- Users - libvirt List Archives

[libvirt-users] 9p host/guest permissions & selinux...?
by Morgan Read 21 Jun '15

21 Jun '15

Hello Folks It's with some trepidation that I venture on to such a heady newsgroup, but I'm about ready to throw myself off a bridge after getting this all set up and apparently working only to be struck down by permissions and selinux hell (either, or both). I've followed instructions here: http://wiki.qemu.org/Documentation/9psetup http://troglobit.github.io/blog/2013/07/05/file-system-pass-through-in-kvm-… http://www.linux-kvm.org/page/9p_virtio The page at the last link helpfully concludes: Note: likely to hit some issues w/ privileges since Fedora libvirt runs guests unprivileged and with SELinux confinement...careful use of chown, chmod and chcon should get it working And, that's the most useful information I've been able to find... *Set up* Host - f21 server [user@frontserver ~]$ uname -a Linux frontserver.lan 4.0.4-202.fc21.i686+PAE #1 SMP Wed May 27 22:51:47 UTC 2015 i686 i686 i386 GNU/Linux Guest - f20 (vortexbox) [root@vortexbox ~]# uname -a Linux vortexbox 3.12.5-301.fc20.i686+PAE #1 SMP Mon Dec 16 18:42:48 EST 2013 i686 i686 i386 GNU/Linux Share is at /home/vortexbox-storage and shared to /storage Output of mount, touch, ls etc on host and guest: [user@frontserver home]$ ls lost+found user vortexbox-storage [user@frontserver home]$ ls -al vortexbox-storage total 12 drwxrwxrwx. 2 qemu qemu 4096 Apr 4 09:58 . drwxr-xr-x. 5 root root 4096 Mar 24 11:23 .. -rwxrwxrwx. 1 qemu qemu 17 Apr 3 17:54 hello [user@frontserver home]$ cd vortexbox-storage [user@frontserver vortexbox-storage]$ touch hello2 [user@frontserver vortexbox-storage]$ ls -al total 12 drwxrwxrwx. 2 qemu qemu 4096 Jun 20 22:07 . drwxr-xr-x. 5 root root 4096 Mar 24 11:23 .. -rwxrwxrwx. 1 qemu qemu 17 Apr 3 17:54 hello -rw-rw-r--. 1 user user 0 Jun 20 22:07 hello2 [user@frontserver vortexbox-storage]$ echo hello2 > hello2 [user@frontserver vortexbox-storage]$ cat hello2 hello2 [user@frontserver vortexbox-storage]$ ssh root(a)192.168.122.61 root(a)192.168.122.61's password: Last login: Sat Jun 20 16:44:37 2015 [root@vortexbox /]# umount /storage [root@vortexbox /]# ls -al | grep storage drwxr-xr-x 2 root root 4096 Jun 20 12:24 storage drwxr-xr-x 5 root root 4096 Mar 24 07:31 storage-tmp [root@vortexbox /]# mount -t 9p -o trans=virtio,version=9p2000.L,rw storage /storage [root@vortexbox /]# ls -al | grep storage drwxrwxrwx 2 107 107 4096 Jun 21 14:11 storage drwxr-xr-x 5 root root 4096 Mar 24 07:31 storage-tmp [root@vortexbox /]# cd /storage [root@vortexbox storage]# ls -al ls: cannot access hello: Permission denied total 8 drwxrwxrwx 2 107 107 4096 Jun 21 14:11 . dr-xr-xr-x. 20 root root 4096 Mar 24 07:43 .. -?????????? ? ? ? ? ? hello [root@vortexbox storage]# cat hello cat: hello: Permission denied [root@vortexbox storage]# ls -al ls: cannot access hello2: Permission denied ls: cannot access hello: Permission denied total 8 drwxrwxrwx 2 107 107 4096 Jun 21 14:13 . dr-xr-xr-x. 20 root root 4096 Mar 24 07:43 .. -?????????? ? ? ? ? ? hello -?????????? ? ? ? ? ? hello2 [root@vortexbox storage]# cat hello2 cat: hello2: Permission denied [root@vortexbox storage]# When I try touch or cat the hellos selinux-troubleshoot throws a wobbly. I've logged that as a bug here: https://bugzilla.redhat.com/show_bug.cgi?id=1234067 I figure it must be possible to give some fairly straight forward instruction (even for me) on what permissions to set where to get this working... If anyone can help, I would be very very grateful (and happy:) Thanks, M -- Morgan Read <mailto:mstuffATreadDOTorgDOTnz> Confused about DRM? Get all the info you need at: http://drm.info/

1 0

[libvirt-users] IOV / SR-IOV / MR-IOV for non-network hardware?
by nusrat 21 Jun '15

21 Jun '15

I've been looking for real-world examples of this for a long time -- mainly because I'm trying to decide whether to restrict my build-options to using only components which are all compatible with IOV. I'm thinking that the constraint would be worth it, if IOV could provide a significant performance benefit for non-network peripherals such as storage, video processing, etc. (compared to passthru / VT-d). http://www.storage-switzerland.com/Articles/Entries/2010/9/29_Offloading_I_… , http://www.plda.com/white-paper-why-using-single-root-io-virtualization-sr-… Almost everything I've found about this is in the abstract or inapplicable to multiple VMs in the same physical host. Examples: hypothetical use with HBAs or multiple graphics cards, http://blog.scottlowe.org/2009/12/02/what-is-sr-iov , http://lists.xen.org/archives/html/xen-users/2013-04/msg00126.html ; academic papers & theses, e.g. http://cs.uccs.edu/~gsc/pub/master/mkopps/doc/MKoppsReportRev3.pdf ; conference presentations, e.g. http://searchstorage.techtarget.com/video/I-O-virtualization-video-SR-IOV-M… ; hardware positioned between multiple hosts and a single peripheral, e.g. http://topics-cdn.dell.com/pdf/poweredge-vrtx_User's%20Guide_en-us.pdf ; and conceptual support for IOV in the spec for NVM Express. I did find actual physical products which claim IOV support, e.g. the LSI 3008 chip, which is used in some mobos and LSI HBAs. I've even found some posts re virtualization by people who discuss various aspects of having and using one of these products. But I have yet to find anyone -- certainly not anyone at or below the level of of "enthusiast", not anyone with a non-"enterprise-class" environment or budget -- who discusses even attempting IOV-based I/O other than for networking, let alone actually achieving it, let alone anyone with even subjective descriptions of performance differences. If non-networking IOV has the great potential discussed in the links above, can anyone tell me why it seems that no one is actually doing it? Kihl? Braren? zir_blazer? ScottLowe? Don Fountain? Boesch? John Howard? George Crump? Anyone? Anyone? Bueller?...

1 0

[libvirt-users] Migrating guests
by Dominique Ramaekers 20 Jun '15

20 Jun '15

Hi, I'm experimenting with the migration function of virsh. I'm doing the migrate with following commands: virsh migrate --life --persistent --copy-storage-all --verbose --abort-on-error domain qemu+ssh://root@destination/system virsh migrate-setmaxdowntime domain 20000 However sometimes at the end of the migration, the guest isn't started on the destination host. So I'm left with a machine that had an improper shutdown... If a live migration isn't reliable, I'm thinking to migrate as such: - guest is still runing - copy or rsync the disk image to the destination - shut down the guest - rsync the disk image again (to minimise the off-line period) - dumpxml of guest and copy to destination - define and start the guest on the destination With the methode of the live migration, the machine will be unresponsive for max 20s = 20000ms (or less if I chose to). The migration it self will take op to 5 hours but I guess I plan these nightly. With the other migration the guest will be really off-line for the duration of the (second) rsync. In my case with disk images from 50 to 150Gb, the rsync wil take up at least 30 minutes and every connection will be closed... Does any body has good experiences with live migrations (without shared storage)? Any tips? Any thoughts on the second method of migrating? Greetings, Dominique.

2 2

[libvirt-users] libvirt/dnsmasq integration
by Boylan, Ross 19 Jun '15

19 Jun '15

I'm struggling with getting this to work smoothly, meaning 1) from the host system I can resolve the names of the VM's and 2) from the VM's I can properly resolve the host name (I get 127.0.0.1, presumably because dnsmasq parsed /etc/hosts on the host). There was some encouraging discussion of this in 2010 (http://www.redhat.com/archives/libvir-list/2010-March/msg00005.html) but no resolution I can see. BTW, the resolvconf machinery (at least on Debian) might provide another line of attack, for systems that have it. Thanks. Ross Boylan

2 1

[libvirt-users] CPU Usage and Memory Usage for VM and Host
by Kumar R, Prashanth (Prashanth) 19 Jun '15

19 Jun '15

Hi All, I would like to know if there is a way to fetch the "CPU Usage and Memory Usage for VM " and CPU Usage and Memory Usage for a Host in the KVM environment using libvirt java sdk . I am using libvirt-0.5.1.jar. This is the maximum Information I could fetch using the libvirt java API.: ________________________________ vmname:flow-cluster1 state:VIR_DOMAIN_RUNNING ostype:hvm guest id :8f0b96e5-1e08-40ce-aea1-9985d80fcabb Max memory : 8388608 Max cpus : 4 Guest Info-cputime: 58930890000000 Guest Info-maxMem: 8388608 Guest Info-memory: 8388608 Guest Info-nrVirtCpu: 4 MemoryStatistic: 8388608 Autostart :false ________________________________ I tried looking into the libvirt java sdk but did not find any methods to fetch the exact CPU Usage percentage and Memory Usage percentage for a VM and Host. Can you please provide me with the java example if possible. Thanks, Prashanth R

1 0

[libvirt-users] Migration b/w nodes with different security models
by Andrey Korolyov 18 Jun '15

18 Jun '15

Hello, I`ve found that the currently end-user may not migrate a VM between nodes with different security_require_confined, what are reasons to forbid such a thing? The security measures are almost not applicable here - if the guest was able to poison the emulator` stack on an unsecured node, he may do the same on a secured one, though the potential consequences will be far more limited. Are there any real-world cases whose prohibition may be helpful in a terms of security measurements for migration I am currently missing? I think it would be safe to exclude total poisoning of a source node in which case libvirtd itself is owned and can try to send a malicious configuration (with changed backing files locations for example). Thanks!

1 0

[libvirt-users] Use virtio channel send data to vm fail
by 2020human 18 Jun '15

18 Jun '15

1. I created a virtual machine and add channel: <channel type='unix'> <source mode='bind' path='/var/lib/libvirt/qemu/r-22-VM.agent'/> <target type='virtio' name='r-22-VM.vport'/> <address type='virtio-serial' controller='0' bus='0' port='1'/> </channel> 2. Use scripts,run this scripts is no error output #!/usr/bin/python import socket s=socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) s.connect("/var/lib/libvirt/qemu/r-22-VM.agent") s.send("test\n") s.close 3. But i not read date in vm device /dev/vport0p1 (vm is run) My version, libvirt: 1.2.13.1 qmeu: 2.3.0 system: centos 6.5 This test in libvirt 1.0.5.7 qemu 1.5.3 is success. Please help , thanks

1 0

[libvirt-users] Libvirt LXC hostname
by Anu Mercian 15 Jun '15

15 Jun '15

Hello, I am trying to bring up an lxc with Centos 6.6 using libvirt command: "virsh -c lxc:/// create vm.xml" When I do the above, the new VM created gets the hostname of the host where libvirt is installed. When I looked up help on the past mail-lists. It seems like this was a problem back in 2013 and it was mentioned that host name cannot be provided. I was wondering if this has been resolved and the host name can be provided in the URI. Link to the similar issue back in 2013: https://www.redhat.com/archives/libvirt-users/2013-November/msg00080.html Any help is much appreciated. Thank you, Anu

2 1

[libvirt-users] Recommended change for the networking page in wiki
by BJ 12 Jun '15

12 Jun '15

Hello all, I was told on IRC that I should come here to discuss a recommended change on the networking page in the wiki. If you take a look at the "Basic Script" shown here: http://wiki.libvirt.org/page/Networking#Forwarding_Incoming_Connections It does two things: 1) Create a DNAT rule in the NAT table of IPTABLES 2) Create a FORWARD rule in the FILTER table of IPTABLES The FORWARD rule is set up as it ought to be, however, the DNAT rule has some unintended consequences. I set up a DNAT on port 80, and suddenly, I couldn't access out on port 80 anymore from my guest machine. However, if I changed the destination address from "anywhere" to the IP of the host machine, the problem resolved. So I change the script to as follows. (Changes are highlighted. For some reason the original script didn't work using /bin/sh, but it did with /bin/bash, so I changed that too). *#!/bin/bash* # used some from advanced script to have multiple ports: use an equal number of guest and host ports Guest_name=xxxxxxx Guest_ipaddr=xxx.xxx.xxx.xx *Host_ipaddr=xxx.xxx.xxx.xx* Host_port=( '80' '443' ) Guest_port=( '80' '443' ) length=$(( ${#Host_port[@]} - 1 )) if [ "${1}" = "${Guest_name}" ]; then if [ "${2}" = "stopped" -o "${2}" = "reconnect" ]; then for i in `seq 0 $length`; do iptables -t nat -D PREROUTING *-d ${Host_ipaddr}* -p tcp --dport ${Host_port[$i]} -j DNAT --to ${Guest_ipaddr}:${Guest_port[$i]} iptables -D FORWARD -d ${Guest_ipaddr}/32 -p tcp -m state --state NEW -m tcp --dport ${Guest_port[$i]} -j ACCEPT done fi if [ "${2}" = "start" -o "${2}" = "reconnect" ]; then for i in `seq 0 $length`; do iptables -t nat -A PREROUTING *-d ${Host_ipaddr}* -p tcp --dport ${Host_port[$i]} -j DNAT --to ${Guest_ipaddr}:${Guest_port[$i]} iptables -I FORWARD 4 -d ${Guest_ipaddr}/32 -p tcp -m state --state NEW -m tcp --dport ${Guest_port[$i]} -j ACCEPT done fi fi Lastly, I should note that I am using Ubuntu 14.04, both for the host and guest. I'm also curious as to why this is considered a hack method. It states in the wiki that "This method is a hack", but it doesn't express why. Many VM Servers have similar features. I know Virtual Box does, I use the same feature there. It may not be how I would set up a production server, but doesn't make it a hack. Thanks, BJ

3 6

[libvirt-users] <vcpu placement='static' current='N'>M</vcpu>
by Thomas Stein 12 Jun '15

12 Jun '15

Hello. I seem to be to stupid to configure vcpu hotplugging on one of my machines. Whenever i set: <vcpu placement='static' current='4'>4</vcpu> and save this setting, this setting is undone by libvirt. It jumps back to: <vcpu placement='static'>4</vcpu> I'm confused now. Someone has an idea what's going on here? Any hints are really appreciated. cheers t.

2 2