest.xml -- 2.35.1

4 22

[PATCH] NEWS: Mention 3 user-visible regressions fixed in this release
by Peter Krempa 30 Jun '22

30 Jun '22

Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- NEWS.rst | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 7597abcf7e..2e29c57ffc 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -61,6 +61,24 @@ v8.5.0 (unreleased) an ``<interface/>`` might have resulted in closing of a random FD and thus sudden disconnect of a client or other random failures. + * qemu: Fix hotplug of network interfaces + + A logic bug introduced in a recent refactor was fixed. The bug caused a + problem when hot-adding a network interface, which failed with the + following error:: + + error: internal error: unable to execute QEMU command 'netdev_add': File descriptor named '(null)' has not been found + + * Fix ``startupPolicy`` validation for ``block`` disks + + Setting of ``startupPolicy`` for a block disk would result in an error due + to a logic bug in a recent refactor. + + * qemu: Fix crash when overriding device properties via ``<qemu:override>`` element + + Adding an override for a device property would result in a crash of the qemu + driver. + v8.4.0 (2022-06-01) =================== -- 2.36.1

2 1

Entering freeze for libvirt-8.5.0
by Jiri Denemark 29 Jun '22

29 Jun '22

I have just tagged v8.5.0-rc1 in the repository and pushed signed tarballs and source RPMs to https://libvirt.org/sources/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Thanks, Jirka

1 1