On Fri, Jan 22, 2016 at 03:56:08PM +0000, Daniel P. Berrange wrote: > We have had virtlockd available for a long time now but > have always defaulted to the 'nop' lock driver which does > no locking. This gives users an unsafe deployment by > default unless they know to turn on lockd. virtlockd will > auto-activate via systemd when guests launch, so setting > it on by default will only cause upgrade pain for people > on non-systemd distros. I tried to test this patch in the below way after applying to my local Git master, and my test seems to fail. Compile and `virtlockd` setup ----------------------------- After applying the patch, I'm here: $ git describe v1.3.1-34-gd3a39cd Compile: $ cd ~/build/libvirt $ ~/src/libvirt/./autgen.sh --system && make -j8 Stop the system libvirtd and virtlockd: $ systemctl stop libvirtd $ systemctl stop virtlockd Enable `virtlockd` for the QEMU driver: $ augtool -s set /files/etc/libvirt/qemu.conf/lock_manager lockd Invoke just compiled virtlockd and libvirtd (in that order): $ sudo ./run src/virtlockd & $ sudo ./run daemon/libvirtd & Test ---- Purposefully make two libvirt VMs point to the same disk image: $ sudo ./run tools/virsh dumpxml cvm1 | grep 'source file' <source file='/var/lib/libvirt/images/cirros-0.3.3-x86_64-disk.img'/> $ sudo ./run tools/virsh dumpxml cvm2 | grep 'source file' <source file='/var/lib/libvirt/images/cirros-0.3.3-x86_64-disk.img'/> Start the first VM (with `virsh` from the build dir), it fails: $ sudo ./run tools/virsh start cvm1 error: Failed to start domain cvm1 error: Failed to connect socket to '/var/run/libvirt/virtlogd-sock': No such file or directory However, the virtlogd-sock file exists in the said path: $ ls -lsrt /var/run/libvirt/virtlockd-sock 0 srwx------. 1 root root 0 Jan 22 19:49 /var/run/libvirt/virtlockd-sock

We have had virtlockd available for a long time now but have always defaulted to the 'nop' lock driver which does no locking. This gives users an unsafe deployment by default unless they know to turn on lockd.

virtlockd will auto-activate via systemd when guests launch, so setting it on by default will only cause upgrade pain for people on non-systemd distros. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com&gt; --- src/qemu/qemu.conf | 3 ++- src/qemu/qemu_driver.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)

On Tue, Jan 26, 2016 at 02:28:56PM +0100, Ján Tomko wrote: > On Fri, Jan 22, 2016 at 03:56:08PM +0000, Daniel P. Berrange wrote: > > We have had virtlockd available for a long time now but > > have always defaulted to the 'nop' lock driver which does > > no locking. This gives users an unsafe deployment by > > default unless they know to turn on lockd. > > Does the default setup of virtlockd offer any safety? > > After looking at: > https://bugzilla.redhat.com/show_bug.cgi?id=1191802 > It seems that with dynamic_ownership enabled we first apply > the security labels, then check the disk locks by calling > virDomainLockProcessResume right before starting the CPUs > in virDomainLockProcessResume. After that fails, resetting > the uid:gid back to root:root cuts off the access to the disk > for the already running domain. > > Is there a reason why the locks are checked so late? > > I assume this only ever worked for the case of migration with > shared storage (and shared lockspace). NB, the virtlockd integration is intended to protect the *content* of the disk image from being written to by two processes at once. Protecting the image metadata not a goal, since that is something that should be dealt with by the security drivers. ie the security driver should be acquiring suitable locks of its own so that it does not block away in-use labels for other VMs. We've had patches floating around for the security drivers for a while, but never got as far as merging them yet.