- Devel - libvirt List Archives

[libvirt] Patch to python-virtinst to allow it to choose svirt labels
by Daniel J Walsh 24 Feb '09

24 Feb '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Also found at least one big bug in python-virtinst, VirtualDisk.py was dropping the "/" between dirname and basename of installation object, when you told it to create the object. I think we want to have a big switch stored in libvirt somewhere saying whether or not we want isolated virtual machines. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkme++4ACgkQrlYvE4MpobM5ewCeP3iaq3HwT/Rw71E2YElbxKyg 66gAoJaCUkQkBvJz80wjztYiwOGsAKaj =GlDN -----END PGP SIGNATURE----- diff -r -u virtinst-0.400.1/virtinst/Guest.py virtinst-0.400.1.new/virtinst/Guest.py --- virtinst-0.400.1/virtinst/Guest.py 2009-01-26 14:33:25.000000000 -0500 +++ virtinst-0.400.1.new/virtinst/Guest.py 2009-02-19 17:36:35.000000000 -0500 @@ -32,6 +32,8 @@ import __builtin__ import CapabilitiesParser import VirtualDevice +import selinux +import random import osdict from VirtualDisk import VirtualDisk @@ -315,8 +317,9 @@ self._install_disk = None # VirtualDisk that contains install media if type is None: - type = "xen" - self.type = type + self.type = "xen" + else: + self.type = type if not location is None: self.location = location @@ -526,6 +529,7 @@ self._vcpus = None self._cpuset = None self._graphics_dev = None + self._seclabel = None self._os_type = None self._os_variant = None @@ -552,12 +556,34 @@ self.disknode = None # this needs to be set in the subclass + self.default_seclabel , self.default_imagelabel = self._default_seclabels() + + while self._seclabel == None: + seclabel, imagelabel = self.gen_seclabels() + if self.is_conflict_seclabel(self.conn, seclabel): + continue + self.set_seclabel(seclabel) + self.set_imagelabel(imagelabel) + def get_installer(self): return self._installer def set_installer(self, val): self._installer = val installer = property(get_installer, set_installer) + # Security context used to secure guest image + def get_imagelabel(self): + return self._imagelabel + def set_imagelabel(self, val): + self._imagelabel = val + imagelabel = property(get_imagelabel, set_imagelabel) + + # Security context used to secure guest process + def get_seclabel(self): + return self._seclabel + def set_seclabel(self, val): + self._seclabel = val + seclabel = property(get_seclabel, set_seclabel) def get_type(self): return self._installer.type @@ -565,7 +591,6 @@ self._installer.type = val type = property(get_type, set_type) - # Domain name of the guest def get_name(self): return self._name @@ -750,7 +775,7 @@ if enabled not in (True, False): raise ValueError, _("Graphics enabled must be True or False") - if enabled == True: + if enabled: gdev = VirtualGraphics(type=gtype) if port: gdev.port = port @@ -807,9 +832,23 @@ """Ensure that devices are setup""" for disk in self._install_disks: disk.setup(progresscb) + # Not sure of this, might want to put this in VirtualDisk class + selinux.setfilecon(disk.path, self._imagelabel) for nic in self._install_nics: nic.setup(self.conn) + def _get_seclabel_xml(self): + xml = "" + if self._seclabel != None: + xml = """ + <seclabel model='selinux'> + <label>%s</label> + <image>%s</image> + </seclabel> +""" % ( self._seclabel, self._imagelabel) + print xml + return xml + def _get_disk_xml(self, install=True): """Return xml for disk devices (Must be implemented in subclass)""" raise NotImplementedError @@ -899,6 +938,7 @@ <devices> %(devices)s </devices> + %(secxml)s </domain> """ % { "type": self.type, "name": self.name, \ @@ -909,7 +949,8 @@ "maxramkb": self.maxmemory * 1024, \ "devices": self._get_device_xml(install), \ "osblob": osblob, \ - "action": action } + "action": action, \ + "secxml": self._get_seclabel_xml()} def start_install(self, consolecb=None, meter=None, removeOld=False, @@ -1026,6 +1067,108 @@ if self.domain is not None: raise RuntimeError, _("Domain has already been started!") + def _default_seclabels(self): + try: + fd = open(selinux.selinux_virtual_domain_context_path(), 'r') + except OSError, (err_no, msg): + raise RuntimeError, \ + "failed to SELinux virtual domains context: %s: %s %s" % (selinux.selinux_virtual_domain_context_path(),err_no, msg) + + label = fd.read() + fd.close() + try: + fd = open(selinux.selinux_virtual_image_context_path(), 'r') + except OSError, (err_no, msg): + raise RuntimeError, \ + "failed to SELinux virtual domains context: %s: %s %s" % (selinux.selinux_virtual_domain_context_path(), err_no, msg) + + image = fd.read() + fd.close() + + return (label, image) + + def is_conflict_seclabel(self, conn, seclabel): + """ + check if security label is in use by any other VMs on passed + connection. + + @param conn: connection to check for collisions on + @type conn: libvirt.virConnect + + @param seclabel: Security Label + @type str: Security label + + @return: True if a collision, False otherwise + @rtype: C{bool} + """ + if not seclabel: + return False + + vms = [] + # get working domain's name + ids = conn.listDomainsID() + for i in ids: + try: + vm = conn.lookupByID(i) + vms.append(vm) + except libvirt.libvirtError: + # guest probably in process of dieing + logging.warn("Failed to lookup domain id %d" % i) + # get defined domain + names = conn.listDefinedDomains() + for name in names: + try: + vm = conn.lookupByName(name) + vms.append(vm) + except libvirt.libvirtError: + # guest probably in process of dieing + logging.warn("Failed to lookup domain name %s" % name) + + count = 0 + for vm in vms: + doc = None + try: + doc = libxml2.parseDoc(vm.XMLDesc(0)) + except: + continue + ctx = doc.xpathNewContext() + try: + try: + label = ctx.xpathEval("/domain/seclabel/label/") + if label[0].content == seclabel: + count += 1 + break + except: + continue + finally: + if ctx is not None: + ctx.xpathFreeContext() + if doc is not None: + doc.freeDoc() + if count > 0: + return True + else: + return False + + def _get_random_mcs(self): + f1 = random.randrange(1024) + f2 = random.randrange(1024) + if f1 < f2: + return "s0:c%s,c%s" % (f1, f2) + else: + if f1 == f2: + return "s0:c%s" % f1 + else: + return "s0:c%s,c%s" % (f2, f1) + + def gen_seclabels(self): + mcs = self._get_random_mcs() + con = self.default_seclabel.split(':') + seclabel = "%s:%s:%s:%s" % (con[0], con[1], con[2], mcs) + con = self.default_imagelabel.split(':') + imagelabel = "%s:%s:%s:%s" % (con[0], con[1], con[2], mcs) + return (seclabel, imagelabel) + def _set_defaults(self): if self.uuid is None: while 1: diff -r -u virtinst-0.400.1/virtinst/VirtualDisk.py virtinst-0.400.1.new/virtinst/VirtualDisk.py --- virtinst-0.400.1/virtinst/VirtualDisk.py 2009-01-26 14:33:25.000000000 -0500 +++ virtinst-0.400.1.new/virtinst/VirtualDisk.py 2009-02-19 19:43:44.000000000 -0500 @@ -172,8 +172,6 @@ """ return "%s:%s" %(self.type, self.path) - - def _get_path(self): return self._path def _set_path(self, val, validate=True): @@ -413,7 +411,7 @@ newpath = self.vol_object.path() elif self.vol_install: newpath = _util.get_xml_path(self.vol_install.pool.XMLDesc(0), - "/pool/target/path") + \ + "/pool/target/path") + "/" + \ self.vol_install.name if newpath and newpath != self.path:

3 6

[libvirt] iptables and libvirt
by Karl Wirth 24 Feb '09

24 Feb '09

Hi, I would like your feedback on the following idea. What if we could flexibly change the iptables rules for the different guests as they are deployed onto the node/host. The idea would be to do all of this within the iptables of the host leaving alone the iptables of the guests themselves. Here are some specifics: - Physical systems typically isolated using firewalls protecting well known ports. - With virt, on shared physical device, use a bridge to give full LAN access to vm - Or a virtual network which is an isolated bridge with no physical connection. Guest can talk to each other directly. Only NAT'd outbound. - The idea is to eventually make it easy to centrally set up iptable rules for guests that are applied in the host iptables. - We would have to be able to migrate the iptables rules and the state data with vm as it moves The benefits of this would be we could: - Create networking controls that provide same isolation as physical systems - Control which VMs can talk to which others Integration option: - Integration in virtd because it knows about the guests and their network parameters. Thanks for your feedback. Best regards, Karl

6 8

[libvirt] About virtualization, libvirt and xen...
by Patrick Archibal 24 Feb '09

24 Feb '09

Hello, I have understand that : ---------------------------- guest ---------------------------- driver_device0_guest ---------------------------- hypervisor ---------------------------- driver_device0_hypervisor ---------------------------- device0 ---------------------------- in order to access to a device, a guest use driver_device0_guest The driver_device0_guest is modified to ask the hypervisor instead of the device0 directly. Then the hypervisor uses the driver_device0_hypervisor in order to ask the device0. It's my understant, maybe it's false. I have few questions : 1 - what is the difference between libvirt and virtio. 2 - why developpers for xen, kvm... must develop drivers each time there are new devices ? Because the driver must ask the hypervisor instead of device directly. 3 - The devices presented to the guest are real or emulated ? (for xen and/or kvm) if devices are real, for example, i can use my graphic card with a virtual machine ?? 4 - Can you tell me why kvm is best or xen is best in enterprise. In my understand, in the future, kvm is in good position because the developpment is integrated in the kernel. Also, i feel xen progress because firms like citrix contribute but it's seems there is no big update since few years. My vision is xen is best for production environnement because it takes advantages of minimal hypervisor code while kvm must be install with the kernel. Also, it seems, performance will be better in kvm with virtio. Can we use virtio with xen ? _________________________________________________________________ Vous voulez savoir ce que vous pouvez faire avec le nouveau Windows Live ? Lancez-vous ! http://www.microsoft.com/windows/windowslive/default.aspx

2 1

[libvirt] [Patch 0/1] enable --checkpoint option in 'virsh save'
by Matt McCowan 24 Feb '09

24 Feb '09

Along the lines of Xen's 'xm save' function with the '-c' checkpoint flag, following up is a patch to basically make-it-so, plus enable it for qemu. Patch merges with CVS, and passes tests as described in the HACKING file. The code implementing the '--live' option for 'virsh migrate' was copied/pasted/mod'ed to create the --checkpoint option for 'virsh save' Regards Matt McCowan

2 2

[libvirt] networking static ip address
by Francisco José Martín 23 Feb '09

23 Feb '09

Hi, we are using the 0.6.0 version and an Ubuntu guest os under KVM virtualization. We have tried several ways to assign a static ip address to the guest os eth0 device on boot, but we didn't success. Is there any easy way to do it? We are trying to have a guest with the ip 192.168.0.1 in the eth0 device, enslaved to the br0 bridge on the host machine, which seems to be a pretty easy setup to test. When the guest OS is booted, the eth0 device exists, but is not up, and doesn't have the IP. Regards, Francisco.

3 3

[libvirt] [PATCH 1/5] Fix a typo in hostdev docs
by Mark McLoughlin 23 Feb '09

23 Feb '09

It's: <address bus='0x06' slot='0x02' function='0x0'/> not: <address>bus='0x06' slot='0x02' function='0x0'</address> Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> --- docs/formatdomain.html | 2 +- docs/formatdomain.html.in | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html b/docs/formatdomain.html index 17384b3..17dc0cd 100644 --- a/docs/formatdomain.html +++ b/docs/formatdomain.html @@ -485,7 +485,7 @@ ... <hostdev mode='subsystem' type='pci'> <source> - <address>bus='0x06' slot='0x02' function='0x0'</address> + <address bus='0x06' slot='0x02' function='0x0'/> </source> </hostdev> ...</pre> diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index c1e6a16..ee32354 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -397,7 +397,7 @@ ... <hostdev mode='subsystem' type='pci'> <source> - <address>bus='0x06' slot='0x02' function='0x0'</address> + <address bus='0x06' slot='0x02' function='0x0'/> </source> </hostdev> ...</pre> -- 1.6.0.6

2 9

[libvirt] networking with VMs on two nodes
by Andreas Rittershofer 23 Feb '09

23 Feb '09

I have two nodes and on each several virtual machines running under KVM/qemu. I've set up the default-network on each node and so I can: 1.) ping from host do guest 2.) ping from guest to host 3.) ping from guest tu guest But all this is only possibe on each node by itself. What I need now is network connection between a VM on node 1 to another VM on node 2. How to setup this? When both nodes are fine every node runs a few guests. But when one node goes down, all guests have to be run on the remaining node. mfg ar -- Hier könnte keine Signatur stehen.

1 0

[libvirt] Re: [et-mgmt-tools] attach hot usb device
by Cole Robinson 23 Feb '09

23 Feb '09

cc-ing libvir-list (future libvirt questions should be directed there) jmandawg wrote: > Hi, > > > > Quick question, since I can’t get to the qemu monitor anymore, how do I > hot add a usb device (smartphone)? > > Is it possible to do through virsh? > Sure: - Use 'lsusb' to determine the bus and device. Example listing looks like: Bus 001 Device 006: ID 0781:5151 SanDisk Corp. Cruzer Micro 256/512MB Flash Drive - Put hostdev xml in a file: cat << __EOF__ > usb.xml <hostdev mode='subsystem' type='usb'> <source> <address bus='1' device='6'/> </source> </hostdev> __EOF__ - Run 'virsh attach-device {VMNAME} usb.xml' on a running VM. Hope that helps, Cole

2 3

[libvirt] Networking with libvirt
by Andreas Rittershofer 22 Feb '09

22 Feb '09

I want to setup networking under KVM and with libvirt. I read a lot the last two days, but it is not working as desired. I don't want bridging, I want it with a tap-device created via vde_switch. I cannot figure out what to put in /etc/libvirt/qemu/machine.xml and /etc/ libvirt/qemu/networks/network.xml - there is no really good documentation. /var/log/libvirt/qemu/maschine.log shows a lot of parameters when I start the VM with virsh start machine, but I cannot figure out where to set these values or where to set the defaults. mfg ar -- Hier könnte keine Signatur stehen.

1 2

[libvirt] update documentation
by jesse lauren farinacci 22 Feb '09

22 Feb '09

I hit a small snag when following the documentation, specifically the doc says to use <clock sync='localtime'/> when it should say <clock offset='localtime'/>.

4 5