- Devel - libvirt List Archives

[PATCH v2 0/5] Further Debian/Ubuntu Apparmor Delta
by Christian Ehrhardt 10 Aug '20

10 Aug '20

Hi, I don't even remember which number of submissions that is #5 maybe? Anyway - I'm hereby continuing to bring Debian and Ubuntu apparmor Delta into upstream libvirt. I have kept out all patches that are either Distro-specific or we ran into trouble/discussions in the past. But there are enough left for a new submission. I have kept the most-original (read the earliest - as some patches appeared in Ubuntu and later with a different Author in Debian) patch author that I could find intact and git-send-email should auto-cc them. I added some more bug links and descriptions so one can understand the case a commit tries to fix without knowing too much context. Update since v1: - drop a few commits that in discussion turned out to be not/no-more needed - fixed a few typos - added the ack's that I received by Jamie Strandboge Christian Ehrhardt (1): apparmor: let qemu load old shared objects after upgrades Jamie Strandboge (1): apparmor: read only access to overcommit_memory Sam Hartman (1): apparmor: allow default pki path Stefan Bader (2): apparmor: allow libvirtd to call pygrub apparmor: qemu access to @{PROC}/*/auxv for hw_cap src/security/apparmor/libvirt-qemu | 10 ++++++++++ src/security/apparmor/usr.sbin.libvirtd.in | 1 + 2 files changed, 11 insertions(+) -- 2.27.0

2 8

[PATCH] virnetserver: fix some memory leaks in virNetTLSContextReloadForServer
by Jin Yan 10 Aug '20

10 Aug '20

From 55fce33e9cf2d5ea58ebc44b4d78f9c12122fdcb Mon Sep 17 00:00:00 2001 From: Jin Yan <jinyan12(a)huawei.com> Date: Fri, 7 Aug 2020 15:59:45 +0800 Subject: [PATCH] virnetserver: fix some memory leaks in virNetTLSContextReloadForServer These leaks were introduced in commit 15d280fa97b0, use g_autofree for all cert_path pointers. Signed-off-by: Jin Yan <jinyan12(a)huawei.com> --- src/rpc/virnettlscontext.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c index 168f3010ae..37564db14e 100644 --- a/src/rpc/virnettlscontext.c +++ b/src/rpc/virnettlscontext.c @@ -921,10 +921,10 @@ int virNetTLSContextReloadForServer(virNetTLSContextPtr ctxt, { gnutls_certificate_credentials_t x509credBak; int err; - char *cacert = NULL; - char *cacrl = NULL; - char *cert = NULL; - char *key = NULL; + g_autofree char *cacert = NULL; + g_autofree char *cacrl = NULL; + g_autofree char *cert = NULL; + g_autofree char *key = NULL; x509credBak = ctxt->x509cred; ctxt->x509cred = NULL; -- 2.23.0

2 2

[PATCH 0/2] qemu: Add a last-resort warning if object-add/device_add are QAPIfied
by Peter Krempa 08 Aug '20

08 Aug '20

See patch 2/2. Peter Krempa (2): testutilsqemuschema: Add template checker for schema entries qemumonitorjsontest: Add a last-resort warning if object-add/device_add are QAPIfied tests/qemumonitorjsontest.c | 53 +++++++++++++++++ tests/testutilsqemuschema.c | 115 ++++++++++++++++++++++++++++++++++++ tests/testutilsqemuschema.h | 5 ++ 3 files changed, 173 insertions(+) -- 2.26.2

2 3

[libvirt PATCH] Adds e1000e/vmxnet3 Vnet_hdr suuport
by Patrick Magauran 08 Aug '20

08 Aug '20

Libvirt bases its decision about whether to apply the vnet_hdr flag to the tap interface on whether or not the selected model is VirtIO. Originally, VirtIO was the only model to support the vnet_hdr in QEMU; however, the e1000e & vmxnet3 adapters also support it(seemingly from introduction based on commits). This passes the whole packet to the host, reducing emulation overhead and improving performance. Signed-off-by: Patrick Magauran <patmagauran.j(a)gmail.com> --- src/conf/domain_conf.c | 8 +++++++- src/conf/domain_conf.h | 1 + src/libvirt_private.syms | 1 + src/qemu/qemu_interface.c | 8 ++++---- 4 files changed, 13 insertions(+), 5 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 69e0439e7e..cb184110f7 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -30981,7 +30981,13 @@ virDomainNetIsVirtioModel(const virDomainNetDef *net) net->model == VIR_DOMAIN_NET_MODEL_VIRTIO_TRANSITIONAL || net->model == VIR_DOMAIN_NET_MODEL_VIRTIO_NON_TRANSITIONAL); } - +bool +virDomainNetIsVnetCompatModel(const virDomainNetDef *net) +{ + return (virDomainNetIsVirtioModel(net) || + net->model == VIR_DOMAIN_NET_MODEL_E1000E || + net->model == VIR_DOMAIN_NET_MODEL_VMXNET3); +} /* Return listens[i] from the appropriate union for the graphics * type, or NULL if this is an unsuitable type, or the index is out of diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 011bf66cb4..cbc46fdf78 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -3371,6 +3371,7 @@ const char *virDomainNetGetModelString(const virDomainNetDef *net); int virDomainNetSetModelString(virDomainNetDefPtr et, const char *model); bool virDomainNetIsVirtioModel(const virDomainNetDef *net); +bool virDomainNetIsVnetCompatModel(const virDomainNetDef *net); int virDomainNetAppendIPAddress(virDomainNetDefPtr def, const char *address, int family, diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 01c2e710cd..2b64042dd2 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -525,6 +525,7 @@ virDomainNetGetActualVlan; virDomainNetGetModelString; virDomainNetInsert; virDomainNetIsVirtioModel; +virDomainNetIsVnetCompatModel; virDomainNetModelTypeFromString; virDomainNetModelTypeToString; virDomainNetNotifyActualDevice; diff --git a/src/qemu/qemu_interface.c b/src/qemu/qemu_interface.c index ffec992596..8397ed8645 100644 --- a/src/qemu/qemu_interface.c +++ b/src/qemu/qemu_interface.c @@ -255,7 +255,7 @@ qemuInterfaceDirectConnect(virDomainDefPtr def, virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver); unsigned int macvlan_create_flags = VIR_NETDEV_MACVLAN_CREATE_WITH_TAP; - if (virDomainNetIsVirtioModel(net)) + if (virDomainNetIsVnetCompatModel(net)) macvlan_create_flags |= VIR_NETDEV_MACVLAN_VNET_HDR; if (virNetDevMacVLanCreateWithVPortProfile(net->ifname, @@ -417,7 +417,7 @@ qemuInterfaceEthernetConnect(virDomainDefPtr def, } } - if (virDomainNetIsVirtioModel(net)) + if (virDomainNetIsVnetCompatModel(net)) tap_create_flags |= VIR_NETDEV_TAP_CREATE_VNET_HDR; if (net->managed_tap == VIR_TRISTATE_BOOL_NO) { @@ -436,7 +436,7 @@ qemuInterfaceEthernetConnect(virDomainDefPtr def, if (virNetDevMacVLanTapOpen(net->ifname, tapfd, tapfdSize) < 0) goto cleanup; if (virNetDevMacVLanTapSetup(tapfd, tapfdSize, - virDomainNetIsVirtioModel(net)) < 0) { + virDomainNetIsVnetCompatModel(net)) < 0) { goto cleanup; } } else { @@ -559,7 +559,7 @@ qemuInterfaceBridgeConnect(virDomainDefPtr def, template_ifname = true; } - if (virDomainNetIsVirtioModel(net)) + if (virDomainNetIsVnetCompatModel(net)) tap_create_flags |= VIR_NETDEV_TAP_CREATE_VNET_HDR; if (driver->privileged) { -- 2.26.2

4 3

[libvirt PATCH 0/3] some vcpupin/emulatorpin/iothreadpin fixes
by Pavel Hrdina 07 Aug '20

07 Aug '20

We should really unify the code and create helpers used by all of these to prevent all of the bugs fixed by this series. It started by failing libvirt-dbus test suite. After fixing it I checked other relevant APIs and drivers and managed to find other issues. Pavel Hrdina (3): conf: fix detection of available host CPUs for vcpupin test: fix emulator pin info in test driver qemu: consider available CPUs in iothread info output src/conf/domain_conf.c | 18 +++++------------- src/conf/domain_conf.h | 4 ++-- src/libxl/libxl_driver.c | 7 ++++++- src/qemu/qemu_driver.c | 13 ++++++------- src/test/test_driver.c | 12 ++++++++---- 5 files changed, 27 insertions(+), 27 deletions(-) -- 2.26.2

2 6

[PATCH] remote: use SocketMode=0600 when polkit is not compiled
by Daniel P. Berrangé 07 Aug '20

07 Aug '20

The systemd .socket unit files we ship for libvirt daemons use SocketMode=0666 on the assumption that libvirt is built with polkit which provides access control. Some people, however, may have explicitly turned off polkit at build time and not realize that leaves them insecure unless they also change the SocketMode. This addresses that problem by making the SocketMode default to 0600 when polkit is disabled at compile time. Note we cannot automatically fix the case where the user compiles polkit, but then overrides the libvirtd.conf defaults to disable polkit. This is what lead to CVE-2020-15708 in Ubuntu 20.10. We can at least improve the inline comments in the config file to give a clearer warning though, which may have helped avoid the mistaken config. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/meson.build | 5 +++++ src/remote/libvirtd.conf.in | 38 ++++++++++++++++++++++++++--------- src/remote/libvirtd.socket.in | 2 +- 3 files changed, 35 insertions(+), 10 deletions(-) diff --git a/src/meson.build b/src/meson.build index b1c9993bc0..fd23fc55a8 100644 --- a/src/meson.build +++ b/src/meson.build @@ -776,6 +776,11 @@ if conf.has('WITH_LIBVIRTD') unit_conf.set('service', unit['service']) unit_conf.set('sockprefix', unit['sockprefix']) unit_conf.set('deps', unit.get('deps', '')) + if conf.has('WITH_POLKIT') + unit_conf.set('mode', '0666') + else + unit_conf.set('mode', '0600') + endif configure_file( input: unit['service_in'], diff --git a/src/remote/libvirtd.conf.in b/src/remote/libvirtd.conf.in index 2607fbad86..1615f33502 100644 --- a/src/remote/libvirtd.conf.in +++ b/src/remote/libvirtd.conf.in @@ -127,6 +127,8 @@ # # Authentication. # +# There are choices available: +# # - none: do not perform auth checks. If you can connect to the # socket you are allowed. This is suitable if there are # restrictions on connecting to the socket (eg, UNIX @@ -144,21 +146,39 @@ # full read/write access (aka sudo like), while anyone # is allowed read/only access. # + # Set an authentication scheme for UNIX read-only sockets +# # By default socket permissions allow anyone to connect # -# To restrict monitoring of domains you may wish to enable -# an authentication mechanism here +# If libvirt was compiled without support for 'polkit', then +# no access control checks are done, but libvirt still only +# allows execution of APIs which don't change state. +# +# If libvirt was compiled with support for 'polkit', then +# the libvirt socket will perform a check with polkit after +# connections. The default policy still allows any local +# user access. +# +# To restrict monitoring of domains you may wish to either +# enable 'sasl' here, or change the polkit policy definition. #auth_unix_ro = "none" -# Set an authentication scheme for UNIX read-write sockets -# By default socket permissions only allow root. If PolicyKit -# support was compiled into libvirt, the default will be to -# use 'polkit' auth. +# Set an authentication scheme for UNIX read-write sockets. +# +# If libvirt was compiled without support for 'polkit', then +# the systemd .socket files will use SocketMode=0600 by default +# thus only allowing root user to connect, and 'auth_unix_rw' +# will default to 'none'. +# +# If libvirt was compiled with support for 'polkit', then +# the systemd .socket files will use SocketMode=0666 which +# allows any user to connect and 'auth_iunix_rw' will default +# to 'polkit'. If you disable use of 'polkit' here, then it +# is essential to change the systemd SocketMode parameter +# back to 0600, to avoid an insecure configuration. # -# If the unix_sock_rw_perms are changed you may wish to enable -# an authentication mechanism here -#auth_unix_rw = "none" +#auth_unix_rw = "polkit" @CUT_ENABLE_IP@ # Change the authentication scheme for TCP sockets. diff --git a/src/remote/libvirtd.socket.in b/src/remote/libvirtd.socket.in index df36df2125..85b4aa800a 100644 --- a/src/remote/libvirtd.socket.in +++ b/src/remote/libvirtd.socket.in @@ -8,7 +8,7 @@ Before=@service@.service # when using systemd version < 227 ListenStream=@runstatedir@/libvirt/@sockprefix@-sock Service=@service@.service -SocketMode=0666 +SocketMode=@mode@ [Install] WantedBy=sockets.target -- 2.25.4

2 1

[PATCH] qemu: remove use of gettid() syscall
by Daniel P. Berrangé 07 Aug '20

07 Aug '20

This is not expose in most historical versions of glibc, nor non-glibc impls. We must use our wrapper API instead. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- Pushed as build fix src/qemu/qemu_shim.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_shim.c b/src/qemu/qemu_shim.c index 4c06f15779..ef0ba086b5 100644 --- a/src/qemu/qemu_shim.c +++ b/src/qemu/qemu_shim.c @@ -176,8 +176,8 @@ int main(int argc, char **argv) } if (verbose) - g_printerr("%s: %lld: initializing libvirt %d\n", - argv[0], deltams(), gettid()); + g_printerr("%s: %lld: initializing libvirt %llu\n", + argv[0], deltams(), virThreadSelfID()); if (virInitialize() < 0) { g_printerr("%s: cannot initialize libvirt\n", argv[0]); -- 2.25.4

1 0

[PATCH v3 0/5] qemu: Support rbd namespace attribute
by Han Han 07 Aug '20

07 Aug '20

Diff from v2: - rebase to master - update some qemu capabilities tests Test results of this patch series on qemu-5.0.0 and librbd1-14.2.8: disk xml: <disk type='network' device='disk'> <driver name='qemu' type='raw'/> <auth username='admin'> <secret type='ceph' usage='ceph_example'/> </auth> <source protocol='rbd' name='rbd/1' namespace='hhan'> <host name='CEPH_MON'/> </source> <target dev='vde' bus='virtio'/> </disk> Live attach and detach the disk: ➜ ~ virsh attach-device new /tmp/ceph-ns.xml Device attached successfully ➜ ~ virsh dumpxml new|xmllint --xpath //disk - <disk type="file" device="disk"> <driver name="qemu" type="qcow2"/> <source file="/var/lib/libvirt/images/new.qcow2" index="2"/> <backingStore/> <target dev="vda" bus="virtio"/> <serial>WD-WMAP9A966149</serial> <alias name="virtio-disk0"/> <address type="pci" domain="0x0000" bus="0x02" slot="0x00" function="0x0"/> </disk><disk type="network" device="disk"> <driver name="qemu" type="raw"/> <auth username="admin"> <secret type="ceph" usage="ceph_example"/> </auth> <source protocol="rbd" name="rbd/1" namespace="hhan" index="3"> <host name="CEPH_MON"/> </source> <target dev="vde" bus="virtio"/> <alias name="virtio-disk4"/> <address type="pci" domain="0x0000" bus="0x03" slot="0x00" function="0x0"/> </disk> ➜ ~ virsh detach-device new /tmp/ceph-ns.xml Device detached successfully ➜ ~ virsh dumpxml new|xmllint --xpath //disk - <disk type="file" device="disk"> <driver name="qemu" type="qcow2"/> <source file="/var/lib/libvirt/images/new.qcow2" index="2"/> <backingStore/> <target dev="vda" bus="virtio"/> <serial>WD-WMAP9A966149</serial> <alias name="virtio-disk0"/> <address type="pci" domain="0x0000" bus="0x02" slot="0x00" function="0x0"/> </disk> It also works when start VM with this disk. And tests pass when it is tested with -blockdev disabled: <domain type='kvm' xmlns:qemu='http://libvirt.org/schemas/domain/qemu/1.0'> [...] <qemu:capabilities> <qemu:del capability='blockdev'/> <qemu:add capability='drive'/> </qemu:capabilities> </domain> v2: https://www.redhat.com/archives/libvir-list/2020-April/msg00972.html Han Han (5): qemu_capabilities: Add QEMU_CAPS_RBD_NAMESPACE conf: Support to parse rbd namespace attribute qemu: Implement rbd namespace attribute doc: rng schemas and html doc for rbd namespace attribute news: qemu: Support rbd namespace NEWS.rst | 6 +++ docs/formatdomain.rst | 5 ++- docs/schemas/domaincommon.rng | 3 ++ src/conf/domain_conf.c | 4 ++ src/qemu/qemu_block.c | 1 + src/qemu/qemu_capabilities.c | 4 ++ src/qemu/qemu_capabilities.h | 3 ++ src/qemu/qemu_command.c | 7 +++- src/util/virstoragefile.h | 1 + .../caps_5.0.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_5.0.0.ppc64.xml | 1 + .../caps_5.0.0.riscv64.xml | 1 + .../caps_5.0.0.x86_64.xml | 1 + .../caps_5.1.0.x86_64.xml | 1 + ...k-network-rbd-namespace.x86_64-latest.args | 41 +++++++++++++++++++ .../disk-network-rbd-namespace.xml | 33 +++++++++++++++ tests/qemuxml2argvtest.c | 1 + ...sk-network-rbd-namespace.x86_64-latest.xml | 41 +++++++++++++++++++ tests/qemuxml2xmltest.c | 1 + 19 files changed, 154 insertions(+), 2 deletions(-) create mode 100644 tests/qemuxml2argvdata/disk-network-rbd-namespace.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-rbd-namespace.xml create mode 100644 tests/qemuxml2xmloutdata/disk-network-rbd-namespace.x86_64-latest.xml -- 2.27.0

2 12

[PATCH 0/3] qemu: implementation of transient option for qcow2 file
by Masayoshi Mizuma 07 Aug '20

07 Aug '20

Hello, This patchset tries to implement transient option for qcow2 file. It gets user available to set <transient/> to the domain xml file like as: <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/var/lib/libvirt/images/guest.qcow2'/> <target dev='vda' bus='virtio'/> <transient/> </disk> Any changes which the Guest does to the disk is dropped when the Guest is shutdowned. Masayoshi Mizuma (3): qemu: implementation of transient option for qcow2 file testutilsqemu: Assign qemu-img path to driver->qemuImgBinary qemublocktest: add test of transient option for qcow2 file src/qemu/qemu_block.c | 71 +++++++++++++++++++ src/qemu/qemu_block.h | 7 ++ src/qemu/qemu_domain.c | 4 ++ src/qemu/qemu_process.c | 3 + src/qemu/qemu_validate.c | 2 +- tests/qemublocktest.c | 10 +++ .../xml2json/qcow2-transient-srconly.json | 9 +++ .../xml2json/qcow2-transient.json | 13 ++++ .../xml2json/qcow2-transient.xml | 13 ++++ tests/testutilsqemu.c | 6 +- 10 files changed, 136 insertions(+), 2 deletions(-) create mode 100644 tests/qemublocktestdata/xml2json/qcow2-transient-srconly.json create mode 100644 tests/qemublocktestdata/xml2json/qcow2-transient.json create mode 100644 tests/qemublocktestdata/xml2json/qcow2-transient.xml -- 2.27.0

3 12

Is the default discard mode to ignore?
by Chris Murphy 07 Aug '20

07 Aug '20

virt-manager 'Discard Mode" defaults to "Hypervisor default" but I'm not sure if there's ever a case where this could translate into on/unmap? What problems could result if the guest OS file system mount option were to default to 'discard'? Is it reasonable to expect discards will be inhibited by default because of Discard Mode's default setting? What I'm concerned about is the use case of either raw or qcow2 backing files that have been fully preallocated. If discards pass through to the backing file, they become sparse files, which may be suboptimal due to ensuing fragmentation. Of course it's a trade off, you also gain efficient storage of the backing file - it consumes only what the guest uses. But I think the more compatible behavior is to not do discards out of the box. Someone who wants sparse backing files, I expect, will (a) create sparse backing files and (b) set discard mode to unmap. Background and genesis of all of this: RFE: kickstart option to control discard configuration https://bugzilla.redhat.com/show_bug.cgi?id=1860720 Thanks, -- Chris Murphy

2 1