- Users - libvirt List Archives

nwfilter direction not being used when protocol all
by Jason Pyeron 11 Oct '21

11 Oct '21

Watson / Kyle: (note I coped the list) While I read https://libvirt.org/formatnwfilter.html#nwfelemsRulesProtoMisc , it is not clear that it is intended to add the iptables action without regard to the rule’s direction. Take the following rule scenarios: <rule action='accept' direction='in' priority='500' statematch='false'> <tcp dstportstart='22'/> </rule> <rule action='drop' direction='in' priority='1000'> <all/> </rule> # iptables-save | grep vnet5 | tee in :FI-vnet5 - [0:0] :FO-vnet5 - [0:0] :HI-vnet5 - [0:0] -A FI-vnet5 -p tcp -m tcp --sport 22 -j RETURN -A FI-vnet5 -j DROP -A FO-vnet5 -p tcp -m tcp --dport 22 -j ACCEPT -A FO-vnet5 -j DROP -A HI-vnet5 -p tcp -m tcp --sport 22 -j RETURN -A HI-vnet5 -j DROP -A libvirt-host-in -m physdev --physdev-in vnet5 -g HI-vnet5 -A libvirt-in -m physdev --physdev-in vnet5 -g FI-vnet5 -A libvirt-in-post -m physdev --physdev-in vnet5 -j ACCEPT -A libvirt-out -m physdev --physdev-out vnet5 --physdev-is-bridged -g FO-vnet5 <rule action='accept' direction='in' priority='500' statematch='false'> <tcp dstportstart='22'/> </rule> <rule action='drop' direction='out' priority='1000'> <all/> </rule> # iptables-save | grep vnet5 | tee out :FI-vnet5 - [0:0] :FO-vnet5 - [0:0] :HI-vnet5 - [0:0] -A FI-vnet5 -p tcp -m tcp --sport 22 -j RETURN -A FI-vnet5 -j DROP -A FO-vnet5 -p tcp -m tcp --dport 22 -j ACCEPT -A FO-vnet5 -j DROP -A HI-vnet5 -p tcp -m tcp --sport 22 -j RETURN -A HI-vnet5 -j DROP -A libvirt-host-in -m physdev --physdev-in vnet5 -g HI-vnet5 -A libvirt-in -m physdev --physdev-in vnet5 -g FI-vnet5 -A libvirt-in-post -m physdev --physdev-in vnet5 -j ACCEPT -A libvirt-out -m physdev --physdev-out vnet5 --physdev-is-bridged -g FO-vnet5 <rule action='accept' direction='in' priority='500' statematch='false'> <tcp dstportstart='22'/> </rule> <rule action='drop' direction='inout' priority='1000'> <all/> </rule> # iptables-save | grep vnet5 | tee inout :FI-vnet5 - [0:0] :FO-vnet5 - [0:0] :HI-vnet5 - [0:0] -A FI-vnet5 -p tcp -m tcp --sport 22 -j RETURN -A FI-vnet5 -j DROP -A FO-vnet5 -p tcp -m tcp --dport 22 -j ACCEPT -A FO-vnet5 -j DROP -A HI-vnet5 -p tcp -m tcp --sport 22 -j RETURN -A HI-vnet5 -j DROP -A libvirt-host-in -m physdev --physdev-in vnet5 -g HI-vnet5 -A libvirt-in -m physdev --physdev-in vnet5 -g FI-vnet5 -A libvirt-in-post -m physdev --physdev-in vnet5 -j ACCEPT -A libvirt-out -m physdev --physdev-out vnet5 --physdev-is-bridged -g FO-vnet5 We note that the -A HI-vnet5 -j DROP -A FI-vnet5 -j DROP -A FO-vnet5 -j DROP Is present without regards to the state of the direction attribute on the “default” drop rule. If the direction is “in” then the “-A FI-vnet5 -j DROP” should not exists. What does the source code say? I worry that either the docs are imprecise and this is desired, or there is a bug and I can end up like https://superuser.com/questions/1660080/in-libvirt-network-filters-nwfilter… As this is going to be a generic rule, applied many times – I would prefer not to have mac based source allow rules. -Jason

1 0

how to get enabled features
by Jiatong Shen 11 Oct '21

11 Oct '21

Hello community, I am trying to learn how to use dtrace and systemtap for libvirt, as the documentation says it seems to enable `--with-dtrace` when compiling. I am installing libvirt using apt install and is it possible to determine if dtrace is built by running some libvirt commands? Thank you. -- Best Regards, Jiatong Shen

2 1

Need more doc for libvirt-console-proxy
by Guy Godfroy 05 Oct '21

05 Oct '21

Hello, I'm making a web app for my company that will enable different teams to manage their own VMs. I wish to make possible to interact with each VM console, so I plan to use some xterm.js with websockets. So I discovered libvirt-console-proxy [1] when I looked for something to put a libvirt console into a websocket. That seems like the right tool for the job. The only doc I found is this article from 2017 [2]. After trying to understand from this article and from --help, I still have many questions. I am really bad at reading code so I can't even get answers from the sources. My main concern is: How a client is supposed to talk to the proxy? It is said that a security token must be provided. How? HTTP header? Which header? Am I missing something in websocket protocol? I think an example client implementation would help a lot. Also, I tried to use virtconsoleresolveradm to set up metadata on my domains like explained in the article [1] : ./virtconsoleresolveradm enable milou Enabled access to domain 'milou' But that doesn't seem to do anything (except defining the metadata namespace in the XML): virsh metadata milou http://libvirt.org/schemas/console-proxy/1.0 <consoles/> I precise that I have already this in my XML: <serial type='pty'> <target type='isa-serial' port='0'> <model name='isa-serial'/> </target> </serial> <console type='pty'> <target type='serial' port='0'/> </console> Should I remove that? Should I edit that? Thanks for your help. Guy Godfroy [1] https://gitlab.com/libvirt/libvirt-console-proxy [2] https://www.berrange.com/posts/2017/01/26/announce-new-libvirt-console-prox…

1 1

how/where to configure access to libvirt-sock-ro
by Marc 04 Oct '21

04 Oct '21

I wanted to create a monitoring user that can do some reporting like this: runuser -u xxxxx -- prometheus-libvirt-exporter -libvirt.uri /var/run/libvirt/libvirt-sock-ro But I am getting the failed to connect: authentication required

2 1

how/where to configure access to libvirt-sock-ro
by Marc 03 Oct '21

03 Oct '21

I wanted to create a monitoring user that can do some reporting like this: runuser -u xxxxx -- prometheus-libvirt-exporter -libvirt.uri /var/run/libvirt/libvirt-sock-ro But I am getting the failed to connect: authentication required

1 0

Are secrets hidden from admins too - ?
by lejeczek 29 Sep '21

29 Sep '21

Hi guys. On a remote & "shared" systems - are private secrets completely 100% safe? Can root get to those? (naturally excluding hacking of unknown bugs & exploits and theories such as "no computer system is ultimately safe") And if answer is yes then - do you have any best practices for storing & managing of those secrets? many thanks, L.

3 6

How to move emulated SWTPM data to a new VM
by Sam Varshavchik 24 Sep '21

24 Sep '21

I have an existing VM with an emulated TPM module. I'm trying to create a replacement VM, pointing to the same disk image that the existing VM uses, and also migrate the existing TPM module to it. Would just copying everything in /var/lib/libvirt/swtpm/<UUID> work? I did some practice runs, and it seems that virt-manager immediately starts the new VM as soon as it creates one, so I need to quickly turn it off, go look up its new UUID, and copy over the TPM files?

2 2

security driver mismatch blocks live migration..
by Jiatong Shen 20 Sep '21

20 Sep '21

Hello community, I am seeing following error during performing a live migration libvirtError: unsupported configuration: Unable to find security driver for model apparmor The root cause is the destination libvirtd runs inside a container and apparmor profile is not enabled. Right now I am researching how to enable apparmor profile for a k8s pod. But Is it possible to do a live migrate an instance and disable security driver at the same time? Thank you. -- Best Regards, Jiatong Shen

2 1

internal error: Network is already in use by interface virbr0
by Michael Ströder 17 Sep '21

17 Sep '21

HI! I'm using libvirt 7.7.0 on openSUSE Tumbleweed. Until recently everything just worked. But now my virtual NAT network is not usable anymore. Starting a VM I get this error: # virsh start ae-dir-suse-p1 error: Failed to start domain 'ae-dir-suse-p1' error: Requested operation is not valid: network 'vnet1' is not active Manually starting the network does not work either: # virsh net-start vnet1 error: Failed to start network vnet1 error: internal error: Network is already in use by interface virbr0 In syslog I find: libvirtd: 6325: error : networkCheckRouteCollision:296 : internal error: Network is already in use by interface virbr0 What does that mean? Where to look for a config error? Ciao, Michael.

3 5

Compiling libvirt on ubuntu
by Or Ozeri 13 Sep '21

13 Sep '21

Hi, I'm trying to compile libvirt on ubuntu machine. I installed meson 0.59.1 using pip. Then installed a few more packages that were required by meson build: sudo apt-get install libxml2-utils xsltproc libpciaccess-dev ninja-build Finally, I followed the simple instructions over here: https://libvirt.org/compiling.html xz -dc libvirt-7.7.0.tar.xz | tar xvf - cd libvirt-7.7.0 meson build ninja -C build The last command fails with: FAILED: src/libvirt-admin.so.0.7007.0 cc -o src/libvirt-admin.so.0.7007.0 src/libvirt_probes.o src/libvirt-admin.so.0.7007.0.p/meson-generated_.._admin_admin_protocol.c.o src/libvirt-admin.so.0.7007.0.p/admin_libvirt-admin.c.o src/libvirt-admin.so.0.7007.0.p/datatypes.c.o -Wl,--as-needed -Wl,--no-undefined -shared -fPIC -Wl,--start-group -Wl,-soname,libvirt-admin.so.0 '-Wl,-rpath,$ORIGIN/:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' -Wl,-rpath-link,/home/oro/ozeri/libvirt-7.7.0/build/src src/libvirt.so.0.7007.0 -Wl,--version-script=/home/oro/ozeri/libvirt-7.7.0/build/src/admin/libvirt_admin.syms -Wl,-z,nodelete /usr/lib/x86_64-linux-gnu/libcap-ng.so /usr/lib/gcc/x86_64-linux-gnu/9/../../../x86_64-linux-gnu/libdevmapper.so /usr/lib/x86_64-linux-gnu/libgnutls.so -Wl,-z,relro -Wl,-z,now -Wl,--no-copy-dt-needed-entries /usr/lib/x86_64-linux-gnu/libglib-2.0.so /usr/lib/x86_64-linux-gnu/libgobject-2.0.so /usr/lib/x86_64-linux-gnu/libgio-2.0.so /usr/lib/x86_64-linux-gnu/libxml2.so /usr/lib/x86_64-linux-gnu/libyajl.so -Wl,--end-group /usr/bin/ld: src/libvirt-admin.so.0.7007.0.p/admin_libvirt-admin.c.o: in function `callFull': /home/oro/ozeri/libvirt-7.7.0/build/../src/admin/admin_remote.c:99: undefined reference to `virNetClientProgramCall' /usr/bin/ld: src/libvirt-admin.so.0.7007.0.p/admin_libvirt-admin.c.o: in function `remoteAdminConnectClose': /home/oro/ozeri/libvirt-7.7.0/build/../src/admin/admin_remote.c:197: undefined reference to `virNetClientSetCloseCallback' /usr/bin/ld: /home/oro/ozeri/libvirt-7.7.0/build/../src/admin/admin_remote.c:199: undefined reference to `virNetClientClose' /usr/bin/ld: src/libvirt-admin.so.0.7007.0.p/admin_libvirt-admin.c.o: in function `remoteAdminPrivNew': /home/oro/ozeri/libvirt-7.7.0/build/../src/admin/admin_remote.c:225: undefined reference to `virNetClientNewUNIX' /usr/bin/ld: /home/oro/ozeri/libvirt-7.7.0/build/../src/admin/admin_remote.c:228: undefined reference to `virNetClientProgramNew' /usr/bin/ld: /home/oro/ozeri/libvirt-7.7.0/build/../src/admin/admin_remote.c:233: undefined reference to `virNetClientAddProgram' /usr/bin/ld: src/libvirt-admin.so.0.7007.0.p/admin_libvirt-admin.c.o: in function `remoteAdminConnectOpen': /home/oro/ozeri/libvirt-7.7.0/build/../src/admin/admin_remote.c:159: undefined reference to `virNetClientRegisterAsyncIO' /usr/bin/ld: /home/oro/ozeri/libvirt-7.7.0/build/../src/admin/admin_remote.c:166: undefined reference to `virNetClientSetCloseCallback' /usr/bin/ld: src/libvirt-admin.so.0.7007.0.p/admin_libvirt-admin.c.o: in function `virAdmConnectIsAlive': /home/oro/ozeri/libvirt-7.7.0/build/../src/admin/libvirt-admin.c:397: undefined reference to `virNetClientIsOpen' collect2: error: ld returned 1 exit status [2/11] Linking target tests/virsystemdtest FAILED: tests/virsystemdtest cc -o tests/virsystemdtest src/libvirt_probes.o tests/virsystemdtest.p/virsystemdtest.c.o -Wl,--as-needed -Wl,--no-undefined -Wl,-export-dynamic -pie -Wl,--whole-archive -Wl,--start-group tests/libtest_utils.a -Wl,--no-whole-archive '-Wl,-rpath,$ORIGIN/../src' -Wl,-rpath-link,/home/oro/ozeri/libvirt-7.7.0/build/src src/libvirt.so.0.7007.0 -Wl,--no-copy-dt-needed-entries -Wl,-export-dynamic -ldl /usr/lib/x86_64-linux-gnu/libglib-2.0.so /usr/lib/x86_64-linux-gnu/libgobject-2.0.so /usr/lib/x86_64-linux-gnu/libgio-2.0.so /usr/lib/x86_64-linux-gnu/libgnutls.so /lib/x86_64-linux-gnu/libnl-3.so /usr/lib/x86_64-linux-gnu/libnl-route-3.so /usr/lib/x86_64-linux-gnu/libxml2.so /usr/lib/gcc/x86_64-linux-gnu/9/../../../x86_64-linux-gnu/libselinux.so /usr/lib/x86_64-linux-gnu/libyajl.so -Wl,--end-group -Wl,-export-dynamic /usr/bin/ld: tests/virsystemdtest.p/virsystemdtest.c.o: in function `testActivationCreateFDs': /home/oro/ozeri/libvirt-7.7.0/build/../tests/virsystemdtest.c:506: undefined reference to `virNetSocketNewListenUNIX' /usr/bin/ld: /home/oro/ozeri/libvirt-7.7.0/build/../tests/virsystemdtest.c:513: undefined reference to `virNetSocketNewListenTCP' /usr/bin/ld: tests/virsystemdtest.p/virsystemdtest.c.o: in function `testActivation': /home/oro/ozeri/libvirt-7.7.0/build/../tests/virsystemdtest.c:548: undefined reference to `virNetSocketGetPath' /usr/bin/ld: /home/oro/ozeri/libvirt-7.7.0/build/../tests/virsystemdtest.c:570: undefined reference to `virNetSocketGetPort' collect2: error: ld returned 1 exit status ninja: build stopped: subcommand failed. I verified that these functions do exist inside libvirt.so.0.7007.0, but for some reason the linker fails. What am I doing wrong here? Thanks, Or

3 2