- Users - libvirt List Archives

[libvirt-users] Best practice for custom iptables rules
by ZeroUno 15 Jan '14

15 Jan '14

Hi, I'm using libvirt to manage some VMs on a CentOS host, and I need some custom iptables rules to always be in place for some communications to happen, e.g. between the VMs and the outside world in both directions. Some of these rules need to be at the top of the iptables chain, otherwise the default rules added by libvirt would block the communications I need. So I cannot just add the rules in /etc/sysconfig/iptables, because libvirt adds its own rules _before_ the rules contained in this config file. I was looking at filters, but maybe not every rule can be made into a filter? Specifically, I need a rule for the POSTROUTING chain in the "nat" table. Can it be added through filters? Also, regarding the "iptables restart problem" described in the last paragraph at <http://libvirt.org/firewall.html>, is there really no acceptable way to make libvirt add its rules back automatically upon iptables/network restart? Thanks for any info. Marco -- 01

4 12

[libvirt-users] how to detect if qemu supports live disk snapshot
by Francesco Romani 15 Jan '14

15 Jan '14

Hi everyone, Using the QEMU hypervisor, when a live disk snapshot is requested through libvirt, the request can fail if the underyling qemu binary lacks the snapshotting support. In python, we have something like libvirtError: Operation not supported: live disk snapshot not supported with this QEMU binary I'd like to detect ahead of time if the underlying QEMU can or cannot do snapshotting, and disable right from the start the snapshotting support in my application, avoiding to throw errors to the user. After reading from the docs, it seems that libvirt doesn't reports yet this information about the hypervisor in the capabilities XML: http://libvirt.org/formatcaps.html a quick test against libvirt 1.1.3 (qemu 1.6.1) on Fedora 20 seems to confirm (see XML dump below[1]). So, if I'm not mistaken, looks like the only way to test for the support in QEMU is to actually request a snapshot and see what happens. Is this right? If this is correct, I would like to craft and propose a patch to libvirt to export this information, maybe into a form of some kind of warning list/blacklist: disk snapshotting it is supposed to be available, but this particular QEMU doesn't support it. What would be the best form to export such information? the options I see are * enhance the capabilities XML * add a new API: something like (very rough first draft) int virDomainIsSnapshotSupported(virConnectPtr conn, unsigned int flags); Thoughts? Any suggestion is welcome. Best regards, +++ [1] # virsh -c qemu:///system Welcome to virsh, the virtualization interactive terminal. Type: 'help' for help with commands 'quit' to quit virsh # capabilities <capabilities> <host> <uuid>01c4dc83-b652-cb11-9e6d-f3bf03b35d26</uuid> <cpu> <arch>x86_64</arch> <model>SandyBridge</model> <vendor>Intel</vendor> <topology sockets='1' cores='2' threads='2'/> <feature name='erms'/> <feature name='smep'/> <feature name='fsgsbase'/> <feature name='rdrand'/> <feature name='f16c'/> <feature name='osxsave'/> <feature name='pcid'/> <feature name='pdcm'/> <feature name='xtpr'/> <feature name='tm2'/> <feature name='est'/> <feature name='smx'/> <feature name='vmx'/> <feature name='ds_cpl'/> <feature name='monitor'/> <feature name='dtes64'/> <feature name='pbe'/> <feature name='tm'/> <feature name='ht'/> <feature name='ss'/> <feature name='acpi'/> <feature name='ds'/> <feature name='vme'/> </cpu> <power_management> <suspend_mem/> <suspend_disk/> <suspend_hybrid/> </power_management> <migration_features> <live/> <uri_transports> <uri_transport>tcp</uri_transport> </uri_transports> </migration_features> <topology> <cells num='1'> <cell id='0'> <memory unit='KiB'>7871524</memory> <cpus num='4'> <cpu id='0' socket_id='0' core_id='0' siblings='0-1'/> <cpu id='1' socket_id='0' core_id='0' siblings='0-1'/> <cpu id='2' socket_id='0' core_id='1' siblings='2-3'/> <cpu id='3' socket_id='0' core_id='1' siblings='2-3'/> </cpus> </cell> </cells> </topology> <secmodel> <model>selinux</model> <doi>0</doi> </secmodel> <secmodel> <model>dac</model> <doi>0</doi> </secmodel> </host> <guest> <os_type>hvm</os_type> <arch name='i686'> <wordsize>32</wordsize> <emulator>/usr/bin/qemu-system-i386</emulator> <machine canonical='pc-i440fx-1.6' maxCpus='255'>pc</machine> <machine maxCpus='255'>pc-q35-1.4</machine> <machine maxCpus='255'>pc-q35-1.5</machine> <machine canonical='pc-q35-1.6' maxCpus='255'>q35</machine> <machine maxCpus='1'>isapc</machine> <machine maxCpus='255'>pc-0.10</machine> <machine maxCpus='255'>pc-0.11</machine> <machine maxCpus='255'>pc-0.12</machine> <machine maxCpus='255'>pc-0.13</machine> <machine maxCpus='255'>pc-0.14</machine> <machine maxCpus='255'>pc-0.15</machine> <machine maxCpus='255'>pc-1.0</machine> <machine maxCpus='255'>pc-1.1</machine> <machine maxCpus='255'>pc-1.2</machine> <machine maxCpus='255'>pc-1.3</machine> <machine maxCpus='255'>pc-i440fx-1.4</machine> <machine maxCpus='255'>pc-i440fx-1.5</machine> <machine maxCpus='1'>none</machine> <domain type='qemu'> </domain> <domain type='kvm'> <emulator>/usr/bin/qemu-kvm</emulator> <machine canonical='pc-i440fx-1.6' maxCpus='255'>pc</machine> <machine maxCpus='255'>pc-q35-1.4</machine> <machine maxCpus='255'>pc-q35-1.5</machine> <machine canonical='pc-q35-1.6' maxCpus='255'>q35</machine> <machine maxCpus='1'>isapc</machine> <machine maxCpus='255'>pc-0.10</machine> <machine maxCpus='255'>pc-0.11</machine> <machine maxCpus='255'>pc-0.12</machine> <machine maxCpus='255'>pc-0.13</machine> <machine maxCpus='255'>pc-0.14</machine> <machine maxCpus='255'>pc-0.15</machine> <machine maxCpus='255'>pc-1.0</machine> <machine maxCpus='255'>pc-1.1</machine> <machine maxCpus='255'>pc-1.2</machine> <machine maxCpus='255'>pc-1.3</machine> <machine maxCpus='255'>pc-i440fx-1.4</machine> <machine maxCpus='255'>pc-i440fx-1.5</machine> <machine maxCpus='1'>none</machine> </domain> </arch> <features> <cpuselection/> <deviceboot/> <acpi default='on' toggle='yes'/> <apic default='on' toggle='no'/> <pae/> <nonpae/> </features> </guest> <guest> <os_type>hvm</os_type> <arch name='x86_64'> <wordsize>64</wordsize> <emulator>/usr/bin/qemu-system-x86_64</emulator> <machine canonical='pc-i440fx-1.6' maxCpus='255'>pc</machine> <machine maxCpus='255'>pc-q35-1.4</machine> <machine maxCpus='255'>pc-q35-1.5</machine> <machine canonical='pc-q35-1.6' maxCpus='255'>q35</machine> <machine maxCpus='1'>isapc</machine> <machine maxCpus='255'>pc-0.10</machine> <machine maxCpus='255'>pc-0.11</machine> <machine maxCpus='255'>pc-0.12</machine> <machine maxCpus='255'>pc-0.13</machine> <machine maxCpus='255'>pc-0.14</machine> <machine maxCpus='255'>pc-0.15</machine> <machine maxCpus='255'>pc-1.0</machine> <machine maxCpus='255'>pc-1.1</machine> <machine maxCpus='255'>pc-1.2</machine> <machine maxCpus='255'>pc-1.3</machine> <machine maxCpus='255'>pc-i440fx-1.4</machine> <machine maxCpus='255'>pc-i440fx-1.5</machine> <machine maxCpus='1'>none</machine> <domain type='qemu'> </domain> <domain type='kvm'> <emulator>/usr/bin/qemu-kvm</emulator> <machine canonical='pc-i440fx-1.6' maxCpus='255'>pc</machine> <machine maxCpus='255'>pc-q35-1.4</machine> <machine maxCpus='255'>pc-q35-1.5</machine> <machine canonical='pc-q35-1.6' maxCpus='255'>q35</machine> <machine maxCpus='1'>isapc</machine> <machine maxCpus='255'>pc-0.10</machine> <machine maxCpus='255'>pc-0.11</machine> <machine maxCpus='255'>pc-0.12</machine> <machine maxCpus='255'>pc-0.13</machine> <machine maxCpus='255'>pc-0.14</machine> <machine maxCpus='255'>pc-0.15</machine> <machine maxCpus='255'>pc-1.0</machine> <machine maxCpus='255'>pc-1.1</machine> <machine maxCpus='255'>pc-1.2</machine> <machine maxCpus='255'>pc-1.3</machine> <machine maxCpus='255'>pc-i440fx-1.4</machine> <machine maxCpus='255'>pc-i440fx-1.5</machine> <machine maxCpus='1'>none</machine> </domain> </arch> <features> <cpuselection/> <deviceboot/> <acpi default='on' toggle='yes'/> <apic default='on' toggle='no'/> </features> </guest> </capabilities> -- Francesco Romani

3 4

[libvirt-users] --persistent/--config confusion
by Dennis Jacobfeuerborn 15 Jan '14

15 Jan '14

Hi, I'm wondering how to attach a network device properly to a domain. According to the man page without "--config" a device created with "attach-device" will be added to the domain yet with "--config" it will only be added to the config and only be available after a restart of the guest. Is there no way to attach the device immediately *and* also make that change persistent? Regards, Dennis

2 2

[libvirt-users] Dedicated GDM session for a virt-manager virtual machine?
by Alex GS 15 Jan '14

15 Jan '14

Dear list, Something has been perplexing me lately. I have a bunch of Windows 7 virtual machines running on top of Fedora 20 in KVM using virt-manager. One of the big problems is that users who need the Windows VM's don't know how to user virt-manager and when they accidentally reboot a machine I have to manually setup the virt-manager session for them and make it full-screen. That means if I'm not physically there the users are unable to use the Windows sessions and cannot do their work. Is there a way to create a GDM desktop session that just launches a virtual machine via virsh and then logs directly into a full-screen virt-viewer instance of that virtual machine? Best, AGS

1 0

[libvirt-users] libvirt on armhf with selinux driver
by Ivan Gooten 14 Jan '14

14 Jan '14

hi, recently i've been busy with libvirt(d) v1.2.0 on armhf and i see, even if selinux sec driver is enabled on the configure stage, the driver is not finally created. these configure parameters are: --with-selinux --with-secdriver-selinux --with-selinux-mount=/sys/fs/selinux the /sys/fs/selinux is valid, selinux is running in permissive mode, got also libselinux DEV package installed, so no missing req. headers here. when trying to run libvirtd, i'm getting: error : virSecurityDriverLookup:78 : unsupported configuration: Security driver selinux not enabled error : lxcSecurityInit:1461 : Failed to initialise security drivers error : virStateInitialize:854 : Initialisation of LXC state driver failed: unsupported configuration: Security driver selinux not enabled error : daemonRunStateInit:909 : Driver state initialisation failed someone got any clue what may be causing this? thanks, ivan gooten

3 5

[libvirt-users] Migration: default value for maxdowntime? (QEMU/KVM)
by Scott Sullivan 10 Jan '14

10 Jan '14

I am wondering what the default value for migrate-setmaxdowntime is when using QEMU/KVM. http://builder.virt-tools.org/artifacts/libvirt-virshcmdref/html/sect-migra… Is the default the same as QEMU's default in this case? I was looking at libvirts source and it appears there is no default set within libvirt, unless I missed it. I do see qemuDomainMigrateSetMaxDowntime() directly enters the monitor to change the value when set with that command. Any insight/confirmation is appreciated.

1 0

[libvirt-users] migrate interrupted but cannot continue
by leocup 09 Jan '14

09 Jan '14

Hello, I have 2 hosts A and B,the settings of libvirtd are A: Compiled against library: libvirt 0.10.2 Using library: libvirt 0.10.2 Using API: QEMU 0.10.2 Running hypervisor: QEMU 0.12.1 B: Compiled against library: libvir 0.9.4 Using library: libvir 0.9.4 Using API: QEMU 0.9.4 Running hypervisor: QEMU 0.12.1 when I migrate a guest from A to B without storage,I used the command "virsh migrate --live --copy-storage-all --verbose vm qemu+ssh://kvm/system".The first time I succeed and I wantto to emulate the local network is down when I migrate,so I close the terminal (Xshell) when migrating, when I reconnect to the terminal ,use the migration command again,it failed.The libvirtd.log says: error : qemuMonitorIORead:514 : Unable to read from monitor: Connection reset by peer warning : qemuMonitorMigrateToFd:1941 : failed to close migration handle It seems that the migration process has not finished normally and so migration cannot go on. I want to know how to resolve it. thanks.

1 0

[libvirt-users] ANNOUNCE: ruby-libvirt 0.5.2
by Chris Lalancette 09 Jan '14

09 Jan '14

All, This is a release notification for ruby-libvirt 0.5.2. ruby-libvirt is a ruby wrapper around the libvirt API. The changelog between 0.5.1 and 0.5.2 is: * Fix to make sure we don't free more entries than retrieved (potential crash) Version 0.5.2 is available from http://libvirt.org/ruby: Tarball: http://libvirt.org/ruby/download/ruby-libvirt-0.5.2.tgz Gem: http://libvirt.org/ruby/download/ruby-libvirt-0.5.2.gem It is also available from rubygems.org; to get the latest version, run: $ gem install ruby-libvirt As usual, if you run into questions, problems, or bugs, please feel free to mail me (clalancette gmail com) and the libvirt mailing list. Thanks to Guido Günther for the patch to fix this problem.

1 0

[libvirt-users] Canceling a live migration via virsh? (QEMU/KVM)
by Scott Sullivan 08 Jan '14

08 Jan '14

I am using QEMU/KVM, using Live Migrations like this: virsh migrate --live ${name} qemu+ssh://${DESTINATION}/system My question, running this command makes it hang in the foreground. Is there a way for this to return immediately, so I can just poll for the migration status? Also, is there a way to _cancel_ a migration? I see the --timeout option, however if a given timeout is reached I would rather have the ability to cancel the migration than force the suspend. I do see there is a QEMU api migrate_cancel..eg: virsh qemu-monitor-command ${name} --pretty '{"execute":"migrate_cancel"}' Is that the only way to cancel a migration using libvirt?

2 2

[libvirt-users] Ownerships of VMs and Image files
by Christoph Pleger 07 Jan '14

07 Jan '14

Hello, I installed libvirt and qemu/kvm on a machine. I testet a little with those and found out that all users having an account on that machine can start every VM of every other user on the machine, in some conditions even directly access the image file on the real host. What I would like to have is that every user can only access the VMs and image files he or she created himself/herself, as long as he/she does not explicitly set other permissions. Is it possible to achieve that? Regards Christoph

2 1