- Devel - libvirt List Archives

[libvirt] [PATCH 0/4] Adding resolution properties for QXL device
by jcfaracco＠gmail.com 05 Aug '19

05 Aug '19

From: Julio Faracco <jcfaracco(a)gmail.com> This serie adds 'xres' and 'yres' properties into XML definition for QXL video device to specify a default resolution. This serie covers a simple test case too. Julio Faracco (4): docs: Adding 'xres' and 'yres' into qxl XML definition conf: Adding XML support for 'xres' and 'yres' qemu: Generate 'xres' and 'yres' for qxl device. tests: Add separate tests for 'xres' and 'yres' docs/schemas/domaincommon.rng | 10 +++++ src/conf/domain_conf.c | 26 ++++++++++++ src/conf/domain_conf.h | 2 + src/qemu/qemu_command.c | 4 ++ .../video-qxl-resolution.args | 32 +++++++++++++++ .../qemuxml2argvdata/video-qxl-resolution.xml | 40 +++++++++++++++++++ tests/qemuxml2argvtest.c | 4 ++ .../video-qxl-resolution.xml | 40 +++++++++++++++++++ tests/qemuxml2xmltest.c | 1 + 9 files changed, 159 insertions(+) create mode 100644 tests/qemuxml2argvdata/video-qxl-resolution.args create mode 100644 tests/qemuxml2argvdata/video-qxl-resolution.xml create mode 100644 tests/qemuxml2xmloutdata/video-qxl-resolution.xml -- 2.20.1

5 15

[libvirt] [PATCH 0/2] test_driver: implement the remaining virDomainCreate APIs
by Ilias Stamatis 05 Aug '19

05 Aug '19

Ilias Stamatis (2): test_driver: implement virDomainCreateWithFiles test_driver: implement virDomainCreateXMLWithFile src/test/test_driver.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) -- 2.22.0

2 3

[libvirt] [PATCH] libxl: Implement domain metadata getter/setter
by Michal Privoznik 05 Aug '19

05 Aug '19

Fortunately, the code that handles metadata getting or setting is driver agnostic, so all that is needed from individual hypervisor drivers is to call the right functions. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1732306 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/libxl/libxl_driver.c | 67 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index 492028c487..ca01f620c7 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -6515,6 +6515,70 @@ libxlConnectBaselineCPU(virConnectPtr conn, return cpustr; } +static int +libxlDomainSetMetadata(virDomainPtr dom, + int type, + const char *metadata, + const char *key, + const char *uri, + unsigned int flags) +{ + libxlDriverPrivatePtr driver = dom->conn->privateData; + VIR_AUTOUNREF(libxlDriverConfigPtr) cfg = libxlDriverConfigGet(driver); + virDomainObjPtr vm = NULL; + int ret = -1; + + virCheckFlags(VIR_DOMAIN_AFFECT_LIVE | + VIR_DOMAIN_AFFECT_CONFIG, -1); + + if (!(vm = libxlDomObjFromDomain(dom))) + return -1; + + if (virDomainSetMetadataEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + + if (libxlDomainObjBeginJob(driver, vm, LIBXL_JOB_MODIFY) < 0) + goto cleanup; + + ret = virDomainObjSetMetadata(vm, type, metadata, key, uri, cfg->caps, + driver->xmlopt, cfg->stateDir, + cfg->configDir, flags); + + if (ret == 0) { + virObjectEventPtr ev = NULL; + ev = virDomainEventMetadataChangeNewFromObj(vm, type, uri); + virObjectEventStateQueue(driver->domainEventState, ev); + } + + libxlDomainObjEndJob(driver, vm); + + cleanup: + virDomainObjEndAPI(&vm); + return ret; +} + +static char * +libxlDomainGetMetadata(virDomainPtr dom, + int type, + const char *uri, + unsigned int flags) +{ + virDomainObjPtr vm; + char *ret = NULL; + + if (!(vm = libxlDomObjFromDomain(dom))) + return NULL; + + if (virDomainGetMetadataEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + + ret = virDomainObjGetMetadata(vm, type, uri, flags); + + cleanup: + virDomainObjEndAPI(&vm); + return ret; +} + static virHypervisorDriver libxlHypervisorDriver = { .name = LIBXL_DRIVER_NAME, .connectURIProbe = libxlConnectURIProbe, @@ -6628,6 +6692,9 @@ static virHypervisorDriver libxlHypervisorDriver = { .connectGetDomainCapabilities = libxlConnectGetDomainCapabilities, /* 2.0.0 */ .connectCompareCPU = libxlConnectCompareCPU, /* 2.3.0 */ .connectBaselineCPU = libxlConnectBaselineCPU, /* 2.3.0 */ + .domainSetMetadata = libxlDomainSetMetadata, /* 5.7.0 */ + .domainGetMetadata = libxlDomainGetMetadata, /* 5.7.0 */ + }; static virConnectDriver libxlConnectDriver = { -- 2.21.0

2 1

[libvirt] [PATCH 0/4] test_driver: implement FS-related APIs
by Ilias Stamatis 04 Aug '19

04 Aug '19

Ilias Stamatis (4): test_driver: introduce domain-private data test_driver: implement virDomainFSFreeze test_driver: implement virDomainFSThaw test_driver: implement virDomainFSTrim src/test/test_driver.c | 191 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 190 insertions(+), 1 deletion(-) -- 2.22.0

2 10

[libvirt] [PATCH] news: Update for 5.6.0 release
by Andrea Bolognani 03 Aug '19

03 Aug '19

Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- docs/news.xml | 74 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) diff --git a/docs/news.xml b/docs/news.xml index 9483172335..dbc72c7c66 100644 --- a/docs/news.xml +++ b/docs/news.xml @@ -85,6 +85,29 @@ option to qemu.conf to override the system default. </description> </change> + <change> + <summary> + Remember original owners and SELinux labels of files + </summary> + <description> + When a domain is starting up libvirt changes DAC and + SELinux labels so that domain can access it. However, + it never remembered the original labels and therefore + the file was returned back to <code>root:root</code>. + With this release, the original labels are remembered + and restored properly. + </description> + </change> + <change> + <summary> + network: Allow passing arbitrary options to dnsmasq + </summary> + <description> + This works similarly to the existing support for passing arbitary + options to QEMU, and just like that feature it comes with no + support guarantees. + </description> + </change> </section> <section title="Removed features"> <change> @@ -119,8 +142,59 @@ TPM device. </description> </change> + <change> + <summary> + test driver: Expand API coverage + </summary> + <description> + Additional APIs have been implemented in the test driver. + </description> + </change> + <change> + <summary> + Implement per-driver locking + </summary> + <description> + Drivers now acquire a lock when they're loaded, ensuring that there + can never be two instances of the same driver active at a time. + </description> + </change> + <change> + <summary> + nss: Report newer addresses first + </summary> + <description> + In some cases, a guest might be assigned a new IP address by DHCP + before the previous lease has expired, in which case the NSS plugin + will correctly report both addresses; many applications, however, + ignore all addresses but the first, and may thus end up trying to + connect using a stale address. To prevent that from happening, the + NSS plugin will now always report the newest address first. + </description> + </change> + <change> + <summary> + util: Optimize mass closing of FDs when spawning child processes + </summary> + <description> + When the limit on the number of FDs is very high, closing all + unwanted FDs after calling <code>fork()</code> can take a lot of + time and delay the start of the child process. libvirt will now + use an optimized algorithm that minimizes such delays. + </description> + </change> </section> <section title="Bug fixes"> + <change> + <summary> + logging: Ensure virtlogd rollover takes priority over logrotate + </summary> + <description> + virtlogd implements its own rollover mechanism, but until now + logrotate could end up acting on the logs before virtlogd had a + chance to do so itself. + </description> + </change> </section> </release> <release version="v5.5.0" date="2019-07-02"> -- 2.21.0

2 2

[libvirt] Entering freeze for libvirt 5.6.0
by Daniel Veillard 02 Aug '19

02 Aug '19

I completely forgot to send plans for this and already a bit late for release schedule, so I just tagged RC1 in git and pushed the signed tarball and source rpm to the usual place: https://libvirt.org/sources/ Seems okay in my very limited tests here, there is a few red tests on jenkins but nothing looking like core libvirt issues https://ci.centos.org/view/libvirt/ I will try to cut RC2 once I'm back in Europe Thursday, and then get the final release by the w.e. or Monday. In the meantime, please give it some testing ! thanks, Daniel -- Daniel Veillard | Red Hat Developers Tools http://developer.redhat.com/ veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 1

[libvirt] [PATCH v1 00/31] Introduce NVMe support
by Michal Privoznik 02 Aug '19

02 Aug '19

These patches introduce a support for NVMe disks into libvirt. Note that even without them it is possible to use NVMe disks for your domains in two ways: 1) <hostdev/> - This is regular PCI assignment with all the drawbacks (no migration, no snapshots, ...) 2) <disk/> - Since NVMe disks are accessible via /dev/nvme* they can be assigned to domains. Problem is, because qemu is accessing /dev/nvme* the host kernel's storage stack is involved which adds significant latency [1]. Solution to this problem is to combine 1) and 2) together: - Bypass host kernel's storage stack by detaching the NVMe disk from the host (and attaching it to VFIO driver), and - Plug the NVMe disk into qemu's block layer so that all fancy features can be supported. On qemu command line this is done via: -drive file.driver=nvme,file.device=0000:01:00.0,file.namespace=1,format=raw,\ if=none,id=drive-virtio-disk0 \ -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x4,drive=drive-virtio-disk0,\ id=virtio-disk0,bootindex=1 \ You can find my patches also on my github [2]. 1: https://www.linux-kvm.org/images/4/4c/Userspace_NVMe_driver_in_QEMU_-_Fam_Z… 2: https://github.com/zippy2/libvirt/commits/nvme Michal Prívozník (31): virHostdevPreparePCIDevices: Separate out function body virHostdevReAttachPCIDevices: Separate out function body virpcimock: Move actions checking one level up Revert "virpcitest: Test virPCIDeviceDetach failure" virpcimock: Create driver_override file in device dirs virPCIDeviceAddressEqual: Fix const correctness virPCIDeviceAddressAsString: Fix const correctness virpci: Introduce virPCIDeviceAddressCopy qemuDomainDeviceDefValidateDisk: Reorder some checks schemas: Introduce disk type NVMe conf: Format and parse NVMe type disk util: Introduce virNVMeDevice module virhostdev: Include virNVMeDevice module virhostdevtest: Don't proceed to test cases if init failed virhostdevtest: s/CHECK_LIST_COUNT/CHECK_PCI_LIST_COUNT/ virpcimock: Introduce NVMe driver and devices virhostdevtest: Test virNVMeDevice assignment qemu: prepare NVMe devices too qemu: Take NVMe disks into account when calculating memlock limit virstoragefile: Introduce virStorageSourceChainHasNVMe domain_conf: Introduce virDomainDefHasNVMeDisk qemu_domain: Separate VFIO code qemu_domain: Introduce NVMe path getting helpers qemu: Create NVMe disk in domain namespace qemu: Allow NVMe disk in CGroups security_selinux: Simplify virSecuritySELinuxSetImageLabelInternal virSecuritySELinuxRestoreImageLabelInt: Don't skip non-local storage qemu_capabilities: Introduce QEMU_CAPS_DRIVE_NVME qemu: Generate command line of NVMe disks qemu: Don't leak storage perms on failure in qemuDomainAttachDiskGeneric qemu_hotplug: Prepare NVMe disks on hotplug docs/formatdomain.html.in | 45 +- docs/schemas/domaincommon.rng | 32 ++ src/conf/domain_conf.c | 160 +++++++ src/conf/domain_conf.h | 6 + src/libvirt_private.syms | 26 ++ src/qemu/qemu_block.c | 24 + src/qemu/qemu_capabilities.c | 4 + src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_cgroup.c | 59 ++- src/qemu/qemu_command.c | 4 + src/qemu/qemu_domain.c | 115 ++++- src/qemu/qemu_domain.h | 6 + src/qemu/qemu_driver.c | 4 + src/qemu/qemu_hostdev.c | 49 ++- src/qemu/qemu_hostdev.h | 10 + src/qemu/qemu_hotplug.c | 76 +++- src/qemu/qemu_migration.c | 1 + src/qemu/qemu_process.c | 7 + src/security/security_dac.c | 38 ++ src/security/security_selinux.c | 95 ++-- src/util/Makefile.inc.am | 2 + src/util/virhostdev.c | 350 +++++++++++++-- src/util/virhostdev.h | 25 ++ src/util/virnvme.c | 412 ++++++++++++++++++ src/util/virnvme.h | 89 ++++ src/util/virpci.c | 12 +- src/util/virpci.h | 8 +- src/util/virstoragefile.c | 73 ++++ src/util/virstoragefile.h | 17 + src/xenconfig/xen_xl.c | 1 + .../caps_2.12.0.aarch64.xml | 1 + .../caps_2.12.0.ppc64.xml | 1 + .../caps_2.12.0.s390x.xml | 1 + .../caps_2.12.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_3.0.0.ppc64.xml | 1 + .../caps_3.0.0.riscv32.xml | 1 + .../caps_3.0.0.riscv64.xml | 1 + .../qemucapabilitiesdata/caps_3.0.0.s390x.xml | 1 + .../caps_3.0.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_3.1.0.ppc64.xml | 1 + .../caps_3.1.0.x86_64.xml | 1 + .../caps_4.0.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_4.0.0.ppc64.xml | 1 + .../caps_4.0.0.riscv32.xml | 1 + .../caps_4.0.0.riscv64.xml | 1 + .../qemucapabilitiesdata/caps_4.0.0.s390x.xml | 1 + .../caps_4.0.0.x86_64.xml | 1 + .../caps_4.1.0.x86_64.xml | 1 + .../disk-nvme.x86_64-latest.args | 52 +++ tests/qemuxml2argvdata/disk-nvme.xml | 63 +++ tests/qemuxml2argvtest.c | 1 + tests/qemuxml2xmloutdata/disk-nvme.xml | 1 + tests/qemuxml2xmltest.c | 1 + tests/virhostdevtest.c | 185 ++++++-- tests/virpcimock.c | 76 +++- tests/virpcitest.c | 32 -- tests/virpcitestdata/0000-01-00.0.config | Bin 0 -> 4096 bytes tests/virpcitestdata/0000-02-00.0.config | Bin 0 -> 4096 bytes 58 files changed, 1978 insertions(+), 204 deletions(-) create mode 100644 src/util/virnvme.c create mode 100644 src/util/virnvme.h create mode 100644 tests/qemuxml2argvdata/disk-nvme.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-nvme.xml create mode 120000 tests/qemuxml2xmloutdata/disk-nvme.xml create mode 100644 tests/virpcitestdata/0000-01-00.0.config create mode 100644 tests/virpcitestdata/0000-02-00.0.config -- 2.21.0

2 75

[libvirt] [PATCH] tests: Fix virsh-snapshot/checkpoint without libreadline-devel
by Eric Blake 02 Aug '19

02 Aug '19

libreadline-devel is an optional build dependency; when it is not present, the output of 'virsh <<EOF ... EOF' is different in that the input provided by the user is not echoed, and prompts become interleaved on the same line as actual output, which in turn causes the sed doing prompt filtering to mess up: | ./virsh-snapshot | --- exp 2019-07-31 18:42:31.107399428 -0300 | +++ out.cooked 2019-07-31 18:42:31.108399437 -0300 | @@ -1,8 +1,3 @@ | - | - | -Domain snapshot s3 created from 's3.xml' | -Domain snapshot s2 created from 's2.xml' | -Name: s2 | Domain: test | Current: yes | State: running Maybe we should fix virsh in interactive mode to echo regardless of whether libreadline-devel was used, but the quicker fix is to make the test use 'virsh "..."' rather than reading its input from stdin. Reported-by: Daniel Henrique Barboza <danielhb413(a)gmail.com> Signed-off-by: Eric Blake <eblake(a)redhat.com> --- I'm tempted to push this as a fix to a build-breaker, but as I did not actually build without libreadline-devel, I'd appreciate an ACK from Daniel that this fixes the problem on his setup. tests/virsh-checkpoint | 7 +++---- tests/virsh-snapshot | 7 +++---- 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/tests/virsh-checkpoint b/tests/virsh-checkpoint index 75bdc293be..92962d2205 100755 --- a/tests/virsh-checkpoint +++ b/tests/virsh-checkpoint @@ -140,7 +140,7 @@ EOF compare exp err || fail=1 # Restore state with redefine -$abs_top_builddir/tools/virsh -c test:///default >out 2>err <<EOF || fail=1 +$abs_top_builddir/tools/virsh -c test:///default >out 2>err ' # Redefine must be in topological order; this will fail checkpoint-create test --redefine c2.xml echo --err marker @@ -149,7 +149,7 @@ $abs_top_builddir/tools/virsh -c test:///default >out 2>err <<EOF || fail=1 checkpoint-create test --redefine c2.xml checkpoint-list test --leaves --name checkpoint-info test c2 -EOF +' || fail=1 cat <<\EOF > exp || fail=1 @@ -165,8 +165,7 @@ Children: 0 Descendants: 0 EOF -sed '1,/^virsh #/d; /virsh #/d' < out > out.cooked || fail=1 -compare exp out.cooked || fail=1 +compare exp out || fail=1 cat <<EOF > exp || fail=1 error: invalid argument: parent c3 for moment c2 not found diff --git a/tests/virsh-snapshot b/tests/virsh-snapshot index 20ff966a51..473e3b3f2d 100755 --- a/tests/virsh-snapshot +++ b/tests/virsh-snapshot @@ -191,7 +191,7 @@ EOF compare exp err || fail=1 # Restore state with redefine -$abs_top_builddir/tools/virsh -c test:///default >out 2>err <<EOF || fail=1 +$abs_top_builddir/tools/virsh -c test:///default >out 2>err ' # Redefine must be in topological order; this will fail snapshot-create test --redefine s2.xml --validate echo --err marker @@ -199,7 +199,7 @@ $abs_top_builddir/tools/virsh -c test:///default >out 2>err <<EOF || fail=1 snapshot-create test --redefine s3.xml --validate snapshot-create test --redefine s2.xml --current --validate snapshot-info test --current -EOF +' || fail=1 cat <<\EOF > exp || fail=1 @@ -217,8 +217,7 @@ Descendants: 0 Metadata: yes EOF -sed '1,/^virsh #/d; /virsh #/d' < out > out.cooked || fail=1 -compare exp out.cooked || fail=1 +compare exp out || fail=1 cat <<EOF > exp || fail=1 error: invalid argument: parent s3 for moment s2 not found -- 2.20.1

2 1

[libvirt] [PATCH 1/1] tests/virsh-checkpoint/snapshot: changing 'sed' out filtering
by Daniel Henrique Barboza 02 Aug '19

02 Aug '19

There is a chance that the current sed filtering used in these new tests might fail in some machines due to the repetition of the 'virsh #' prompt at the same line, together with valid output that shouldn't be filtered. This is output of virsh-snapshot test in my T480 dev box: ./virsh-snapshot --- exp 2019-07-31 18:42:31.107399428 -0300 +++ out.cooked 2019-07-31 18:42:31.108399437 -0300 @@ -1,8 +1,3 @@ - - -Domain snapshot s3 created from 's3.xml' -Domain snapshot s2 created from 's2.xml' -Name: s2 Domain: test Current: yes State: running There are 3 valid lines missing. This is the unfiltered output: === out === Welcome to lt-virsh, the virtualization interactive terminal. Type: 'help' for help with commands 'quit' to quit virsh # virsh # virsh # virsh # virsh # Domain snapshot s3 created from 's3.xml' virsh # Domain snapshot s2 created from 's2.xml' virsh # Name: s2 Domain: test Current: yes State: running Location: internal Parent: s3 Children: 0 Descendants: 0 Metadata: yes virsh # ============ We can see that the 3 lines being erased are being followed by the 'virsh #' prompt and the filtering is erasing those. A similar situation happens with virsh-checkpoint as well. This patch makes the 'sed' filtering less elegant and more crude than the current version, but more reliable to these outputs that may vary from each dev machine. We're also removing the blank lines in the expected output to make it less prone to errors as well. Signed-off-by: Daniel Henrique Barboza <danielhb413(a)gmail.com> --- Eric, feel free to accept this patch, tweak it, discard it and try something else or whatever. I was going to send the commit msg as a reply to your query in the ML, then realized that I might as well propose a fix for it. tests/virsh-checkpoint | 6 +----- tests/virsh-snapshot | 6 ++---- 2 files changed, 3 insertions(+), 9 deletions(-) diff --git a/tests/virsh-checkpoint b/tests/virsh-checkpoint index 75bdc293be..a3cad74f74 100755 --- a/tests/virsh-checkpoint +++ b/tests/virsh-checkpoint @@ -152,20 +152,16 @@ $abs_top_builddir/tools/virsh -c test:///default >out 2>err <<EOF || fail=1 EOF cat <<\EOF > exp || fail=1 - - Domain checkpoint c3 created from 'c3.xml' Domain checkpoint c2 created from 'c2.xml' c2 - Name: c2 Domain: test Parent: c3 Children: 0 Descendants: 0 - EOF -sed '1,/^virsh #/d; /virsh #/d' < out > out.cooked || fail=1 +sed '1,/^virsh #/d; s/virsh #\s//g; /^$/d' < out > out.cooked || fail=1 compare exp out.cooked || fail=1 cat <<EOF > exp || fail=1 diff --git a/tests/virsh-snapshot b/tests/virsh-snapshot index 20ff966a51..874093ea3c 100755 --- a/tests/virsh-snapshot +++ b/tests/virsh-snapshot @@ -201,9 +201,8 @@ $abs_top_builddir/tools/virsh -c test:///default >out 2>err <<EOF || fail=1 snapshot-info test --current EOF -cat <<\EOF > exp || fail=1 - +cat <<\EOF > exp || fail=1 Domain snapshot s3 created from 's3.xml' Domain snapshot s2 created from 's2.xml' Name: s2 @@ -215,9 +214,8 @@ Parent: s3 Children: 0 Descendants: 0 Metadata: yes - EOF -sed '1,/^virsh #/d; /virsh #/d' < out > out.cooked || fail=1 +sed '1,/^virsh #/d; s/virsh #\s//g; /^$/d' < out > out.cooked || fail=1 compare exp out.cooked || fail=1 cat <<EOF > exp || fail=1 -- 2.21.0

2 7

[libvirt] [PATCH] RFC: security: Make sure to decrease ref count label value
by Stefan Berger 02 Aug '19

02 Aug '19

I noticed that if a domain fails to restore, the ref count in the xattr 'trusted.libvirt.security.ref_selinux' keeps on increasing indefinitely and the VM will never restore even if the root cause for the restore failure has been removed. The reason seems to be that the code to decrease the ref count never gets called because the block above it fails due to virSecuritySELinuxTransactionAppend() failing. The simple solution seems to be to revert the order in which things are done. Signed-off-by: Stefan Berger <stefanb(a)linux.ibm.com> --- src/security/security_selinux.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index ea20373a90..9fd29e9bca 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -1499,14 +1499,9 @@ virSecuritySELinuxRestoreFileLabel(virSecurityManagerPtr mgr, goto cleanup; } - if ((rc = virSecuritySELinuxTransactionAppend(path, NULL, - false, recall, true)) < 0) { - goto cleanup; - } else if (rc > 0) { - ret = 0; - goto cleanup; - } - + /* Recall the label so the ref count label decreases its counter + * even if transaction append below fails. + */ if (recall) { rc = virSecuritySELinuxRecallLabel(newpath, &fcon); if (rc == -2) { @@ -1519,6 +1514,14 @@ virSecuritySELinuxRestoreFileLabel(virSecurityManagerPtr mgr, } } + if ((rc = virSecuritySELinuxTransactionAppend(path, NULL, + false, recall, true)) < 0) { + goto cleanup; + } else if (rc > 0) { + ret = 0; + goto cleanup; + } + if (!recall || rc == -2) { if (stat(newpath, &buf) != 0) { VIR_WARN("cannot stat %s: %s", newpath, -- 2.20.1

3 3