- Users - libvirt List Archives

nftables rules (DNS, DHCP, etc) not being written on Fedora 41
by Robin Lee Powell 21 Feb '25

21 Feb '25

I do not think this is any of the similar issues that have been posted to this list; I've checked. In particular, this in *NOT* an issue with nft rules precedence; the rules are simply not being written by libvirt. I'm running vagrant which is running libvirt on a Fedora 41 host. I do not think this is a vagrant problem, but if people want me to run virsh commands directly I certainly can. Anyway, vagrant was failing until I noticed that the default for /etc/libvirt/network.conf is now nftables, which I did not have set up. When I set `firewall_backend = "iptables"`, everything worked fine. I want to emphasize that: the same vagrant / libvirt setup *was* working with iptables. But I took that as a sign that it was time to move to nftables, so I moved everything on this host and stuff is back to working. But libvirt just isn't writing out the right nft rules. Like, at all. Here's the network vagrant creates: $ sudo virsh net-dumpxml vagrant-libvirt <network connections='1' ipv6='yes'> <name>vagrant-libvirt</name> <uuid>b2d93ef4-b305-4382-a380-c1eca92d8ebd</uuid> <forward mode='nat'> <nat> <port start='1024' end='65535'/> </nat> </forward> <bridge name='virbr1' stp='on' delay='0'/> <mac address='52:54:00:63:d3:f6'/> <ip address='192.168.121.1' netmask='255.255.255.0'> <dhcp> <range start='192.168.121.1' end='192.168.121.254'/> </dhcp> </ip> </network> And here's the *entire* libvirt-related ruleset in nftables: table ip libvirt_network { chain forward { type filter hook forward priority filter; policy accept; counter packets 0 bytes 0 jump guest_cross counter packets 0 bytes 0 jump guest_input counter packets 0 bytes 0 jump guest_output } chain guest_output { ip saddr 192.168.121.0/24 iif "virbr1" counter packets 0 bytes 0 accept iif "virbr1" counter packets 0 bytes 0 reject } chain guest_input { oif "virbr1" ip daddr 192.168.121.0/24 ct state established,related counter packets 0 bytes 0 accept oif "virbr1" counter packets 0 bytes 0 reject } chain guest_cross { iif "virbr1" oif "virbr1" counter packets 0 bytes 0 accept } chain guest_nat { type nat hook postrouting priority srcnat; policy accept; ip saddr 192.168.121.0/24 ip daddr 224.0.0.0/24 counter packets 1 bytes 187 return ip saddr 192.168.121.0/24 ip daddr 255.255.255.255 counter packets 0 bytes 0 return meta l4proto tcp ip saddr 192.168.121.0/24 ip daddr != 192.168.121.0/24 counter packets 0 bytes 0 masquerade to :1024-65535 meta l4proto udp ip saddr 192.168.121.0/24 ip daddr != 192.168.121.0/24 counter packets 0 bytes 0 masquerade to :1024-65535 ip saddr 192.168.121.0/24 ip daddr != 192.168.121.0/24 counter packets 0 bytes 0 masquerade } } table ip6 libvirt_network { chain forward { type filter hook forward priority filter; policy accept; counter packets 0 bytes 0 jump guest_cross counter packets 0 bytes 0 jump guest_input counter packets 0 bytes 0 jump guest_output } chain guest_output { iif "virbr1" counter packets 0 bytes 0 reject } chain guest_input { oif "virbr1" counter packets 0 bytes 0 reject } chain guest_cross { iif "virbr1" oif "virbr1" counter packets 0 bytes 0 accept } chain guest_nat { type nat hook postrouting priority srcnat; policy accept; } } Here's some log output (I have virtnetworkd running with -v): $ sudo journalctl -u virtnetworkd.service | grep -i nft [snip] Feb 20 21:36:42 stodi.digitalkingdom.org virtnetworkd[89119]: using firewall_backend: 'nftables' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft list table ip libvirt_network' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft list table ip6 libvirt_network' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_output iif virbr1 counter reject' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_input oif virbr1 counter reject' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_cross iif virbr1 oif virbr1 counter accept' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip6 libvirt_network guest_output iif virbr1 counter reject' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip6 libvirt_network guest_input oif virbr1 counter reject' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip6 libvirt_network guest_cross iif virbr1 oif virbr1 counter accept' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_output ip saddr 192.168.121.0/24 iif virbr1 counter accept' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_input oif virbr1 ip daddr 192.168.121.0/24 ct state related,established counter accept' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat ip saddr 192.168.121.0/24 ip daddr '!=' 192.168.121.0/24 counter masquerade' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat meta l4proto udp ip saddr 192.168.121.0/24 ip daddr '!=' 192.168.121.0/24 counter masquerade to :1024-65535' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat meta l4proto tcp ip saddr 192.168.121.0/24 ip daddr '!=' 192.168.121.0/24 counter masquerade to :1024-65535' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat ip saddr 192.168.121.0/24 ip daddr 255.255.255.255/32 counter return' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat ip saddr 192.168.121.0/24 ip daddr 224.0.0.0/24 counter return' So it's not like trying to create the rules and failing, that I can see; it just isn't trying. To clarify this setup appears to be missing every rule that would be needed for DHCPv4 and DNS to work. Like https://gitlab.com/libvirt/libvirt/-/issues/88#note_694493261 shows rules for udp 67 and 53 that are just 100% not being created at all. I have no idea what's going wrong here or even where to look; the code at https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/GT75… sure *looks like* it should be unconditionally adding those rules. Help?

1 0

Re: SEV-SNP Libvirt Support
by Michal Prívozník 17 Feb '25

17 Feb '25

On 2/17/25 11:11, Paraskevas Nik wrote: > Hello Michael, > Thanks for responding. I have built the libvirt and and then used ninja > install to install it. Does this also installs the correct selinux labels? Depends, if you've passed "-Dsystem=true" to meson setup then it should replace the system binaries and thus SELinux might have the correct policy. But otherwise, I'd suggest 'meson dist && rpmbuild -ta ...' and then installing those RPMs. Michal

2 1

SEV-SNP Libvirt Support
by Paraskevas Nik 17 Feb '25

17 Feb '25

Hello, I am trying to build libvirt v10.5.0 to support SEV-SNP but when I run virsh domcapabilities I am getting <sev support=no>. If I install libvirt 8.0.0 using apt install libvirt-daemon-system qemu-kvm them sev shows as supported. Everything is enabled on the system about SEV, SEV-ES, SEV-SNP. Is there a specific build option to enable SEV? *# cat /sys/module/kvm_amd/parameters/sev* *Y* *CPU: AMD EPYC 9254* *# dmesg | grep -i sev* *[ 0.000000] SEV-SNP: RMP table physical range [0x000000002d500000 - 0x000000004ddfffff]* *[ 0.009021] SEV-SNP: Reserving start/end of RMP table on a 2MB boundary [0x000000002d400000]* *[ 11.184492] ccp 0000:01:00.5: sev enabled* *[ 12.664210] ccp 0000:01:00.5: SEV API:1.55 build:36* *[ 12.664217] ccp 0000:01:00.5: SEV-SNP API:1.55 build:36* *[ 12.671343] kvm_amd: SEV enabled (ASIDs 16 - 1006)* *[ 12.671345] kvm_amd: SEV-ES enabled (ASIDs 1 - 15)* *[ 12.671346] kvm_amd: SEV-SNP enabled (ASIDs 1 - 15)* *Linux kernel version: 6.12**Libvirt version: 10.5.0* *qemu-system-x86_64 version : 9.1.0* *If you need any other information please let me know.Cheers*

2 1

Re: Network denied access
by Rodrigo Prieto 12 Feb '25

12 Feb '25

Thank you for taking the time to respond. I want to mention that I don't speak English, and it's difficult for me to understand using a translator. In the file */etc/libvirt/libvirtd.conf*, I have the following: access_drivers = [ "polkit" ] The *virtqemud* and *virtnetworkd* services are not installed. I used the version from the Debian 12 repositories. systemctl status virtnetworkd.socket Unit virtnetworkd.socket could not be found. systemctl status virtqemud.socket Unit virtqemud.socket could not be found. In the file */etc/libvirt/qemu.conf*, the default configuration is present. Best regards. El jue, 6 feb 2025 a las 20:48, Rodrigo Prieto (<rodrigoprieto2019(a)gmail.com>) escribió: > Thank you for taking the time to respond. I want to mention that I don't > speak English, and it's difficult for me to understand using a translator. > > In the file */etc/libvirt/libvirtd.conf*, I have the following: > access_drivers = [ "polkit" ] > > > The *virtqemud* and *virtnetworkd* services are not installed. I used the > version from the Debian 12 repositories. > > systemctl status virtnetworkd.socket > Unit virtnetworkd.socket could not be found. > > systemctl status virtqemud.socket > Unit virtqemud.socket could not be found. > > In the file */etc/libvirt/qemu.conf*, the default configuration is > present. > > Best regards. > > El jue, 6 feb 2025 a las 12:55, Martin Kletzander (<mkletzan(a)redhat.com>) > escribió: > >> On Fri, Jan 31, 2025 at 03:34:03AM -0300, Rodrigo Prieto wrote: >> >Hello, >> > >> >I am configuring Polkit using an example I found on the web. It correctly >> >displays the assigned domain for a given user, but when I try to start >> the >> >VM, I get the following error: >> > >> >error: Failed to start domain 'debian12' >> >error: access denied: 'network' denied access >> > >> >Here is my configuration: >> > >> >polkit.addRule(function(action, subject) { >> > if (action.id == "org.libvirt.unix.manage" && >> > subject.user == "lolo") { >> > return polkit.Result.YES; >> > } >> >}); >> >polkit.addRule(function(action, subject) { >> > if (action.id.indexOf("org.libvirt.api.domain.") == 0 && >> > subject.user == "lolo") { >> > if (action.lookup("connect_driver") == 'QEMU' && >> > action.lookup("domain_name") == 'debian12') { >> > return polkit.Result.YES; >> > } else { >> > return polkit.Result.NO; >> > } >> > } >> >}); >> > >> >> So doing this allows you to do anything with debian12 domain on the QEMU >> connection driver. >> >> >To grant network access, I have to configure the following: >> > >> >polkit.addRule(function(action, subject) { >> > if (action.id.indexOf("org.libvirt.api.network") == 0 && >> > subject.user == "lolo") { >> > return polkit.Result.YES; >> > } >> >}); >> > >> >> Adding this allows you to do anything with any network. This rule does >> omit a condition similar to the above one from the api.domain rule. >> >> >The problem with the previous configuration is that it allows full access >> >to the network, requiring the following configuration: >> > >> >> *to all the networks >> >> >polkit.addRule(function(action, subject) { >> > if ((action.id == "org.libvirt.api.network.stop" || >> > action.id == "org.libvirt.api.network.delete" || >> > action.id == "org.libvirt.api.network.write") && >> > subject.user == "lolo") { >> > return polkit.Result.NO; >> > } >> >}); >> > >> >By default, shouldn't network access behave like domains or pools, which >> >cannot be deleted? >> >> Can you not? The domain undefine API checks domain:delete ACL with the >> domain name and network undefine API checks network:delete ACL with the >> network name. I'll have to test it, but in the meantime could you try >> reproducing that with the same polkit rules (obviously modified to fit >> the domain/network difference)? >> >> >I tested it on Libvirt 9.0.0 and 10.0.0 >> > >> >> I did not find any difference between 9.0.0 and the current master with >> a quick git-fu. >> >> I tested it on current git master and it works fine, the user can >> undefine both the network and the domain, but only the one named as >> specified. >> >> >If you can help me, I would really appreciate it. >> >> Be sure to check that both virtqemud and virtnetworkd use polkit as >> their access driver in their respective configs. >> >> Have a nice day, >> Martin >> >

2 1

How can I control iptables/nftables rules addition on libvirtd host on Debian 12 ?
by oza.4h07＠gmail.com 10 Feb '25

10 Feb '25

Hello, When I install libvirt-daemon on a Debian 12 host, I can see the iptables rules below beeing added. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :LIBVIRT_FWI - [0:0] :LIBVIRT_FWO - [0:0] :LIBVIRT_FWX - [0:0] :LIBVIRT_INP - [0:0] :LIBVIRT_OUT - [0:0] -A INPUT -j LIBVIRT_INP -A FORWARD -j LIBVIRT_FWX -A FORWARD -j LIBVIRT_FWI -A FORWARD -j LIBVIRT_FWO -A OUTPUT -j LIBVIRT_OUT -A LIBVIRT_FWI -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A LIBVIRT_FWI -o virbr0 -j REJECT --reject-with icmp-port-unreachable -A LIBVIRT_FWO -s 192.168.122.0/24 -i virbr0 -j ACCEPT -A LIBVIRT_FWO -i virbr0 -j REJECT --reject-with icmp-port-unreachable -A LIBVIRT_FWX -i virbr0 -o virbr0 -j ACCEPT -A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 53 -j ACCEPT -A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT -A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 67 -j ACCEPT -A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT -A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 53 -j ACCEPT -A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 53 -j ACCEPT -A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT -A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 68 -j ACCEPT COMMIT For some reason, I need to add a couple of other rules. How can I do that ? Best regards

5 15

SEV Support Libvirt
by Paraskevas Nik 07 Feb '25

07 Feb '25

*Hello I am trying to enable libvirt to support sev-snp. Currently I am using virsh domcapabilities to check if its enabled but I am getting : <sev supported='no'/>* *Followed the instructions at : * *https://libvirt.org/kbase/launch_security_sev.html* <https://libvirt.org/kbase/launch_security_sev.html> * My AMD CPU supports SEV,SEV-SNP and I have followed all the steps and it is enabled. BIOS settings are configured to support SEV,SNP CPU: AMD EPYC 9254* *# cat /sys/module/kvm_amd/parameters/sev* *Y* *# dmesg | grep -i sev* *[ 0.000000] SEV-SNP: RMP table physical range [0x000000002d500000 - 0x000000004ddfffff]* *[ 0.009021] SEV-SNP: Reserving start/end of RMP table on a 2MB boundary [0x000000002d400000]* *[ 11.184492] ccp 0000:01:00.5: sev enabled* *[ 12.664210] ccp 0000:01:00.5: SEV API:1.55 build:36* *[ 12.664217] ccp 0000:01:00.5: SEV-SNP API:1.55 build:36* *[ 12.671343] kvm_amd: SEV enabled (ASIDs 16 - 1006)* *[ 12.671345] kvm_amd: SEV-ES enabled (ASIDs 1 - 15)* *[ 12.671346] kvm_amd: SEV-SNP enabled (ASIDs 1 - 15)* *Versions:* *Libvirt version: 10.7.0* *qemu-system-x86_64 version : 9.1.0* *Linux kernel version: 6.11.0-rc3* *Distro: Ubuntu 22.04.4 LTS* * If you need any other information please let me know.* Thanks!

2 1

Network denied access
by Rodrigo Prieto 06 Feb '25

06 Feb '25

Hello, I am configuring Polkit using an example I found on the web. It correctly displays the assigned domain for a given user, but when I try to start the VM, I get the following error: error: Failed to start domain 'debian12' error: access denied: 'network' denied access Here is my configuration: polkit.addRule(function(action, subject) { if (action.id == "org.libvirt.unix.manage" && subject.user == "lolo") { return polkit.Result.YES; } }); polkit.addRule(function(action, subject) { if (action.id.indexOf("org.libvirt.api.domain.") == 0 && subject.user == "lolo") { if (action.lookup("connect_driver") == 'QEMU' && action.lookup("domain_name") == 'debian12') { return polkit.Result.YES; } else { return polkit.Result.NO; } } }); To grant network access, I have to configure the following: polkit.addRule(function(action, subject) { if (action.id.indexOf("org.libvirt.api.network") == 0 && subject.user == "lolo") { return polkit.Result.YES; } }); The problem with the previous configuration is that it allows full access to the network, requiring the following configuration: polkit.addRule(function(action, subject) { if ((action.id == "org.libvirt.api.network.stop" || action.id == "org.libvirt.api.network.delete" || action.id == "org.libvirt.api.network.write") && subject.user == "lolo") { return polkit.Result.NO; } }); By default, shouldn't network access behave like domains or pools, which cannot be deleted? I tested it on Libvirt 9.0.0 and 10.0.0 If you can help me, I would really appreciate it.

2 1

Detect OS
by rodrigoprieto2019＠gmail.com 31 Jan '25

31 Jan '25

Hello, I would like to know if this behavior is normal. When I create a VM locally using the virt-install command with the argument --osinfo detect=on, it works perfectly and detects the operating system version. However, when I try to do it remotely using virt-install --connect=qemu+tcp://x.x.x.x/system, the following error appears: `--os-variant/--osinfo OS name is required, but no value was set or detected. This is now a fatal error. Specifying an OS name is required for modern, performant, and secure virtual machine defaults. If you expected virt-install to detect an OS name from the install media, you can set a fallback OS name with: --osinfo detect=on,name=OSNAME You can see a full list of possible OS name values with: virt-install --osinfo list If your Linux distro is not listed, try one of generic values such as: linux2024, linux2022, linux2020, linux2018, linux2016 If you just need to get the old behavior back, you can use: --osinfo detect=on,require=off Or export VIRTINSTALL_OSINFO_DISABLE_REQUIRE=1` Both the host machine and the client PC have osinfo updated to the latest version as of today. If I execute the command with --os-variant, it works correctly when done remotely. Is there a way to make it detect the operating system automatically when connected remotely? I’m using libvirtd (libvirt) 10.10.0 on Debian 12. Best regards, and thank you.

3 2

The right way to revert to external disk snapshots
by Alex Serban 29 Jan '25

29 Jan '25

Hello everyone, I'm seeking guidance on *best practices* for virtual machine recovery using external disk snapshots, particularly in a storage environment with ZFS. My current snapshot and recovery *workflow* involves: - Keeping VM disks & state on a ZFS volume; - Creating external KVM/Libvirt disk-only snapshots, resulting in deltas kept on the volume, next to the disk images; - Capturing the entire VM state through ZFS snapshots; - VM recovery through ZFS snapshot clones. I am particularly interested in obtaining an app-consistent recovery, in which I need to revert to the KVM snapshot of the VM, to ensure the possible clean state offered by a quiesced snapshot. Reading other posts from the archive and forums, it is clear for me that I cannot simply revert to the VM's snapshot, if it's a disk-only one, and that I have to manage them manually. Thus, my question is: *what is the best practice in order to recover the VM to the external disk snapshot that we have*? *What I have tried* and worked but I'm not sure is the best practice: on a VM with only one snapshot, I've changed the disk source files (which were pointing to deltas), to the ones pointed by their backingStore source files, effectively making them use the disk state of the snapshot time. This only works for shut-off VMs, as live VMs cannot have their disk sources changed, of course. Thus, for powered on VMs in the use case with only one snapshot, I've chosen to use `virDomainBlockPull` in order to have the app-consistent state pulled on the current disk (which was and still is pointing to the delta). *My concerns* on the approach I took regard, mostly, scalability and the safety of the whole process: - I am not sure how I could revert again to the current snapshot with the operations I did: for powered off VMs, disk images will change once we start using the VM, and for powered on VMs, the blockpull will alter the deltas which the disks were pointing to; - I don't see how I could apply this method in a scalable way, if the VM had more than one snapshot. At least for powered-on VMs. Thus, I thought I should seek some advice from you guys and see if there's another, smarter way that I can do this. Thanks a lot for your time, Alex Serban

2 3

Cannot start network interfaces
by Iain M Conochie 28 Jan '25

28 Jan '25

Good day all, I have having an issue starting virtual networks defined within libvirt: virsh # net-start cmdb error: Failed to start network cmdb error: internal error: Child process (VIR_BRIDGE_NAME=virbr3 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/cmdb.conf -- leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper) unexpected exit status 2: dnsmasq: failed to create listening socket for 172.26.80.1: Address already in use The definition of the network is pretty simple: virsh # net-dumpxml cmdb <network> <name>cmdb</name> <uuid>42ffd3c4-624d-46ad-be21-bb3c61c67e41</uuid> <bridge name='virbr3' stp='on' delay='0'/> <mac address='52:54:00:5b:e9:6c'/> <domain name='shihad.org'/> <ip address='172.26.80.1' netmask='255.255.255.0'> </ip> </network> At the OS level, this network interface should get created by libvirt, so I am a bit mystified why dnsmasq is having an issue starting, as there is nothing using this address yet. In fact, virbr3 does not exist until libvirt would bring up this interface: ifconfig -a | grep virbr virbr0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 I am running libvirt 9.0.0 on Debian 12. Any help or pointers greatly appreciated. Thanks! Iain

4 7