- Users - libvirt List Archives

[libvirt-users] Migration b/w nodes with different security models
by Andrey Korolyov 19 Jun '15

19 Jun '15

Hello, I`ve found that the currently end-user may not migrate a VM between nodes with different security_require_confined, what are reasons to forbid such a thing? The security measures are almost not applicable here - if the guest was able to poison the emulator` stack on an unsecured node, he may do the same on a secured one, though the potential consequences will be far more limited. Are there any real-world cases whose prohibition may be helpful in a terms of security measurements for migration I am currently missing? I think it would be safe to exclude total poisoning of a source node in which case libvirtd itself is owned and can try to send a malicious configuration (with changed backing files locations for example). Thanks!

1 0

[libvirt-users] Use virtio channel send data to vm fail
by 2020human 18 Jun '15

18 Jun '15

1. I created a virtual machine and add channel: <channel type='unix'> <source mode='bind' path='/var/lib/libvirt/qemu/r-22-VM.agent'/> <target type='virtio' name='r-22-VM.vport'/> <address type='virtio-serial' controller='0' bus='0' port='1'/> </channel> 2. Use scripts,run this scripts is no error output #!/usr/bin/python import socket s=socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) s.connect("/var/lib/libvirt/qemu/r-22-VM.agent") s.send("test\n") s.close 3. But i not read date in vm device /dev/vport0p1 (vm is run) My version, libvirt: 1.2.13.1 qmeu: 2.3.0 system: centos 6.5 This test in libvirt 1.0.5.7 qemu 1.5.3 is success. Please help , thanks

1 0

[libvirt-users] Libvirt LXC hostname
by Anu Mercian 15 Jun '15

15 Jun '15

Hello, I am trying to bring up an lxc with Centos 6.6 using libvirt command: "virsh -c lxc:/// create vm.xml" When I do the above, the new VM created gets the hostname of the host where libvirt is installed. When I looked up help on the past mail-lists. It seems like this was a problem back in 2013 and it was mentioned that host name cannot be provided. I was wondering if this has been resolved and the host name can be provided in the URI. Link to the similar issue back in 2013: https://www.redhat.com/archives/libvirt-users/2013-November/msg00080.html Any help is much appreciated. Thank you, Anu

2 1

[libvirt-users] Recommended change for the networking page in wiki
by BJ 13 Jun '15

13 Jun '15

Hello all, I was told on IRC that I should come here to discuss a recommended change on the networking page in the wiki. If you take a look at the "Basic Script" shown here: http://wiki.libvirt.org/page/Networking#Forwarding_Incoming_Connections It does two things: 1) Create a DNAT rule in the NAT table of IPTABLES 2) Create a FORWARD rule in the FILTER table of IPTABLES The FORWARD rule is set up as it ought to be, however, the DNAT rule has some unintended consequences. I set up a DNAT on port 80, and suddenly, I couldn't access out on port 80 anymore from my guest machine. However, if I changed the destination address from "anywhere" to the IP of the host machine, the problem resolved. So I change the script to as follows. (Changes are highlighted. For some reason the original script didn't work using /bin/sh, but it did with /bin/bash, so I changed that too). *#!/bin/bash* # used some from advanced script to have multiple ports: use an equal number of guest and host ports Guest_name=xxxxxxx Guest_ipaddr=xxx.xxx.xxx.xx *Host_ipaddr=xxx.xxx.xxx.xx* Host_port=( '80' '443' ) Guest_port=( '80' '443' ) length=$(( ${#Host_port[@]} - 1 )) if [ "${1}" = "${Guest_name}" ]; then if [ "${2}" = "stopped" -o "${2}" = "reconnect" ]; then for i in `seq 0 $length`; do iptables -t nat -D PREROUTING *-d ${Host_ipaddr}* -p tcp --dport ${Host_port[$i]} -j DNAT --to ${Guest_ipaddr}:${Guest_port[$i]} iptables -D FORWARD -d ${Guest_ipaddr}/32 -p tcp -m state --state NEW -m tcp --dport ${Guest_port[$i]} -j ACCEPT done fi if [ "${2}" = "start" -o "${2}" = "reconnect" ]; then for i in `seq 0 $length`; do iptables -t nat -A PREROUTING *-d ${Host_ipaddr}* -p tcp --dport ${Host_port[$i]} -j DNAT --to ${Guest_ipaddr}:${Guest_port[$i]} iptables -I FORWARD 4 -d ${Guest_ipaddr}/32 -p tcp -m state --state NEW -m tcp --dport ${Guest_port[$i]} -j ACCEPT done fi fi Lastly, I should note that I am using Ubuntu 14.04, both for the host and guest. I'm also curious as to why this is considered a hack method. It states in the wiki that "This method is a hack", but it doesn't express why. Many VM Servers have similar features. I know Virtual Box does, I use the same feature there. It may not be how I would set up a production server, but doesn't make it a hack. Thanks, BJ

3 6

[libvirt-users] <vcpu placement='static' current='N'>M</vcpu>
by Thomas Stein 12 Jun '15

12 Jun '15

Hello. I seem to be to stupid to configure vcpu hotplugging on one of my machines. Whenever i set: <vcpu placement='static' current='4'>4</vcpu> and save this setting, this setting is undone by libvirt. It jumps back to: <vcpu placement='static'>4</vcpu> I'm confused now. Someone has an idea what's going on here? Any hints are really appreciated. cheers t.

2 2

Re: [libvirt-users] <vcpu placement='static' current='N'>M</vcpu>
by Thomas Stein 12 Jun '15

12 Jun '15

Am 12.06.15 um 11:43 schrieb Dominique Ramaekers: > Did you shutdown the guest before making this change? Yes. I even can't set this setting while the machine is powered off. Here ist the machines xml. <domain type='kvm'> <name>changed</name> <uuid>c71f66b3-2fd1-42f0-b8be-42999857eb95</uuid> <memory unit='KiB'>4194304</memory> <currentMemory unit='KiB'>2097152</currentMemory> <vcpu placement='static'>4</vcpu> <resource> <partition>/machine</partition> </resource> <os> <type arch='x86_64' machine='pc-0.14'>hvm</type> <boot dev='hd'/> </os> <features> <acpi/> <apic/> <pae/> </features> <cpu mode='host-model'> <model fallback='allow'/> </cpu> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>restart</on_crash> <devices> <emulator>/usr/bin/qemu-system-x86_64</emulator> <disk type='file' device='disk'> <driver name='qemu' type='qcow2' cache='writeback' io='threads'/> <source file='/var/lib/libvirt/images/1.qcow2'/> <target dev='vda' bus='virtio'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> </disk> <disk type='file' device='disk'> <driver name='qemu' type='qcow2' cache='writethrough' io='threads'/> <source file='/var/lib/libvirt/images/nfs.qcow2'/> <target dev='vdb' bus='virtio'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> </disk> <controller type='virtio-serial' index='0'> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </controller> <controller type='usb' index='0'> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> </controller> <controller type='pci' index='0' model='pci-root'/> <interface type='network'> <mac address='52:54:00:18:75:ef'/> <source network='routed'/> <model type='virtio'/> <filterref filter='filter-changed'> <parameter name='IP' value='changed'/> </filterref> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> <serial type='pty'> <target port='0'/> </serial> <console type='pty'> <target type='serial' port='0'/> </console> <channel type='unix'> <source mode='bind' path='/var/lib/libvirt/qemu/f16x86_64.agent'/> <target type='virtio' name='org.qemu.guest_agent.0'/> <address type='virtio-serial' controller='0' bus='0' port='1'/> </channel> <input type='mouse' bus='ps2'/> <input type='keyboard' bus='ps2'/> <graphics type='vnc' port='-1' autoport='yes' listen='127.0.0.1'> <listen type='address' address='127.0.0.1'/> </graphics> <video> <model type='cirrus' vram='16384' heads='1'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </video> <memballoon model='virtio'> <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> </memballoon> </devices> <seclabel type='none' model='none'/> </domain> cheers t. > -----Oorspronkelijk bericht----- > Van: Thomas Stein [mailto:himbeere@meine-oma.de] > Verzonden: vrijdag 12 juni 2015 11:32 > Aan: libvirt-users(a)redhat.com > Onderwerp: [libvirt-users] <vcpu placement='static' current='N'>M</vcpu> > > Hello. > > I seem to be to stupid to configure vcpu hotplugging on one of my machines. Whenever i set: > > <vcpu placement='static' current='4'>4</vcpu> > > and save this setting, this setting is undone by libvirt. It jumps back to: > > <vcpu placement='static'>4</vcpu> > > I'm confused now. Someone has an idea what's going on here? Any hints are really appreciated. > > cheers > t. > > _______________________________________________ > libvirt-users mailing list > libvirt-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/libvirt-users >

1 1

Re: [libvirt-users] [ovirt-users] Bug in Snapshot Removing
by Soeren Malchow 12 Jun '15

12 Jun '15

Small addition again: This error shows up in the log while removing snapshots WITHOUT rendering the Vms unresponsive — Jun 01 01:33:45 mc-dc3ham-compute-02-live.mc.mcon.net libvirtd[1657]: Timed out during operation: cannot acquire state change lock Jun 01 01:33:45 mc-dc3ham-compute-02-live.mc.mcon.net vdsm[6839]: vdsm vm.Vm ERROR vmId=`56848f4a-cd73-4eda-bf79-7eb80ae569a9`::Error getting block job info Traceback (most recent call last): File "/usr/share/vdsm/virt/vm.py", line 5759, in queryBlockJobs… — From: Soeren Malchow <soeren.malchow(a)mcon.net<mailto:soeren.malchow@mcon.net>> Date: Monday 1 June 2015 00:56 To: "libvirt-users(a)redhat.com<mailto:libvirt-users@redhat.com>" <libvirt-users(a)redhat.com<mailto:libvirt-users@redhat.com>>, users <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] Bug in Snapshot Removing Dear all I am not sure if the mail just did not get any attention between all the mails and this time it is also going to the libvirt mailing list. I am experiencing a problem with VM becoming unresponsive when removing Snapshots (Live Merge) and i think there is a serious problem. Here are the previous mails, http://lists.ovirt.org/pipermail/users/2015-May/033083.html The problem is on a system with everything on the latest version, CentOS 7.1 and ovirt 3.5.2.1 all upgrades applied. This Problem did NOT exist before upgrading to CentOS 7.1 with an environment running ovirt 3.5.0 and 3.5.1 and Fedora 20 with the libvirt-preview repo activated. I think this is a bug in libvirt, not ovirt itself, but i am not sure. The actual file throwing the exception is in VDSM (/usr/share/vdsm/virt/vm.py, line 697). We are very willing to help, test and supply log files in anyway we can. Regards Soeren

3 12

[libvirt-users] SSH into LXC and install files via JAVA API
by Anu Mercian 11 Jun '15

11 Jun '15

Hello everyone, I am trying to use libvirt's JAVA API to ssh into a domain and install some files, for example, dhcpd. Using virsh, its pretty straight forward using the command line: virsh -c lxc:/// create myguest.xml virsh -c lxc:/// console myguest virsh -c lxc:/// lxc-enter-namespace myguest -- sudo yum install dhcpd But in order to incorporate the above functionality in a JAVA API, I am not really sure what to do. The following command helps me ssh into a system, but I am not sure how to send remote commands. conn = Connect("lxc+ssh:///") Please can someone help me out with this? Thank you, Anu

1 0

[libvirt-users] how do I use the same secret with the same ID on all libvrit/qemu/kvm hosts?
by Jelle de Jong 10 Jun '15

10 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello everybody, Every time I use [virsh secret-define --file secret.xml] I get an unique id back and I use this id in my vm guests xml configs, but this is preventing me from live migrating between kvm host. Maybe im using the wrong methods, but i normaly dumpxml the config and define it in the other kvm hosts (scripted) but now this other host has an other unique id and the kvm guests fails so I'm guessing I need to use the same secret id betwen all my kvm hosts but how do i do this? Kind regards, Jelle de Jong -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iJwEAQECAAYFAlV3Pa0ACgkQ1WclBW9j5HmSsAP/ZqG0kqf+pQPD1Jng+qIA1Ih8 qEabjpZyBAz5AITP6RpeopP+ZAyXIlex4xmSGPBNZPT2OEC9J4jA0AcC65MiG44f 1ma2C7VckoPoONO0D9q8JLwqG8fFVqAFZBTszBz5sj7qzEPiIC5/g6b0czf8QUno b9LwvViwGCPgfETBkXU= =zT/0 -----END PGP SIGNATURE-----

1 1

[libvirt-users] LXCs using Libvirt
by Anu Mercian 10 Jun '15

10 Jun '15

Hi all, I am trying to bring up lxc's using Libvirt JAVA API. I do the following: conn = Connect("lxc:\\\") xml_config = "<domain> .... <\domain>" dom = conn.domainCreateXML(xml_config, 0) dom.create() Using the above code, I am able to start a domain but the domain is not visible within the "lxc" list, i.e when I use the command "lxc-ls --fancy", the domain that was created cannot be viewed, although, when I use the function conn.listDomains(), I can view the domain. As a work-around if I use the "lxc-create -t <OS> -n <name>" command followed by "conn.domainDefineXML(xml_config)", I can view the domain within "lxc-ls --fancy" Any one has observed this problem earlier and is there a way I can create the domain without using "lxc-create ..." command and still list the domain on the "lxc-ls --fancy" list? Thank you, Anu

2 2