- Users - libvirt List Archives

Unexplicable permission error when trying to read a qemu firmware file
by Emmanuel Kasper 04 Jan '21

04 Jan '21

Hi I want to create a CoreOS VM following the steps mentioned at https://docs.fedoraproject.org/en-US/fedora-coreos/getting-started, using a Debian 11 (bullseye) system. I am thus creating a VM with the following virt-install command: virt-install --connect="qemu:///system" --name=coreos \ --vcpus=2 --memory=2048 \ --os-variant=fedora29 --import --graphics=none \ --disk="size=10,backing_store=$PWD/fedora-coreos-33.20201201.3.0-qemu.x86_64.qcow2" \ --qemu-commandline="-fw_cfg name=opt/com.coreos/config,file=/tmp/example.ign" which spits some warnings and this mysterious error 2020-12-29T16:52:03.858938Z qemu-system-x86_64: warning: host doesn't support requested feature: MSR(48FH).vmx-exit-load-perf-global-ctrl [bit 12] 2020-12-29T16:52:03.858941Z qemu-system-x86_64: warning: host doesn't support requested feature: MSR(490H).vmx-entry-load-perf-global-ctrl [bit 13] 2020-12-29T16:52:03.864778Z qemu-system-x86_64: -fw_cfg name=opt/com.coreos/config,file=/tmp/example.ign: can't load /tmp/example.ign: Failed to open file “/tmp/example.ign”: Permission denied the file /tmp/example.ign is perfectly world readable, -rw-rw-rw- 1 manu manu 1130 Dec 29 17:23 /tmp/example.ign so I am puzzled at what could cause this permission error. on a RHEL8 system, I had the same error, and was able to fix by setting a security context on the firmware file: sudo semanage fcontext --add --type virt_content_t /tmp/example.ign restorecon /tmp/example.ign now this Debian system does not selinux installed at all. ls -dZ / ? / I could also read the qemu firmware file when using the qemu:///session connection any pointers where to look for ? Emmanuel

2 1

Isolated bridge does not bridge
by Paul van der Vlis 04 Jan '21

04 Jan '21

Hello, I want to do some testing and I have removed two VM's from the bridge what connects them to internet, and added them to another isolated bridge what's not connected to internet. Problem is that I cannot reach the other host in the isolated network. Something like this: virsh shutdown kvm66 virsh shutdown kvm68 brctl delif br0 vnet10 vnet6 # the interfaces of kvm66 and kvm68 brctl addbr br1 brctl addif br1 vnet10 vnet6 Then I've replaced br0 to br1 in the XML of both VM's with "virsh edit". Then I did start the VM's using the serial console (no network): virsh start --console kvm66 virsh start --console kvm68 I cannot ping from one machine to the other. Why?? With regards, Paul -- Paul van der Vlis Linux systeembeheer Groningen https://www.vandervlis.nl/

4 5

How to open listener of Libvirt ?
by tommy 04 Jan '21

04 Jan '21

Hi,every one: My Ubuntu is : 20.04 LTS, and I using libvirtd on it to manage KVM vm, but now I can not open listener function of the libvirtd. SYSTEM SOCKET ACTIVATION The libvirtd daemon is capable of starting in two modes. In the traditional mode, it will create and listen on UNIX sockets itself. If the --listen parameter is given, it will also listen on TCP/IP socket(s), according to the listen_tcp and listen_tls options in /etc/libvirt/libvirtd.conf In socket activation mode, it will rely on systemd to create and listen on the UNIX, and optionally TCP/IP, sockets and pass them as pre-opened file de� scriptors. In this mode, it is not permitted to pass the --listen parameter, and most of the socket related config options in /etc/libvirt/libvirtd.conf will no longer have any effect. To enable TCP or TLS sockets use either $ systemctl start libvirtd-tls.socket Or $ systemctl start libvirtd-tcp.socket But, on my system, there are no such service like libvirtd-tls.socket or libvirtd-tcp.socket. root@ubts1:~# systemctl | grep libvirt libvirt-guests.service loaded active exited Suspend/Resume Running libvirt Guests libvirtd.service loaded active running Virtualization daemon libvirtd-admin.socket loaded active running Libvirt admin socket libvirtd-ro.socket loaded active running Libvirt local read-only socket libvirtd.socket loaded active running Libvirt local socket How can I open the listener ? Thanks！

2 3

cannot get Libvirt/qemu to use secure boot
by Felix Rubio Dalmau 29 Dec '20

29 Dec '20

Hi everybody, I am having serious trouble enabling secure boot via virt-install... and I do not see clearly even where to look for help :-/. Maybe somebody can point me on the right direction? I am running: arch linux edk2-ovmf 202011-1 libvirt 6.5 virt-install 3.2 qemu 5.2 I am creating the domain with virt-install, and the parameters --features smm.state=on --boot loader=/usr/share/ovmf/x64/OVMF_CODE.secboot.fd,nvram.template=/usr/share/ovmf/x64/OVMF_VARS.fd,loader.readonly=yes,loader.type=pflash,loader_secure=yes If I boot into the UEFI I can see there is the menu for the OVMF and Secure Boot available, but when I get into the Secure Boot entry, I only see it is "disabled" and I cannot tick the "Attempt secure boot" box. As far as I understand, by using OVMF_CODE.secboot.f I should already get the default keys working, so I should be good to go to test this setup, but... to no success. Does anybody have any idea on what might be wrong/where can I get help (should this not be the place?) Thank you! Felix

1 1

Manage libvirt actions through netgroups and PolKit
by Gi Actor 26 Dec '20

26 Dec '20

1 0

libvirt-lxc: Permission issue of /proc/net
by John Hurnett 24 Dec '20

24 Dec '20

Hi, I've encountered a problem that some of /proc/net/ files can't be accessed in unprivileged containers, because it is owned by nobody:nogroup (-1:-1) and have 440 permissions. This exact issue was solved in LXC project by unsharing netns: https://github.com/lxc/lxc/commit/5b1e83cbc498cd3edeaf13afa987d530299a35a7 . Maybe it could be similarly fixed on libvirt-lxc? BR, John H.

2 2

AppArmor issue when using gluster storage pool
by Max Schettler 16 Dec '20

16 Dec '20

Hi, I'm trying to run a VM image that's stored on a gluster storage pool which I added to libvirt (5.0.0) on a Debian 10 installation. Whenever I try to boot a gluster-based VM, I get an error message about a missing AppArmor profile. In fact, the corresponding files (/etc/apparmor.d/libvirt/libvirt-{,.files}) are missing. After some tinkering I noticed that the profile for the VM are in fact missing iff there is a gluster-based disk attached to the VM in question. Whenever I remove the disk, the profile files reappear, and when I add it again, they are not present. I am wondering what might cause this, and how I could fix, or work around it, other than outright disabling AppArmor altogether. Thanks and best regards, Max Schettler -- Max Schettler, M.Sc. TKN, TU Berlin, Germany http://www.ccs-labs.org/team/schettler/

1 0

SASL(-1): generic failure: All-whitespace username - from HA/pacemaker
by lejeczek 15 Dec '20

15 Dec '20

Hi guys, I have a HA/pacemaker cluster with VirtualDomain and it all seems to work fine, VMs start & stop, except for live migration. So I thought I'd start here with errors I see, from 'pacemaker': ... All-whitespace username. notice: vpn1_migrate_to_0[977276] error output [ error: authentication failed: Failed to start SASL negotiation: -1 (SASL(-1): generic failure: All-whitespace username.) ] notice: vpn1_migrate_to_0[977276] error output [ ocf-exit-reason:vpn1: live migration to dzien failed: 1 ] notice: Result of migrate_to operation for vpn1 on swir: error notice: swir-vpn1_migrate_to_0:189 [ error: authentication failed: Failed to start SASL negotiation: -1 (SASL(-1): generic failure: All-whitespace username.)\nocf-exit-reason:vpn1: live migration to dzien failed: 1\n ] notice: Result of stop operation for vpn1 on swir: ok Can you shed more light on what virsh/libvirt says there? many thanks, L.

1 0

live migration with authentication - how?
by lejeczek 15 Dec '20

15 Dec '20

Hi guys. I'm trying I assumed something very crude, logic suggested I should try it first: $ virsh migrate reactos qemu+ssh://dzien/system?authfile=/etc/ovirt-hosted-engine/virsh_auth.conf Please enter your authentication name: vdsm@ovirt Please enter your password: As you can see I still get asked for credentials. Is it possible to live migrate that(or some) way, without being asked for those? many thanks, L.

2 2

Libvirt-lxc: iptables not working in containers
by John Hurnett 15 Dec '20

15 Dec '20

Hi, I can't get iptables to work in libvirt-lxc containers. "iptables -L" command shows empty chains. However I tested the same scenario with pure lxc and iptables works as it should. Has anyone experienced that? It seems like a bug, but maybe there is some libvirt xml parameter I am missing? BR

2 1