- Devel - libvirt List Archives

[libvirt] [PATCH 00/17] Refactor virt-login-shell and nss module
by Daniel P. Berrangé 07 Aug '19

07 Aug '19

As previously discussed, it is desirable to move libvirt to a model where we abort-on-OOM, possibly making use of glib2. This would be good for libvirt in general, but it is bad for a couple of libvirt addons. The virt-login-shell setuid program would be ok with abort-on-OOM, but absolutely can never link to glib2 in a setuid setup. The NSS module cannot tolerate abort-on-OOM as it is dyn loaded in to every process on the host, some of which wish to be robust on OOM. It is not practical to restrict abort-on-OOM to only the pieces of code not used by NSS, nor is it practical to conditionally build with & without abort-on-OOM. The solution to both these problems is to refactor the code such that it does not use any common libvirt code. Only direct libc APIs are permitted, and for the NSS module the yajl library. For virt-login-shell this refactoring actually makes the entire solution more pleasant to deal with, so is a win regardless. For the NSS module, the code is a little less attractive by using the lower level libc APIs. The need to use the yajl APIs directly also makes parsing MACs/leases much more verbose. This is still tolerable though, given the benefit of switching the other libvirt code to abort-on-OOM. Daniel P. Berrangé (17): tools: fix crash in virt-login-shell if config doesn't exist tools: fix double error reporting in virt-login-shell tools: rename source for virt-login-shell tools: split virt-login-shell into two binaries build: drop libvirt setuid library build util: get rid of virIsSUID method util: simplify virCommand APIs for env passthrough. util: get rid of virGetEnv{Allow,Block}SUID functions nss: remove use for virDir helper APIs nss: remove use for virString helper APIs nss: remove use for virFile helper APIs nss: refactor code for processing mac addresses nss: custom parser for loading .macs file nss: custom parser for loading .leases file nss: directly use getnameinfo/getaddrinfo nss: remove last usages of libvirt headers nss: only link to yajl library and nothing else .gitignore | 1 + cfg.mk | 25 +- config-post.h | 54 ---- configure.ac | 3 - libvirt.spec.in | 1 + src/Makefile.am | 174 ------------- src/libvirt-admin.c | 2 +- src/libvirt.c | 47 ++-- src/libvirt_private.syms | 6 +- src/lxc/lxc_process.c | 2 +- src/network/leaseshelper.c | 14 +- src/qemu/qemu_command.c | 8 +- src/qemu/qemu_firmware.c | 2 +- src/remote/remote_driver.c | 25 +- src/rpc/virnetlibsshsession.c | 2 +- src/rpc/virnetsocket.c | 16 +- src/rpc/virnettlscontext.c | 2 +- src/util/virauth.c | 2 +- src/util/vircommand.c | 48 +--- src/util/vircommand.h | 8 +- src/util/virfile.c | 7 +- src/util/virlease.c | 4 +- src/util/virlog.c | 15 +- src/util/virsystemd.c | 8 +- src/util/virutil.c | 48 +--- src/util/virutil.h | 4 - src/vbox/vbox_XPCOMCGlue.c | 2 +- src/vbox/vbox_common.c | 2 +- tests/commandtest.c | 8 +- tools/Makefile.am | 43 ++-- tools/nss/libvirt_nss.c | 343 ++++++++----------------- tools/nss/libvirt_nss.h | 24 ++ tools/nss/libvirt_nss_leases.c | 429 +++++++++++++++++++++++++++++++ tools/nss/libvirt_nss_leases.h | 40 +++ tools/nss/libvirt_nss_macs.c | 287 +++++++++++++++++++++ tools/nss/libvirt_nss_macs.h | 29 +++ tools/virsh.c | 2 +- tools/virt-login-shell-helper.c | 439 ++++++++++++++++++++++++++++++++ tools/virt-login-shell.c | 421 ++++-------------------------- tools/vsh.c | 12 +- 40 files changed, 1521 insertions(+), 1088 deletions(-) create mode 100644 tools/nss/libvirt_nss_leases.c create mode 100644 tools/nss/libvirt_nss_leases.h create mode 100644 tools/nss/libvirt_nss_macs.c create mode 100644 tools/nss/libvirt_nss_macs.h create mode 100644 tools/virt-login-shell-helper.c -- 2.21.0

2 18

[libvirt] [PATCH] src: security: Replace bitwise OR with logical OR
by Erik Skultety 07 Aug '19

07 Aug '19

Typo introduced by commit d73f3f58360. https://bugzilla.redhat.com/show_bug.cgi?id=1738483 Signed-off-by: Erik Skultety <eskultet(a)redhat.com> --- Pushed as trivial. src/security/security_util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/security/security_util.c b/src/security/security_util.c index ad265b0bc5..9d3f483f6b 100644 --- a/src/security/security_util.c +++ b/src/security/security_util.c @@ -268,7 +268,7 @@ virSecurityMoveRememberedLabel(const char *name, VIR_AUTOFREE(char *) attr_name = NULL; VIR_AUTOFREE(char *) attr_value = NULL; - if (!(ref_name = virSecurityGetRefCountAttrName(name)) | + if (!(ref_name = virSecurityGetRefCountAttrName(name)) || !(attr_name = virSecurityGetAttrName(name))) return -1; -- 2.20.1

1 0

[libvirt] [PATCH] test_driver: implement virDomainReset
by Ilias Stamatis 07 Aug '19

07 Aug '19

The qemu and vz implementations don't emit any signals when this API is called, so we can do the same here for now and succeed by doing nothing. Signed-off-by: Ilias Stamatis <stamatis.iliass(a)gmail.com> --- src/test/test_driver.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/src/test/test_driver.c b/src/test/test_driver.c index d9a7f815d5..6bca4e277f 100755 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -2004,6 +2004,28 @@ static int testDomainReboot(virDomainPtr domain, } +static int +testDomainReset(virDomainPtr dom, + unsigned int flags) +{ + virDomainObjPtr vm; + int ret = -1; + + virCheckFlags(0, -1); + + if (!(vm = testDomObjFromDomain(dom))) + return -1; + + if (virDomainObjCheckActive(vm) < 0) + goto cleanup; + + ret = 0; + cleanup: + virDomainObjEndAPI(&vm); + return ret; +} + + static char * testDomainGetHostname(virDomainPtr domain, unsigned int flags) @@ -8878,6 +8900,7 @@ static virHypervisorDriver testHypervisorDriver = { .domainShutdown = testDomainShutdown, /* 0.1.1 */ .domainShutdownFlags = testDomainShutdownFlags, /* 0.9.10 */ .domainReboot = testDomainReboot, /* 0.1.1 */ + .domainReset = testDomainReset, /* 5.7.0 */ .domainDestroy = testDomainDestroy, /* 0.1.1 */ .domainDestroyFlags = testDomainDestroyFlags, /* 4.2.0 */ .domainGetOSType = testDomainGetOSType, /* 0.1.9 */ -- 2.22.0

2 1

[libvirt] [PATCH] test_driver: implement virDomainSetTime and update virDomainGetTime
by Ilias Stamatis 07 Aug '19

07 Aug '19

Until now, testDomainGetTime would always return the same fixed value everytime it was called. By using domain-private data we can make this API return the values previously set with testDomainSetTime, or use the same old fixed value in case testDomainSetTime hasn't been called at all. --- src/test/test_driver.c | 45 ++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 43 insertions(+), 2 deletions(-) diff --git a/src/test/test_driver.c b/src/test/test_driver.c index d9a7f815d5..6a75e63429 100755 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -392,6 +392,11 @@ struct _testDomainObjPrivate { testDriverPtr driver; bool frozen[2]; /* used by file system related calls */ + + + /* used by get/set time APIs */ + long long seconds; + unsigned int nseconds; }; @@ -406,6 +411,9 @@ testDomainObjPrivateAlloc(void *opaque) priv->driver = opaque; priv->frozen[0] = priv->frozen[1] = false; + priv->seconds = 627319920; + priv->nseconds = 0; + return priv; } @@ -2082,6 +2090,7 @@ testDomainGetTime(virDomainPtr dom, unsigned int flags) { virDomainObjPtr vm = NULL; + testDomainObjPrivatePtr priv; int ret = -1; virCheckFlags(0, -1); @@ -2095,8 +2104,39 @@ testDomainGetTime(virDomainPtr dom, goto cleanup; } - *seconds = 627319920; - *nseconds = 0; + priv = vm->privateData; + + *seconds = priv->seconds; + *nseconds = priv->nseconds; + + ret = 0; + cleanup: + virDomainObjEndAPI(&vm); + return ret; +} + + +static int +testDomainSetTime(virDomainPtr dom, + long long seconds, + unsigned int nseconds, + unsigned int flags) +{ + virDomainObjPtr vm = NULL; + testDomainObjPrivatePtr priv; + int ret = -1; + + virCheckFlags(VIR_DOMAIN_TIME_SYNC, ret); + + if (!(vm = testDomObjFromDomain(dom))) + return -1; + + if (virDomainObjCheckActive(vm) < 0) + goto cleanup; + + priv = vm->privateData; + priv->seconds = seconds; + priv->nseconds = nseconds; ret = 0; cleanup: @@ -8891,6 +8931,7 @@ static virHypervisorDriver testHypervisorDriver = { .domainGetInfo = testDomainGetInfo, /* 0.1.1 */ .domainGetState = testDomainGetState, /* 0.9.2 */ .domainGetTime = testDomainGetTime, /* 5.4.0 */ + .domainSetTime = testDomainSetTime, /* 5.7.0 */ .domainSave = testDomainSave, /* 0.3.2 */ .domainSaveFlags = testDomainSaveFlags, /* 0.9.4 */ .domainRestore = testDomainRestore, /* 0.3.2 */ -- 2.22.0

2 1

[libvirt] [PATCH 0/7] qemu: use domCaps for validation
by Cole Robinson 06 Aug '19

06 Aug '19

I'm trying to remove some hurdles and pitfalls WRT extending domaincapabilities data. One issue is that it's too easy to add invalid data to it, or let the data become out of date. For example the first two patches of this series add <rng model=X> domcaps reporting. The logic to fill in the domcaps data from qemuCaps is nearly identical to the logic we use to validate rng->model in qemuDomainRNGDefValidate. If just those patches are added, and later a new qemu rng model was introduced, a future patch could easily miss updated domaincapabilities output. This series aims to set up a pattern to prevent these types of issues from sneaking in. A function virDomainCapsDeviceDefValidate is added which will use domcaps data to perform validation against a devicedef. The existing qemu <rng> model validation is moved there. This ensures that any future <rng> model additions, if they want to work in the qemu driver, effectively need to extend domaincapabilities as well. It's also theoretically useful for other drivers too. One issue is that at DomainDefValidate time we don't have domCaps handy, or any cache layer for domCaps assembling. Patch #4 adds a domCapsCache hashtable to the virQEMUCaps class for caching domCaps builds based on the full tuple of emulator+machine+arch+virttype. If qemuCaps need to be regenerated, the domCaps cache is wiped out for us so we don't need to worry about the data being stale, it's tied to the lifetime of a qemuCaps instance. Cole Robinson (7): conf: domcaps: Report device <rng> qemu: capabilities: fill in domcaps <rng> qemu: conf: add virQEMUDriverGetDomainCapabilities qemu: conf: Cache domCaps in qemuCaps conf: domcaps: Add virDomainCapsDeviceDefValidate qemu: domain: Call virDomainCapsDeviceDefValidate qemu: Move rng model validation to domcaps docs/formatdomaincaps.html.in | 35 ++++++++ docs/schemas/domaincaps.rng | 10 +++ src/conf/domain_capabilities.c | 83 ++++++++++++++++++ src/conf/domain_capabilities.h | 14 ++++ src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 41 +++++++++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_conf.c | 84 +++++++++++++++++++ src/qemu/qemu_conf.h | 7 ++ src/qemu/qemu_domain.c | 38 +++------ src/qemu/qemu_driver.c | 18 +--- .../qemu_1.7.0.x86_64.xml | 9 ++ .../qemu_2.12.0-virt.aarch64.xml | 11 +++ .../qemu_2.12.0.ppc64.xml | 11 +++ .../qemu_2.12.0.s390x.xml | 11 +++ .../qemu_2.12.0.x86_64.xml | 11 +++ .../qemu_2.6.0-virt.aarch64.xml | 11 +++ .../qemu_2.6.0.aarch64.xml | 11 +++ .../domaincapsschemadata/qemu_2.6.0.ppc64.xml | 11 +++ .../qemu_2.6.0.x86_64.xml | 11 +++ .../domaincapsschemadata/qemu_2.7.0.s390x.xml | 11 +++ .../qemu_2.8.0-tcg.x86_64.xml | 11 +++ .../domaincapsschemadata/qemu_2.8.0.s390x.xml | 11 +++ .../qemu_2.8.0.x86_64.xml | 11 +++ .../qemu_2.9.0-q35.x86_64.xml | 11 +++ .../qemu_2.9.0-tcg.x86_64.xml | 11 +++ .../qemu_2.9.0.x86_64.xml | 11 +++ .../domaincapsschemadata/qemu_3.0.0.s390x.xml | 11 +++ .../qemu_4.0.0.x86_64.xml | 11 +++ 29 files changed, 488 insertions(+), 40 deletions(-) -- 2.21.0

3 16

[libvirt] [PATCH 0/3] Couple of resctrl fixes
by Michal Privoznik 06 Aug '19

06 Aug '19

*** BLURB HERE *** Michal Prívozník (3): qemuDomainGetResctrlMonData: Don't leak @caps qemuDomainGetResctrlMonData: Dereference resctrl monitor iff not NULL qemuDomainGetResctrlMonData: Switch to switch() src/qemu/qemu_driver.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) -- 2.21.0

2 5

[libvirt] [PATCH v2 0/4] test_driver: implement FS-related APIs
by Ilias Stamatis 06 Aug '19

06 Aug '19

Ilias Stamatis (4): test_driver: introduce domain-private data test_driver: implement virDomainFSFreeze test_driver: implement virDomainFSThaw test_driver: implement virDomainFSTrim src/test/test_driver.c | 200 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 199 insertions(+), 1 deletion(-) -- 2.22.0

2 7

[libvirt] [PATCH] daemon: improve Xen support in systemd service
by Jim Fehlig 05 Aug '19

05 Aug '19

The xencommons service provides all the essential services such as xenstored, xenconsoled, etc. needed by the libvirt Xen driver, so libvirtd should be started after xencommons. The xendomains service uses Xen's xl tool to operate on any domains it finds running, even those managed by libvirt. Add a conflicts on the xendomains service to ensure it is not enabled when libvirtd is enabled. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/remote/libvirtd.service.in | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/remote/libvirtd.service.in b/src/remote/libvirtd.service.in index 3ddf0e229b..5dbe7cbe72 100644 --- a/src/remote/libvirtd.service.in +++ b/src/remote/libvirtd.service.in @@ -15,6 +15,8 @@ After=local-fs.target After=remote-fs.target After=systemd-logind.service After=systemd-machined.service +After=xencommons.service +Conflicts=xendomains.service Documentation=man:libvirtd(8) Documentation=https://libvirt.org -- 2.22.0

2 2

[libvirt] [PATCH] tools: console: Use proper constructor
by Roman Bolshakov 05 Aug '19

05 Aug '19

"virsh console" on macOS cannot attach to a domain and it doesn't matter if it's local or remote domain: $ ~ virsh console vm Connected to domain vm Escape character is ^] error: internal error: unable to wait on console condition The error comes from pthread_cond_wait that fails with EINVAL. The mutex in the parent is not initialized with pthread_mutex_init and it results in silent failure of pthead_mutex_lock and the attach failure. Fixes: 98361cc3b95 ("tools: console: make console virLockableObject") Signed-off-by: Roman Bolshakov <r.bolshakov(a)yadro.com> --- tools/virsh-console.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/virsh-console.c b/tools/virsh-console.c index 826a4afcb2..e16f841e57 100644 --- a/tools/virsh-console.c +++ b/tools/virsh-console.c @@ -367,7 +367,7 @@ virConsoleNew(void) if (virConsoleInitialize() < 0) return NULL; - if (!(con = virObjectNew(virConsoleClass))) + if (!(con = virObjectLockableNew(virConsoleClass))) return NULL; if (virCondInit(&con->cond) < 0) { -- 2.20.1 (Apple Git-117)

2 1

[libvirt] [PATCH] news.xml: Restore blank news example
by Michal Privoznik 05 Aug '19

05 Aug '19

In v5.6.0-rc1~347 I've mistakenly messed up news.xml as the change I wanted to promote was added into a comment (I blame git rebase for that). Anyway, restore the original state of the comment so it can be copied again. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Pushed under trivial rule. docs/news.xml | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/docs/news.xml b/docs/news.xml index 3c5cd7d597..a4d727b9c5 100644 --- a/docs/news.xml +++ b/docs/news.xml @@ -25,19 +25,6 @@ <section title="New features"> </section> <section title="Improvements"> - <change> - <summary> - Remember original owners and SELinux labels of files - </summary> - <description> - When a domain is starting up libvirt changes DAC and - SELinux labels so that domain can access it. However, - it never remembered the original labels and therefore - the file was returned back to <code>root:root</code>. - With this release, the original labels are remembered - and restored properly. - </description> - </change> </section> <section title="Bug fixes"> </section> -- 2.21.0

1 0