- Devel - libvirt List Archives

[libvirt] On pidfile security and using -daemonize to start qemu/kvm
by Charles Duffy 03 Sep '09

03 Sep '09

I had a brief conversation with Daniel Berrange on IRC this morning regarding race conditions in libvirt's invocation of qemu domains. The preferred approach from qemu's maintainership is using -daemonize at invocation, and then waiting for the process to exit before attempting to connect to the monitor; after this occurs, qemu guarantees monitor availability, so no retry/timeout behavior is necessary. Dan pointed out an issue with this approach: To determine the PID of the qemu instance started, the -pidfile argument to qemu needs to be used with -daemonize. However, -pidfile writes the requested pidfile with qemu's permissions; if the guest were subverted, it could rewrite its pidfile and lead libvirt to kill other, arbitrary processes. Neither changing permissions with -runas rather than prior to invocation nor chown'ing the pidfile from libvirt after creation helps, as qemu keeps a file handle on it open throughout operation (to maintain a POSIX lock on the file). However, a workaround exists, and it meshes well with a security fix which needs to be implemented anyhow: At present, on initial startup or libvirtd restart, we read the PIDs associated with vCPUs from the monitor in virDetectVcpuPIDs(); doing this on libvirtd restart poses a security risk for the reason given above, so we need to have libvirtd record the PIDs on initial startup (before any untrusted code within the guest is ever run) regardless. If we also read the libvirtd pidfile at this same early time (before the guest has been started and thus had an opportunity to run untrusted code) and include its contents when writing out the vCPU PIDs, this would eliminate the issue with pidfile ownership blocking use of -daemonize. Thoughts?

2 1

[libvirt] [PATCH] xen_internal.c: remove two unused local variables
by Jim Meyering 03 Sep '09

03 Sep '09

Obviously unnecessary. Maybe someone had plans for these long ago? >From 94730ec1d99076cd18b04b950adad7c7a576071f Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Thu, 3 Sep 2009 17:11:14 +0200 Subject: [PATCH] xen_internal.c: remove two unused local variables * src/xen_internal.c (xenHypervisorSetSchedulerParameters): Remove set-but-never-used local variables, cap_set and weight_set. --- src/xen_internal.c | 5 ----- 1 files changed, 0 insertions(+), 5 deletions(-) diff --git a/src/xen_internal.c b/src/xen_internal.c index ae78f84..30fd8bd 100644 --- a/src/xen_internal.c +++ b/src/xen_internal.c @@ -1299,9 +1299,6 @@ xenHypervisorSetSchedulerParameters(virDomainPtr domain, TODO return(-1); case XEN_SCHEDULER_CREDIT: { - int weight_set = 0; - int cap_set = 0; - memset(&op_dom, 0, sizeof(op_dom)); op_dom.cmd = XEN_V2_OP_SCHEDULER; op_dom.domain = (domid_t) domain->id; @@ -1326,7 +1323,6 @@ xenHypervisorSetSchedulerParameters(virDomainPtr domain, return(-1); } op_dom.u.getschedinfo.u.credit.weight = val; - weight_set = 1; } else if (STREQ (params[i].field, str_cap) && params[i].type == VIR_DOMAIN_SCHED_FIELD_UINT) { val = params[i].value.ui; @@ -1336,7 +1332,6 @@ xenHypervisorSetSchedulerParameters(virDomainPtr domain, return(-1); } op_dom.u.getschedinfo.u.credit.cap = val; - cap_set = 1; } else { virXenErrorFunc (domain->conn, VIR_ERR_INVALID_ARG, __FUNCTION__, "Credit scheduler accepts 'cap' and 'weight' integer parameters", -- 1.6.4.2.395.ge3d52

2 1

[libvirt] [PATCH] python: let libvirt_virConnectDomainEventCallback indicate success
by Jim Meyering 03 Sep '09

03 Sep '09

First dead-store-related bug fix: >From 6024fb05dfa2dd408ad79abbac88791f5048af11 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Thu, 3 Sep 2009 14:09:49 +0200 Subject: [PATCH] python: let libvirt_virConnectDomainEventCallback indicate success * python/libvir.c (libvirt_virConnectDomainEventCallback): Return 0 when successful, rather than always returning -1. clang flagged this function for its dead-store of "ret=0". Once "ret" was set to 0, it was never used, and the function would always return -1. --- python/libvir.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/python/libvir.c b/python/libvir.c index e2c196a..0c00b80 100644 --- a/python/libvir.c +++ b/python/libvir.c @@ -4,7 +4,7 @@ * entry points where an automatically generated stub is * unpractical * - * Copyright (C) 2005, 2007, 2008 Red Hat, Inc. + * Copyright (C) 2005, 2007-2009 Red Hat, Inc. * * Daniel Veillard <veillard(a)redhat.com> */ @@ -1812,7 +1812,7 @@ libvirt_virConnectDomainEventCallback(virConnectPtr conn ATTRIBUTE_UNUSED, cleanup: LIBVIRT_RELEASE_THREAD_STATE; - return -1; + return ret; } static PyObject * -- 1.6.4.2.395.ge3d52

2 1

[libvirt] [PATCH 0/3] QEMU directory/monitor socket fixes/cleanup
by Daniel P. Berrange 03 Sep '09

03 Sep '09

This patch series does three things - Moves QEMU monitor sockets in /var/lib/libvirt/qemu, since this is created file and thus should be separate from libvirtd created data to avoid risk from QEMU compromise. - Sets QEMU directory ownership to match configured qemu user/group - Fixes a minor memory leak / socket unlink

2 4

[libvirt] [PATCH 2/2]: VirtualBox: Updated vboxNetworkUndefine() and vboxNetworkDestroy()
by Pritesh Kothari 03 Sep '09

03 Sep '09

Hi All, I have made some changes to the functions vboxNetworkCreateXML(), vboxNetworkDefineXML(), vboxNetworkUndefine() and vboxNetworkDestroy() to handle multiple host only interfaces as multiple host only interfaces are supported by VirtualBox 3.0 and greater. The patch's are as below: PATCH 1/2: Merged vboxNetworkCreateXML() and vboxNetworkDefineXML() and added code to handle multiple hostonly interfaces. PATCH 2/2: Merged vboxNetworkUndefine() and vboxNetworkDestroy() and added code to handle multiple hostonly interfaces. Regards, Pritesh

3 2

[libvirt] [PATCH] esx_vi: remove unreachable code
by Jim Meyering 03 Sep '09

03 Sep '09

This removes dead code and suppresses a warning from clang. However, see below: >From 2ed548cbe948aa7ef37ccd121bd084bd05019ac8 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Thu, 3 Sep 2009 16:35:47 +0200 Subject: [PATCH] esx_vi: remove unreachable code * src/esx/esx_vi.c (esxVI_Enumeration_Deserialize): Remove unreachable code. --- src/esx/esx_vi.c | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index 0da908b..c689a7a 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -857,8 +857,6 @@ esxVI_Enumeration_Deserialize(virConnectPtr conn, failure: goto cleanup; - - result = -1; } -------------------------------------------- This function does not allow the caller to distinguish via its return value whether it has failed. It always returns 0. I see that this function's return value is used in numerous places (each esxVI_.*Deserialize function), so this should be fixed. int esxVI_Enumeration_Deserialize(virConnectPtr conn, const esxVI_Enumeration *enumeration, xmlNodePtr node, int *value) { int i; int result = 0; char *name = NULL; if (value == NULL) { ESX_VI_ERROR(conn, VIR_ERR_INTERNAL_ERROR, "Invalid argument"); goto failure; } *value = 0; /* undefined */ if (esxVI_String_DeserializeValue(conn, node, &name) < 0) { goto failure; } for (i = 0; enumeration->values[i].name != NULL; ++i) { if (STREQ(name, enumeration->values[i].name)) { *value = enumeration->values[i].value; goto cleanup; } } ESX_VI_ERROR(conn, VIR_ERR_INTERNAL_ERROR, "Unknown value '%s' for %s", name, enumeration->type); cleanup: VIR_FREE(name); return result; failure: goto cleanup; }

2 2

[libvirt] [PATCH 0/1] Support huge pages in guests
by Daniel P. Berrange 03 Sep '09

03 Sep '09

This patch is an update of John Cooper's original work from last month http://www.redhat.com/archives/libvir-list/2009-July/msg00753.html Changes since that patch - We create a directory $MOUNTPOINT/libvirt/qemu inside the hugetlbfs mount point. This is neccessary because QEMU now runs as 'qemu:qemu' in Fedora and thus cannot create files in the root. libvirtd will automatically chown() this subdir to allow QEMU guests access - Don't automatically probe for hugetlbfs mount if runing as an unprivileged libvirtd, since user won't have access to the mount unless administrator has manually created them a subdir. - Change the XML to look like <memoryBacking> <hugepages/> </memoryBacking> This is because I fear we may have more config options for memory backing store in the future, such as whether KVM can use KSM for sharing on the guest. - Add a test case for it in the XML -> ARGV convetor - Document the new XML options - Add the new XML options to the RNG schema - Fix setup & auto-detection of hugetlbfs mount if no qemu.conf file exists at all - Add config parameter to the augeas schema - Move the code which finds a mount point into util.c since its not specific to QEMU

4 5

[libvirt] PATCH 0/0: Support setting a disk drive serial (number) v2
by Daniel P. Berrange 03 Sep '09

03 Sep '09

This is a second version of the patch posted here http://www.redhat.com/archives/libvir-list/2009-August/msg00341.html In this version, I make the QEMU driver refuse to run with any serial that doesn't contain 0-9, a-Z, -, _, since there's no way to escape special chars in QEMU command line args. Hopefully we can lift this restriction in a future version of QEMU I also add a check that serial=s is actually supported by QEMU

3 3

[libvirt] [PATCH] mdns.c: remove dead initialization
by Jim Meyering 03 Sep '09

03 Sep '09

The only following uses of group look like this: (always preceded by initialization): AVAHI_DEBUG("Client collision/connecting %p", mdns->client); group = mdns->group; while (group) { if (group->handle) avahi_entry_group_reset(group->handle); group = group->next; } So the value used in the initialization at the top is never used. >From 515e4a4542ce396b8775c618cbe17a30b78299b4 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Thu, 3 Sep 2009 13:45:22 +0200 Subject: [PATCH] mdns.c: remove dead initialization * qemud/mdns.c (libvirtd_mdns_client_callback): Remove dead initialization. --- qemud/mdns.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/qemud/mdns.c b/qemud/mdns.c index ae6ff08..73b7d11 100644 --- a/qemud/mdns.c +++ b/qemud/mdns.c @@ -178,7 +178,7 @@ static void libvirtd_mdns_create_services(struct libvirtd_mdns_group *group) { static void libvirtd_mdns_client_callback(AvahiClient *c, AvahiClientState state, void *userdata) { struct libvirtd_mdns *mdns = (struct libvirtd_mdns *)userdata; - struct libvirtd_mdns_group *group = mdns->group; + struct libvirtd_mdns_group *group; if (!mdns->client) mdns->client = c; -- 1.6.4.2.395.ge3d52

2 1

[libvirt] [PATCH] node_device_conf.c: remove dead initialization
by Jim Meyering 03 Sep '09

03 Sep '09

The following use of "caps" is the assignment in a for-loop, so the initialization is unnecessary. >From 7032a0b370db1a9489cf19fce0cabbb6959320ab Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Thu, 3 Sep 2009 13:38:57 +0200 Subject: [PATCH] node_device_conf.c: remove dead initialization * src/node_device_conf.c (virNodeDeviceDefFormat): Remove dead initialization. --- src/node_device_conf.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/node_device_conf.c b/src/node_device_conf.c index 56a9bb5..5b25bb7 100644 --- a/src/node_device_conf.c +++ b/src/node_device_conf.c @@ -213,7 +213,7 @@ char *virNodeDeviceDefFormat(virConnectPtr conn, const virNodeDeviceDefPtr def) { virBuffer buf = VIR_BUFFER_INITIALIZER; - virNodeDevCapsDefPtr caps = def->caps; + virNodeDevCapsDefPtr caps; char *tmp; virBufferAddLit(&buf, "<device>\n"); -- 1.6.4.2.395.ge3d52

2 1