- Devel - libvirt List Archives

[libvirt] [PATCH] Fix up 'neccessary -> necessary' in a comment.
by Chris Lalancette 21 Sep '09

21 Sep '09

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- src/virterror.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/virterror.c b/src/virterror.c index 77b295c..e421ab7 100644 --- a/src/virterror.c +++ b/src/virterror.c @@ -641,7 +641,7 @@ virRaiseErrorFull(virConnectPtr conn, /* * All errors are recorded in thread local storage * For compatability, public API calls will copy them - * to the per-connection error object when neccessary + * to the per-connection error object when necessary */ to = virLastErrorObject(); if (!to) -- 1.6.0.6

2 1

[libvirt] [PATCH 2/2] Fix leak in PCI hostdev hot-unplug
by Mark McLoughlin 21 Sep '09

21 Sep '09

* src/qemu_driver.c: sync the hostdev hot-unplug code with the disk/net code. --- src/qemu_driver.c | 20 +++++++++++++------- 1 files changed, 13 insertions(+), 7 deletions(-) diff --git a/src/qemu_driver.c b/src/qemu_driver.c index de31581..2ddcdc0 100644 --- a/src/qemu_driver.c +++ b/src/qemu_driver.c @@ -6206,14 +6206,20 @@ static int qemudDomainDetachHostPciDevice(virConnectPtr conn, pciFreeDevice(conn, pci); } - if (i != --vm->def->nhostdevs) - memmove(&vm->def->hostdevs[i], - &vm->def->hostdevs[i+1], - sizeof(*vm->def->hostdevs) * (vm->def->nhostdevs-i)); - if (VIR_REALLOC_N(vm->def->hostdevs, vm->def->nhostdevs) < 0) { - virReportOOMError(conn); - ret = -1; + if (vm->def->nhostdevs > 1) { + memmove(vm->def->hostdevs + i, + vm->def->hostdevs + i + 1, + sizeof(*vm->def->hostdevs) * + (vm->def->nhostdevs - (i + 1))); + vm->def->nhostdevs--; + if (VIR_REALLOC_N(vm->def->hostdevs, vm->def->nhostdevs) < 0) { + /* ignore, harmless */ + } + } else { + VIR_FREE(vm->def->hostdevs); + vm->def->nhostdevs = 0; } + virDomainHostdevDefFree(detach); return ret; } -- 1.6.2.5

2 1

[libvirt] [PATCH 1/2] Fix net/disk hot-unplug segfault
by Mark McLoughlin 21 Sep '09

21 Sep '09

When we hot-unplug the last device, we're currently double-freeing the device definition. Reported by Michal Nowak here: https://bugzilla.redhat.com/523953 * src/qemu_driver.c: fix double free --- src/qemu_driver.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/qemu_driver.c b/src/qemu_driver.c index a65334f..de31581 100644 --- a/src/qemu_driver.c +++ b/src/qemu_driver.c @@ -5998,7 +5998,7 @@ try_command: /* ignore, harmless */ } } else { - VIR_FREE(vm->def->disks[0]); + VIR_FREE(vm->def->disks); vm->def->ndisks = 0; } virDomainDiskDefFree(detach); @@ -6100,7 +6100,7 @@ qemudDomainDetachNetDevice(virConnectPtr conn, /* ignore, harmless */ } } else { - VIR_FREE(vm->def->nets[0]); + VIR_FREE(vm->def->nets); vm->def->nnets = 0; } virDomainNetDefFree(detach); -- 1.6.2.5

2 2

[libvirt] virsh migrate with libvirt-0.6.2: failed to start listening VM
by David Wilcox 21 Sep '09

21 Sep '09

Hello, I'm trying to migrate a vm from a fedora 11 host to another fedora 11 host. Both hosts are on the same subnet. Both machines have identical architectures. We use an nfs shared storage mounted, but both machines also have their own hard drives. I get the machines up and running alright. Here's the printout of virsh when I try to do the migration. # virsh list Id Name State ---------------------------------- 1 windowsxp running 2 potato running # virsh migrate 1 qemu+ssh://prodigy/system Password: error: operation failed: failed to start listening VM On the other machine, the log file that gets created under /var/log/libvirt/qemo/windowsxp.log LC_ALL=C PATH=/sbin:/usr/sbin:/bin:/usr/bin /usr/bin/qemu-kvm -S -M pc -m 512 -smp 1 -name windowsxp -uuid 24d2fd62-ed4f-a321-e264-200b347cfa6c -monitor pty -pidfile /var/run/libvirt/qemu//windowsxp.pid -localtime -no-acpi -boot c -drive file=/var/lib/libvirt/images/windowsxp.img,if=ide,index=0,boot=on -drive file=/aml/iso/windows_xp_sp3.iso,if=ide,media=cdrom,index=2 -net nic,macaddr=54:52:00:01:f1:06,vlan=0 -net tap,fd=19,vlan=0 -serial pty -parallel none -usb -usbdevice tablet -vnc 127.0.0.1:0 -soundhw es1370 -incoming tcp:0.0.0.0:49159 qemu: could not open disk image /var/lib/libvirt/images/windowsxp.img I would think that the virtual machine should copy from the one machine to the other. Isn't libvirt supposed to copy the image file? What's even stranger, I've been trying this for awhile. It's failed every time, except once when it succeded. I don't know what made it succeed in that case and fail in all the other cases. Thanks.

2 1

[libvirt] regarding the network information for Domain
by anuj rampal 18 Sep '09

18 Sep '09

Hi all, im trying to call libvirt api from windows. I have created a guest OS(windows) using the libvirt api from my windows machine. It gets created fine it also gets the the IP address from the DHCP also. So all works fine. Now to RDP into the machine what I have to do is 1. logon to my host machine. 2. open the guest OS using either "virt-viewer" or "virt-manager". 3. check out the IP address of the machine. 4. then RDP into the guest OS. My Question: Is there a way to find The IP address of the Guest OS.??? ---------------------------------------------------------------------------------------------------------------------------- im also trying to cross compile "virt-viewer 0.0.3" but this is what i get when i do make: [root@FC-11 virt-viewer-0.0.3]# make make all-recursive make[1]: Entering directory `/root/virt-viewer-0.0.3' Making all in src make[2]: Entering directory `/root/virt-viewer-0.0.3/src' /bin/sh ../libtool --tag=CC --mode=link i686-pc-mingw32-gcc -mms-bitfields -I/usr/i686-pc-mingw32/sys-root/mingw/include/gtk-vnc-1.0 -I/usr/i686-pc-mingw32/sys-root/mingw/include/gtk-2.0 -I/usr/i686-pc-mingw32/sys-root/mingw/include -I/usr/i686-pc-mingw32/sys-root/mingw/lib/gtk-2.0/include -I/usr/i686-pc-mingw32/sys-root/mingw/include/atk-1.0 -I/usr/i686-pc-mingw32/sys-root/mingw/include/cairo -I/usr/i686-pc-mingw32/sys-root/mingw/include/pango-1.0 -I/usr/i686-pc-mingw32/sys-root/mingw/include/glib-2.0 -I/usr/i686-pc-mingw32/sys-root/mingw/lib/glib-2.0/include -I/usr/i686-pc-mingw32/sys-root/mingw/include/pixman-1 -I/usr/i686-pc-mingw32/sys-root/mingw/include/libpng12 -mms-bitfields -I/usr/i686-pc-mingw32/sys-root/mingw/include/gtk-2.0 -I/usr/i686-pc-mingw32/sys-root/mingw/lib/gtk-2.0/include -I/usr/i686-pc-mingw32/sys-root/mingw/include/atk-1.0 -I/usr/i686-pc-mingw32/sys-root/mingw/include/cairo -I/usr/i686-pc-mingw32/sys-root/mingw/include/pango-1.0 -I/usr/i686-pc-mingw32/sys-root/mingw/include/glib-2.0 -I/usr/i686-pc-mingw32/sys-root/mingw/lib/glib-2.0/include -I/usr/i686-pc-mingw32/sys-root/mingw/include/pixman-1 -I/usr/i686-pc-mingw32/sys-root/mingw/include/libpng12 -I/usr/i686-pc-mingw32/sys-root/mingw/include/libxml2 -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -fasynchronous-unwind-tables -Wall -Wmissing-prototypes -std=c99 -Wnested-externs -Wpointer-arith -Wextra -Wshadow -Wcast-align -Wwrite-strings -Waggregate-return -Winline -Wredundant-decls -Wno-sign-compare -g -O2 -o virt-viewer.exe virt_viewer-main.o -Wl,-luuid -L/usr/i686-pc-mingw32/sys-root/mingw/lib -lgtk-vnc-1.0 -lgtk-win32-2.0 -lgnutls -lgdk-win32-2.0 -limm32 -lshell32 -lole32 -latk-1.0 -lgdk_pixbuf-2.0 -lpangocairo-1.0 -lgio-2.0 -lcairo -lpangowin32-1.0 -lgdi32 -lpango-1.0 -lm -lgobject-2.0 -lgmodule-2.0 -lglib-2.0 -lintl -Wl,-luuid -L/usr/i686-pc-mingw32/sys-root/mingw/lib -lgtk-win32-2.0 -lgdk-win32-2.0 -limm32 -lshell32 -lole32 -latk-1.0 -lgdk_pixbuf-2.0 -lpangocairo-1.0 -lgio-2.0 -lcairo -lpangowin32-1.0 -lgdi32 -lpango-1.0 -lm -lgobject-2.0 -lgmodule-2.0 -lglib-2.0 -lintl -L/usr/i686-pc-mingw32/sys-root/mingw/lib -lxml2 -lvirt -lpthread ../libtool: line 834: X--tag=CC: command not found ../libtool: line 867: libtool: ignoring unknown tag : command not found ../libtool: line 834: X--mode=link: command not found ../libtool: line 1001: *** Warning: inferring the mode of operation is deprecated.: command not found ../libtool: line 1002: *** Future versions of Libtool will require --mode=MODE be specified.: command not found ../libtool: line 2074: X-mms-bitfields: command not found ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/gtk-vnc-1.0: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/gtk-2.0: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/lib/gtk-2.0/include: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/atk-1.0: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/cairo: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/pango-1.0: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/glib-2.0: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/lib/glib-2.0/include: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/pixman-1: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/libpng12: No such file or directory ../libtool: line 2074: X-mms-bitfields: command not found ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/gtk-2.0: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/lib/gtk-2.0/include: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/atk-1.0: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/cairo: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/pango-1.0: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/glib-2.0: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/lib/glib-2.0/include: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/pixman-1: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/libpng12: No such file or directory ../libtool: line 2239: X-I/usr/i686-pc-mingw32/sys-root/mingw/include/libxml2: No such file or directory ../libtool: line 2239: X-Wp,-D_FORTIFY_SOURCE=2: command not found ../libtool: line 2239: X-fexceptions: command not found ../libtool: line 2239: X-fstack-protector: command not found ../libtool: line 2239: X--param=ssp-buffer-size=4: command not found ../libtool: line 2239: X-fasynchronous-unwind-tables: command not found ../libtool: line 2239: X-Wall: command not found ../libtool: line 2239: X-Wmissing-prototypes: command not found ../libtool: line 2239: X-std=c99: command not found ../libtool: line 2239: X-Wnested-externs: command not found ../libtool: line 2239: X-Wpointer-arith: command not found ../libtool: line 2239: X-Wextra: command not found ../libtool: line 2239: X-Wshadow: command not found ../libtool: line 2239: X-Wcast-align: command not found ../libtool: line 2239: X-Wwrite-strings: command not found ../libtool: line 2239: X-Waggregate-return: command not found ../libtool: line 2239: X-Winline: command not found ../libtool: line 2239: X-Wredundant-decls: command not found ../libtool: line 2239: X-Wno-sign-compare: command not found ../libtool: line 2239: X-g: command not found ../libtool: line 2239: X-O2: command not found ../libtool: line 2202: X-Wl,-luuid: command not found Fatal server error: Server is already active for display 0 If this server is no longer running, remove /tmp/.X0-lock and start again. Please consult the The X.Org Foundation support at http://wiki.x.org for help. ../libtool: line 1958: X-L/usr/i686-pc-mingw32/sys-root/mingw/lib: No such file or directory ../libtool: line 1981: X/root/virt-viewer-0.0.3/src: No such file or directory ../libtool: line 2202: X-Wl,-luuid: command not found Fatal server error: Server is already active for display 0 If this server is no longer running, remove /tmp/.X0-lock and start again. Please consult the The X.Org Foundation support at http://wiki.x.org for help. ../libtool: line 1958: X-L/usr/i686-pc-mingw32/sys-root/mingw/lib: No such file or directory ../libtool: line 1981: X/root/virt-viewer-0.0.3/src: No such file or directory ../libtool: line 1958: X-L/usr/i686-pc-mingw32/sys-root/mingw/lib: No such file or directory ../libtool: line 1981: X/root/virt-viewer-0.0.3/src: No such file or directory ../libtool: line 2408: Xvirt-viewer.exe: command not found ../libtool: line 2413: X/usr/lib/qt-3.3/bin:/usr/kerberos/sbin:/usr/kerberos/bin:/usr/lib/ccache:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin: No such file or directory ../libtool: line 2420: Xvirt-viewer.exe: command not found ../libtool: line 2555: X-lgtk-vnc-1.0: command not found ../libtool: line 2555: X-lgtk-win32-2.0: command not found ../libtool: line 2555: X-lgnutls: command not found ../libtool: line 2555: X-lgdk-win32-2.0: command not found ../libtool: line 2555: X-limm32: command not found ../libtool: line 2555: X-lshell32: command not found ../libtool: line 2555: X-lole32: command not found ../libtool: line 2555: X-latk-1.0: command not found ../libtool: line 2555: X-lgdk_pixbuf-2.0: command not found ../libtool: line 2555: X-lpangocairo-1.0: command not found ../libtool: line 2555: X-lgio-2.0: command not found ../libtool: line 2555: X-lcairo: command not found ../libtool: line 2555: X-lpangowin32-1.0: command not found ../libtool: line 2555: X-lgdi32: command not found ../libtool: line 2555: X-lpango-1.0: command not found ../libtool: line 2555: X-lgobject-2.0: command not found ../libtool: line 2555: X-lgmodule-2.0: command not found ../libtool: line 2555: X-lglib-2.0: command not found ../libtool: line 2555: X-lintl: command not found ../libtool: line 2555: X-lgtk-win32-2.0: command not found ../libtool: line 2555: X-lgdk-win32-2.0: command not found ../libtool: line 2555: X-limm32: command not found ../libtool: line 2555: X-lshell32: command not found ../libtool: line 2555: X-lole32: command not found ../libtool: line 2555: X-latk-1.0: command not found ../libtool: line 2555: X-lgdk_pixbuf-2.0: command not found ../libtool: line 2555: X-lpangocairo-1.0: command not found ../libtool: line 2555: X-lgio-2.0: command not found ../libtool: line 2555: X-lcairo: command not found ../libtool: line 2555: X-lpangowin32-1.0: command not found ../libtool: line 2555: X-lgdi32: command not found ../libtool: line 2555: X-lpango-1.0: command not found ../libtool: line 2555: X-lgobject-2.0: command not found ../libtool: line 2555: X-lgmodule-2.0: command not found ../libtool: line 2555: X-lglib-2.0: command not found ../libtool: line 2555: X-lintl: command not found ../libtool: line 2555: X-lxml2: command not found ../libtool: line 2555: X-lvirt: command not found ../libtool: line 2555: X-lpthread: command not found ../libtool: line 2637: X-L/root/virt-viewer-0.0.3/src: No such file or directory ../libtool: line 2555: X-lgtk-vnc-1.0: command not found ../libtool: line 2555: X-lgnutls: command not found ../libtool: line 2555: X-lgtk-win32-2.0: command not found ../libtool: line 2555: X-lgdk-win32-2.0: command not found ../libtool: line 2555: X-limm32: command not found ../libtool: line 2555: X-lshell32: command not found ../libtool: line 2555: X-lole32: command not found ../libtool: line 2555: X-latk-1.0: command not found ../libtool: line 2555: X-lgdk_pixbuf-2.0: command not found ../libtool: line 2555: X-lpangocairo-1.0: command not found ../libtool: line 2555: X-lgio-2.0: command not found ../libtool: line 2555: X-lcairo: command not found ../libtool: line 2555: X-lpangowin32-1.0: command not found ../libtool: line 2555: X-lgdi32: command not found ../libtool: line 2555: X-lpango-1.0: command not found ../libtool: line 2555: X-lgobject-2.0: command not found ../libtool: line 2555: X-lgmodule-2.0: command not found ../libtool: line 2555: X-lglib-2.0: command not found ../libtool: line 2555: X-lintl: command not found ../libtool: line 2555: X-lxml2: command not found ../libtool: line 2555: X-lvirt: command not found ../libtool: line 2555: X-lpthread: command not found ../libtool: line 2637: X-L/root/virt-viewer-0.0.3/src: No such file or directory ../libtool: line 2555: X-lgtk-vnc-1.0: command not found ../libtool: line 2555: X-lgnutls: command not found ../libtool: line 2555: X-lgtk-win32-2.0: command not found ../libtool: line 2555: X-lgdk-win32-2.0: command not found ../libtool: line 2555: X-limm32: command not found ../libtool: line 2555: X-lshell32: command not found ../libtool: line 2555: X-lole32: command not found ../libtool: line 2555: X-latk-1.0: command not found ../libtool: line 2555: X-lgdk_pixbuf-2.0: command not found ../libtool: line 2555: X-lpangocairo-1.0: command not found ../libtool: line 2555: X-lgio-2.0: command not found ../libtool: line 2555: X-lcairo: command not found ../libtool: line 2555: X-lpangowin32-1.0: command not found ../libtool: line 2555: X-lgdi32: command not found ../libtool: line 2555: X-lpango-1.0: command not found ../libtool: line 2555: X-lgobject-2.0: command not found ../libtool: line 2555: X-lgmodule-2.0: command not found ../libtool: line 2555: X-lglib-2.0: command not found ../libtool: line 2555: X-lintl: command not found ../libtool: line 2555: X-lxml2: command not found ../libtool: line 2555: X-lvirt: command not found ../libtool: line 2555: X-lpthread: command not found ../libtool: line 5172: Xi686-pc-mingw32-gcc "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" -o @OUTPUT@ virt_viewer-main.o -L/root/virt-viewer-0.0.3/src -lgtk-vnc-1.0 -lgnutls -lgtk-win32-2.0 -lgdk-win32-2.0 -limm32 -lshell32 -lole32 -latk-1.0 -lgdk_pixbuf-2.0 -lpangocairo-1.0 -lgio-2.0 -lcairo -lpangowin32-1.0 -lgdi32 -lpango-1.0 -lgobject-2.0 -lgmodule-2.0 -lglib-2.0 -lintl -lxml2 -lvirt -lpthread: No such file or directory ../libtool: line 5173: Xi686-pc-mingw32-gcc "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" -o @OUTPUT@ virt_viewer-main.o -L/root/virt-viewer-0.0.3/src -lgtk-vnc-1.0 -lgnutls -lgtk-win32-2.0 -lgdk-win32-2.0 -limm32 -lshell32 -lole32 -latk-1.0 -lgdk_pixbuf-2.0 -lpangocairo-1.0 -lgio-2.0 -lcairo -lpangowin32-1.0 -lgdi32 -lpango-1.0 -lgobject-2.0 -lgmodule-2.0 -lglib-2.0 -lintl -lxml2 -lvirt -lpthread: No such file or directory Fatal server error: Server is already active for display 0 If this server is no longer running, remove /tmp/.X0-lock and start again. Please consult the The X.Org Foundation support at http://wiki.x.org for help. ../libtool: line 5182: : command not found make[2]: Leaving directory `/root/virt-viewer-0.0.3/src' Making all in man make[2]: Entering directory `/root/virt-viewer-0.0.3/man' make[2]: Nothing to be done for `all'. make[2]: Leaving directory `/root/virt-viewer-0.0.3/man' Making all in plugin make[2]: Entering directory `/root/virt-viewer-0.0.3/plugin' make[2]: Nothing to be done for `all'. make[2]: Leaving directory `/root/virt-viewer-0.0.3/plugin' make[2]: Entering directory `/root/virt-viewer-0.0.3' make[2]: Leaving directory `/root/virt-viewer-0.0.3' make[1]: Leaving directory `/root/virt-viewer-0.0.3' could any1 help me out with this. Thanks in advance. Regards Anuj

2 1

[libvirt] guests and pulseaudio fighting over audio devices
by Dave Allan 17 Sep '09

17 Sep '09

I noticed that when a KVM guest created with virt-manager is running on F10, sound on the physical host stops working. When all VMs are shutdown, sound starts working again. Removing the <sound> tag from the VM XML allows sound to work while the VM is booted. To further complicate troubleshooting, if audio is already playing when the guest is started it keeps playing, since pulse already has the device open. The message in /var/log/messages when I try to play audio is: pulseaudio[6492]: module-alsa-sink.c: Error opening PCM device front:0: Device or resource busy strace of pulseaudio shows: open("/dev/snd/pcmC0D0p", O_RDWR|O_NONBLOCK) = -1 EBUSY (Device or resource busy) but fuser and lsof show nothing. A trivial test program also sees Device or resource busy when trying to open /dev/snd/pcmC0D0p I am in favor of removing the <sound> tag from the default configuration, since I don't use sound from within guests and I do use sound on my desktop, but perhaps this behavior is specific to my configuration. I haven't investigated it exhaustively. What does everybody else think? Dave

2 2

[libvirt] Resubmission: [PATCH 0/6] sVirt AppArmor security driver
by Jamie Strandboge 16 Sep '09

16 Sep '09

Resubmitting based on feedback from this list. Notably, *alloc calls have been removed and syntax-check completes without error for all files. Jamie On Fri, 04 Sep 2009, Jamie Strandboge wrote: > This patch series implements the AppArmor security driver for sVirt. > This implementation was developed for the Ubuntu AppArmorLibvirtProfile > specification[1], but is general enough for any AppArmor deployment > (such as Ubuntu, *SUSE and Mandriva). > > This patch has seen quite a bit of real world testing in Ubuntu 9.10 > (our development release) in our 0.7.0-1ubuntu3 package. I did make a > few small changes after going through HACKING, but mostly I got the > tests going and added documentation. > > DESIGN > ------ > When a virtual machine is started, determine if a profile is currently > defined for the machine, and use it if available. If not, generate a new > profile for the machine based on a template, which is by default a very > restrictive profile allowing access to disk files, and anything else > needed to run, such as the pid, monitor and log files. > > Virtual machines should have a unique profile specific to that machine. > To ensure uniqueness, the profile name will be derived from the UUID of > the virtual machine. These profiles should be configurable, either by > adjusting the profile template for new machines, creating/modifying the > VM profile directly or through the use of AppArmor abstractions. This > will allow for administrators to fine-tune confinement for individual > machines if desired. > > If enabled at compile time, the sVirt security model will be activated > if AppArmor is available on the host OS and a profile for the libvirtd > daemon is loaded when libvirtd is started. > > libvirtd should not be allowed to create arbitrary profiles or modify > profiles directly, so as to not allow libvirtd to potentially (ie via a > security bug in libvirtd itself) bootstrap out of AppArmor confinement. > > Because root privileges are needed to manipulate AppArmor profiles, > qemu:///session will not be supported at this time, but the > implementation must allow for a confined libvirtd with qemu:///session > guests running unconfined. This can be revisited when AppArmor supports > per-user profiles. > > Please see the specification[1] for more details. > > > PATCHES > ------- > The patches are all against trunk as of yesterday. Testing was done on > trunk and there seem to be no regressions over the the 0.7.0-1ubuntu3 > package in Ubuntu. > > > [PATCH 1*] > patch_1a_reenable-nonfile-labels.patch: > When James Morris originally submitted his sVirt patches (as seen in > libvirt 0.6.1), he did not require on disk labelling for > virSecurityDomainRestoreImageLabel. A later commit[2] changed this > behavior to assume on disk labelling, which halts implementations for > path-based MAC systems such as AppArmor and TOMOYO where > vm->def->seclabel is required to obtain the label. This patch simply > adds the 'virDomainObjPtr vm' argument back to *RestoreImageLabel. > > patch_1b_optional.patch: > Due to the above change, 'make syntax-check' fails because > SELinuxRestoreSecurityImageLabel() does not use the 'virDomainObjPtr > vm'. patch_1b_optional.patch is a simple patch to fix this by checking > if vm->def->seclabel == NULL and returns with error if it does. I > realize this may not be desired in the long term, but it should be > harmless enough to include. > > > [PATCH 2] > patch_2_security_c.patch: > Updates src/security.c for AppArmor > > > [PATCH 3] > patch_3_security_apparmor.patch: > Adds security_apparmor.c, security_apparmor.h, virt-aa-helper.c and > updates po/POTFILES.in. virt-aa-helper.c is a new binary which is used > exclusively by the AppArmor security driver to manipulate AppArmor. > These files compile without warning and pass syntax-check. > > > [PATCH 4] > patch_4_tests.patch: > Adds tests for virt-aa-helper and the security driver. secaatest.c is > identical to seclabeltest.c except it initializes the 'apparmor' driver > instead of 'selinux'. These tests are integrated into 'make check' and > pass. > > > [PATCH 5] > patch_5_docs.patch: > Updates docs/drvqemu.html.in for AppArmor and adds profile examples to > examples/apparmor. > > > [PATCH 6] > patch_6_autoconf.patch: > Updates Makefile.am and configure.in for AppArmor. It is based on and > should operate the same as the SELinux configuration. > > > Caveats and known issues: > 1. it does not take advantage of the recent host device labelling > functionality yet > 2. it does not properly handle hot-plugging of devices yet > 3. qemu:///session runs unconfined (see above) > > > Thanks! > > Jamie (jdstrand on Freenode and OFTC) > > [1] https://wiki.ubuntu.com/SecurityTeam/Specifications/AppArmorLibvirtProfile > [2] http://libvirt.org/git/?p=libvirt.git;a=commit;h=c86afc85ee0d1ec6d76c2d254b… > -- Jamie Strandboge | http://www.canonical.com

4 14

[libvirt] Passing -no-kvm-irqchip to KVM/QEMU guests
by Garry Dolley 16 Sep '09

16 Sep '09

Dear libvirt, Is there a way to tell a KVM/QEMU guest managed by libvirt to start with the "-no-kvm-irqchip" argument? I have some FreeBSD 7 guests with timing issues, and if I try to start the VMs manually with -no-kvm-irqchip, the timing issues go away (the only known workaround right now). However, if the guest is managed by libvirt, I have found no way to pass this command line option. I'm running libvirt 0.6.4 on Ubuntu 9.04 Thoughts? -- Garry Dolley ARP Networks, Inc. | http://www.arpnetworks.com | (818) 206-0181 Data center, VPS, and IP Transit solutions Member Los Angeles County REACT, Unit 336 | WQGK336 Blog http://scie.nti.st

3 3

[libvirt] Python binding to virConnectListInterfaces
by Shahar Klein 16 Sep '09

16 Sep '09

Hi I'm trying to implement virConnectListInterfaces for the ESX driver (actually the esx_interface driver) but the python generator does not write the code for this function in generator.py this function is in a special table called: skip_impl and there is a comment saying: # Class methods which are written by hand in libvir.c but the Python-level # code is still automatically generated (so they are not in skip_function()) I'm not sure what does it mean should I implement in libvir.c? and I'm done? thanks ahead Shahar

4 8

[libvirt] ESX driver does not support vmxnet3
by Shahar Klein 16 Sep '09

16 Sep '09

diff --git a/src/esx/esx_vmx.c b/src/esx/esx_vmx.c index 70e9305..6bd6b93 100644 --- a/src/esx/esx_vmx.c +++ b/src/esx/esx_vmx.c @@ -1409,10 +1409,11 @@ esxVMX_ParseEthernet(virConnectPtr conn, virConfPtr conf, int controller, if (virtualDev != NULL && STRCASENEQ(virtualDev, "vlance") && STRCASENEQ(virtualDev, "vmxnet") && + STRCASENEQ(virtualDev, "vmxnet3") && STRCASENEQ(virtualDev, "e1000")) { ESX_ERROR(conn, VIR_ERR_INTERNAL_ERROR, "Expecting VMX entry '%s' to be 'vlance' or 'vmxnet' or " - "'e1000' but found '%s'", virtualDev_name, virtualDev); + "'vmxnet3' or 'e1000' but found '%s'", virtualDev_name, virtualDev); goto failure; }

3 2