- Users - libvirt List Archives

[libvirt-users] LIbvirt seclabel.
by cooldharma06 06 Aug '13

06 Aug '13

hi all, i am new to the libvirt. Via libvirt i am converting my xen.com.sfg. In xen i added xsm label as, seclabel:system_u:domU_t. but after creating vm using xen or by convertdom-to-xml also does not contain any label or text with xen-4.2.1. in the documentation also you mentioned selinux label (sVirt) only. Can u clear me the following things: 1. How to use XSM label in libvirt.? 2. What are the procedures(syntax and tags) to use for xsm label in xml file.? Regards, cooldharma06

2 1

[libvirt-users] Getting nwfilter to work on Debian Wheezy
by Sven Schwedas 06 Aug '13

06 Aug '13

Hi, I'm trying to configure nwfilter for KVM, but so far I haven't managed to figure out a working configuration. Network setup: The dom0 (Debian 7.1, kernel 3.2.46-1, libvirt 0.9.12) is connected via eth0, part of the external subnet 192.168.17.0/24, and has an additional subnet 192.168.128.160/28 routed to its main address 192.168.17.125. The host's subnet is configured as bridge in virsh: > <network> > <name>foo</name> > <forward dev='eth0' mode='route'> > <interface dev='eth0'/> > </forward> > <bridge name='foo-br0' stp='off' delay='0' /> > <ip address='192.168.128.161' netmask='255.255.255.240'> > </ip> > </network> The domU is configured to use this bridge (static IP configured in DomU): > <interface type='network'> > <source network='foo'/> > <target dev='vnet0'/> > <model type='virtio'/> > <filterref filter='test-eth0'> > <parameter name='CTRL_IP_LEARNING' value='none'/> > <parameter name='IP' value='192.168.128.162'/> > </filterref> > <alias name='net0'/> > <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> > </interface> With an empty filter, connectivity is working fine. Now, if I add the example ruleset suggested in the documentation ( http://libvirt.org/formatnwfilter.html#nwfwriteexample ), *incoming* ICMP works (but not outgoing), and inbound SSH traffic is blocked, together with outbound DNS. The linked rules produce the following iptables chains: > Chain INPUT (policy ACCEPT) > target prot opt source destination > libvirt-host-in all -- 0.0.0.0/0 0.0.0.0/0 > ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53 > ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 > ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:67 > ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:67 > > Chain FORWARD (policy ACCEPT) > target prot opt source destination > libvirt-in all -- 0.0.0.0/0 0.0.0.0/0 > libvirt-out all -- 0.0.0.0/0 0.0.0.0/0 > libvirt-in-post all -- 0.0.0.0/0 0.0.0.0/0 > ACCEPT all -- 0.0.0.0/0 192.168.128.160/28 > ACCEPT all -- 192.168.128.160/28 0.0.0.0/0 > ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 > REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable > REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable > > Chain OUTPUT (policy ACCEPT) > target prot opt source destination > > Chain FI-vnet0 (1 references) > target prot opt source destination > RETURN tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:22 state ESTABLISHED ctdir ORIGINAL > RETURN tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:80 state ESTABLISHED ctdir ORIGINAL > RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED ctdir REPLY > RETURN udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53 state NEW,ESTABLISHED ctdir REPLY > DROP all -- 0.0.0.0/0 0.0.0.0/0 > > Chain FO-vnet0 (1 references) > target prot opt source destination > ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 state NEW,ESTABLISHED ctdir REPLY > ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 state NEW,ESTABLISHED ctdir REPLY > ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED ctdir ORIGINAL > ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:53 state ESTABLISHED ctdir ORIGINAL > DROP all -- 0.0.0.0/0 0.0.0.0/0 > > Chain HI-vnet0 (1 references) > target prot opt source destination > RETURN tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:22 state ESTABLISHED ctdir ORIGINAL > RETURN tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:80 state ESTABLISHED ctdir ORIGINAL > RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED ctdir REPLY > RETURN udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53 state NEW,ESTABLISHED ctdir REPLY > DROP all -- 0.0.0.0/0 0.0.0.0/0 > > Chain libvirt-host-in (1 references) > target prot opt source destination > HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 > > Chain libvirt-in (1 references) > target prot opt source destination > FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 > > Chain libvirt-in-post (1 references) > target prot opt source destination > ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 > > Chain libvirt-out (1 references) > target prot opt source destination > FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 I've tried fidgeting with the configuration (direction inout instead of in/out, etc.), but I didn't find a setup that works as intended. What am I missing? -- Mit freundlichen Grüßen, / Best Regards, Sven SCHWEDAS Systemadministrator TAO Beratungs- und Management GmbH | Lendplatz 45 | A - 8020 Graz Mail/XMPP: sven.schwedas(a)tao.at | +43 (0)680 301 7167 http://software.tao.at

5 8

[libvirt-users] Libvirt not getting connected to ESX server
by varun bhatnagar 04 Aug '13

04 Aug '13

Hi, I was trying to connect to ESX server using libvirt's virsh console but I am getting the following error: *virsh# connect esx://172.16.73.14* *Enter username for 172.16.73.14 [root]: root* *Enter root's password for 172.16.73.14:* *error: Failed to connect to the hypervisor* *error: internal error curl_easy_perform() returned an error: Peer certificate cannot be authenticated with known CA certificates (60) : SSL certificate problem, verify that the CA cert is OK. Details:* *error: 14090086:SSL routine:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed.* * * Can anyone please help me out with this one and tell me how to resolve this error? Regards, Varun

2 3

[libvirt-users] Please remove pm-utils dep from libvirt-clients
by Richard Hughes 04 Aug '13

04 Aug '13

Hi, I'm going to be retiring pm-utils from Fedora soon; it's completely dead upstream and it not needed anymore by upower or anything else. Nothing other than libvirt-clients depends on it, so when I tried to remove this from rawhide I noticed this commit: commit 7069f75cb8dad58715f723fd542e4ff69dbff51b Author: Daniel Veillard <veillard(a)redhat.com> Date: Thu Dec 8 17:03:16 2011 +0800 update to libvirt-0.9.8 added: +# Needed for probing the power management features of the host. +Requires: pm-utils Is this true? You really don't want to be parsing pm-is-supported, it often doesn't work and isn't used by anything else any more. Would it be possible to port away from pm-is-supported if you're actually using it, and drop the dep for F20 please? Any questions please CC me as I'm not subscribed. Thanks, Richard

1 0

[libvirt-users] Installing libvirt
by Peeyush Gupta 03 Aug '13

03 Aug '13

Hi, I am trying to install new libvirt version on Ubuntu 12.04 LTS. Now I downloaded libvirt 1.0.5 from libvirt.org/sources then I issued three commands: ./autogen.sh make make install This installs the libvirt on my system. But there are some issues, I have to run libvirtd explicitly everytime I reboot my system. And whenever I try to run virt-manager from terminal, it says "No D-Bus daemon running". But when I do "sudo virt-manager", it runs fine. Any idea what am I doing wrong? Thanks. ~Peeyush Gupta

4 6

[libvirt-users] start lxc container on fedora 19
by Aarti Sawant 02 Aug '13

02 Aug '13

hello, i am new to lxc, i have created a lxc container on fedora 19 i created a container rootfs of fedora 19 by using yum --installroot=/containers/test1 --releasever=19 install openssh test1.xml file for container test1 <domain type="lxc"> <name>test1</name> <vcpu placement="static">1</vcpu> <cputune> <shares>1024</shares> <period>1000000</period> </cputune> <memtune> <hard_limit unit="M">1024</hard_limit> <soft_limit unit="M">128</soft_limit> <min_guarantee unit="M">64</min_guarantee> </memtune> <blkiotune> <weight>800</weight> </blkiotune> <memory unit="KiB">102400</memory> <os> <type>exe</type> <init>/bin/bash</init> </os> <clock offset="utc"/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/libexec/libvirt_lxc</emulator> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/"/> <target dir="/"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/var"/> <target dir="/var"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/dev"/> <target dir="/dev"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/root"/> <target dir="/root"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/home"/> <target dir="/home"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/opt"/> <target dir="/opt"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/media"/> <target dir="/media"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/bin"/> <target dir="/bin"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/lib64"/> <target dir="/lib64"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/etc"/> <target dir="/etc"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/lib"/> <target dir="/lib"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/run"/> <target dir="/run"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/srv"/> <target dir="/srv"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/sys"/> <target dir="/sys"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/tmp"/> <target dir="/tmp"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/boot"/> <target dir="/boot"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/usr"/> <target dir="/usr"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/mnt"/> <target dir="/mnt"/> </filesystem> <filesystem accessmode="passthrough" type="mount"> <source dir="/containers/test1/sbin"/> <target dir="/sbin"/> </filesystem> <interface type="bridge"> <source bridge="br0"/> </interface> <console port="0" type="pty"/> </devices> </domain> the host network files: /etc/sysconfig/network-script/ifcfg-br0 DEVICE="br0" TYPE="Bridge" USERCTL="no" BOOTPROTO="dhcp" ONBOOT="yes" NM_CONTROLLED="no" /etc/sysconfig/network-script/ifcfg-p2p1 DEVICE="p2p1" BOOTPROTO="dhcp" BRIDGE="br0" NM_CONTROLLED="no" ONBOOT="yes" TYPE="Ethernet" the fstab of host # # /etc/fstab # Created by anaconda on Fri Jul 26 05:26:08 2013 # # Accessible filesystems, by reference, are maintained under '/dev/disk' # See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info # UUID=b49ce5dc-afb7-4c8e-9487-c1ed101d9166 / ext4 defaults 1 1 UUID=3dfa07fd-a06b-4a1a-a3fd-4e2f5e0d0e6a /boot ext4 defaults 1 2 UUID=3d1cb255-721a-48d2-b2e9-86f52b5fbec6 swap swap defaults 0 0 none /sys/fs/cgroup cgroup defaults 0 0 when i try to start the container using virsh i get error virsh --connect lxc:// virsh # define /containers/test1/test1.xml Domain test1 defined from /containers/test1/test1.xml virsh # start test1 error: Failed to start domain test1 error: internal error guest failed to start: PATH=/bin:/sbin TERM=linux container=lxc-libvirt container_uuid=05a7239d-f610-4ae9-ad47-4bf47f2f9b54 LIBVIRT_LXC_UUID=05a7239d-f610-4ae9-ad47-4bf47f2f9b54 LIBVIRT_LXC_NAME=test1 /bin/lxc_defaultinit.sh Unable to send container continue message: Broken pipe has anyone face the same problem with fedora 19. can anyone guide me.. Thanks, Aarti Sawant

2 2

[libvirt-users] Segfault with ruby-libvirt 0.4.0 and libvirt 1.1.1
by Bertrand Paquet 02 Aug '13

02 Aug '13

Hi, I have upgraded my libvirt version, and I have a crash using ruby-libvirt (0.4.0). The same code ruby worked well before upgrade. ruby(92500,0x107092000) malloc: *** error for object 0x7fdc03ea7658: pointer being freed was not allocated *** set a breakpoint in malloc_error_break to debug Abort trap: 6 I'm under Mac Os, but my colleague is under Linux and have the same problem. Any idea ? Any information to how diagnosis the problem ? Regards, Bertrand

2 1

[libvirt-users] Quick questions on virtio-serial transport
by Hari Pyla 01 Aug '13

01 Aug '13

Hi, I am using the virtio-serial transport for communication between the host and the guest. I've created the channel using virt-install: virt-install --name=centos --import --disk /var/lib/libvirt/images/centos.img,size=15 \ --ram 2048 \ --vcpus=2 \ --arch=x86_64 --os-type linux --network=bridge:br1 --graphics vnc \ --noautoconsole \ --channel pty,target_type=virtio,name=guest1 This correctly creates a file "/dev/virtio-ports/guest1" in the guest for the guest to communicate with the host. So the guest side of things are good. Now on the host side, I see a two files being created in /dev/pts directory. $ ls -alt /dev/pts crw--w---- 1 qemu tty 136, 1 Jul 31 15:49 1 crw--w---- 1 qemu tty 136, 2 Jul 31 15:49 2 So here are my questions: i) I was wondering if there is anyway of knowing which of these files correspond to the other end of the channel without having to manually echoing data to each of these files and see which of the data shows up on the guest side. ii) I was also wondering if there is anyway of identifying the host side endpoint i.e., /dev/pts/FILE of the channel programatically iii) Better yet can the /dev/pts/FILE be explicitly passed as an argument while creating a channel in the guest so the host knows that it is supposed to use the /dev/pts/FILE if it wants to talk to the guest. I read a prior post on this mailing list: https://www.redhat.com/archives/libvir-list/2012-May/msg00964.html It mentions that from the host side one could dump the xml of the guest and identify the "source path" of the channel, something in the lines of <channel type='pty'> <source path='/dev/pts/12'/> <target type='virtio' name='arbitrary.virtio.serial.port.name'/> <alias name='channel0'/> <address type='virtio-serial' controller='0' bus='0' port='2'/> </channel> but I do not find the source path in the XML description of the guest I've created. This is what I see in the XML file. <channel type='pty'> <target type='virtio' name='guest1'/> <address type='virtio-serial' controller='0' bus='0' port='1'/> </channel> I was wondering if I am missing something. Any help is greatly appreciated. Thanks, --Hari

1 0

[libvirt-users] filesystem accessmode='passthrough'
by Yury Goltsov 31 Jul '13

31 Jul '13

Hello. I am trying to 'passthrough' the part of host filesystem to kvm guest. libvirt xml: <filesystem type='mount' accessmode='passthrough'> <source dir='/var/guests/mail-var'/> <target dir='mail-var'/> </filesystem> kvm is started from root. After mounting in guest mount -t 9p mail-var /mnt -o trans=virtio,version=9p2000.L or mount -t 9p www-var /mnt -o trans=virtio if I try to make file or directory in guest, I have problem with permissions: ruser@www:~# ls -ld /mnt/ruser/ drwxr-xr-x 2 ruser www-data 4096 May 28 13:13 /mnt/ruser/ ruser@www:~# ls -ld /mnt/tmp/ drwxrwxrwx 2 root root 4096 Jul 26 09:01 /mnt/tmp/ root@www:~# touch /mnt/tmp/file1 OK: root@www:~# touch /mnt/ruser/file2 touch: cannot touch `/mnt/ruser/file2': Permission denied root@www:~# su ruser ruser@www:~$ touch /mnt/ruser/file3 touch: cannot touch `/mnt/ruser/file3': Permission denied ruser@www:~$ touch /mnt/tmp/file4 touch: setting times of `/mnt/tmp/file4': No such file or directory I have read in documentation, that in "passthrough" security model, files are stored using the same credentials as they are created on the guest (like NFS3). Suggest me, please, what is it: I do something wrong, or I must update qemu-kvm or/and libvirt to recent version, or I need to find other solution for sharing host filesystem? Thanks. Yury in host: root@host:~# libvirtd --version libvirtd (libvirt) 0.9.12 root@host:~# kvm --version QEMU emulator version 1.1.2 (qemu-kvm-1.1.2+dfsg-6, Debian), Copyright (c) 2003-2008 Fabrice Bellard root@host:~# uname -a Linux host 3.2.0-4-amd64 #1 SMP Debian 3.2.46-1 x86_64 GNU/Linux root@host:~$ cat /etc/os-release PRETTY_NAME="Debian GNU/Linux 7 (wheezy)"

2 5

[libvirt-users] Fail to destroy lxc container: internal error Some container PIDs refused to die
by hzguanqiang 31 Jul '13

31 Jul '13

Hey guys, When I destroy a lxc container, It reported an error with details as following: root@debian:~$ vir destroy 901eef81-06b2-4252-aeef-53b87c402585 error: Failed to destroy domain 901eef81-06b2-4252-aeef-53b87c402585 error: internal error Some container PIDs refused to die root@debian:~$ vir version Compiled against library: libvirt 1.1.0 Using library: libvirt 1.1.0 Using API: LXC 1.1.0 Running hypervisor: LXC 3.2.46 What's the problem? How could I destroy the lxc just like this? Thanks. -------------- Best regards! GuanQiang 2013-07-31

2 1