- Users - libvirt List Archives

Unexplicable permission error when trying to read a qemu firmware file
by Emmanuel Kasper 04 Jan '21

04 Jan '21

Hi I want to create a CoreOS VM following the steps mentioned at https://docs.fedoraproject.org/en-US/fedora-coreos/getting-started, using a Debian 11 (bullseye) system. I am thus creating a VM with the following virt-install command: virt-install --connect="qemu:///system" --name=coreos \ --vcpus=2 --memory=2048 \ --os-variant=fedora29 --import --graphics=none \ --disk="size=10,backing_store=$PWD/fedora-coreos-33.20201201.3.0-qemu.x86_64.qcow2" \ --qemu-commandline="-fw_cfg name=opt/com.coreos/config,file=/tmp/example.ign" which spits some warnings and this mysterious error 2020-12-29T16:52:03.858938Z qemu-system-x86_64: warning: host doesn't support requested feature: MSR(48FH).vmx-exit-load-perf-global-ctrl [bit 12] 2020-12-29T16:52:03.858941Z qemu-system-x86_64: warning: host doesn't support requested feature: MSR(490H).vmx-entry-load-perf-global-ctrl [bit 13] 2020-12-29T16:52:03.864778Z qemu-system-x86_64: -fw_cfg name=opt/com.coreos/config,file=/tmp/example.ign: can't load /tmp/example.ign: Failed to open file “/tmp/example.ign”: Permission denied the file /tmp/example.ign is perfectly world readable, -rw-rw-rw- 1 manu manu 1130 Dec 29 17:23 /tmp/example.ign so I am puzzled at what could cause this permission error. on a RHEL8 system, I had the same error, and was able to fix by setting a security context on the firmware file: sudo semanage fcontext --add --type virt_content_t /tmp/example.ign restorecon /tmp/example.ign now this Debian system does not selinux installed at all. ls -dZ / ? / I could also read the qemu firmware file when using the qemu:///session connection any pointers where to look for ? Emmanuel

2 1

Isolated bridge does not bridge
by Paul van der Vlis 04 Jan '21

04 Jan '21

Hello, I want to do some testing and I have removed two VM's from the bridge what connects them to internet, and added them to another isolated bridge what's not connected to internet. Problem is that I cannot reach the other host in the isolated network. Something like this: virsh shutdown kvm66 virsh shutdown kvm68 brctl delif br0 vnet10 vnet6 # the interfaces of kvm66 and kvm68 brctl addbr br1 brctl addif br1 vnet10 vnet6 Then I've replaced br0 to br1 in the XML of both VM's with "virsh edit". Then I did start the VM's using the serial console (no network): virsh start --console kvm66 virsh start --console kvm68 I cannot ping from one machine to the other. Why?? With regards, Paul -- Paul van der Vlis Linux systeembeheer Groningen https://www.vandervlis.nl/

4 5

How to open listener of Libvirt ?
by tommy 04 Jan '21

04 Jan '21

Hi,every one: My Ubuntu is : 20.04 LTS, and I using libvirtd on it to manage KVM vm, but now I can not open listener function of the libvirtd. SYSTEM SOCKET ACTIVATION The libvirtd daemon is capable of starting in two modes. In the traditional mode, it will create and listen on UNIX sockets itself. If the --listen parameter is given, it will also listen on TCP/IP socket(s), according to the listen_tcp and listen_tls options in /etc/libvirt/libvirtd.conf In socket activation mode, it will rely on systemd to create and listen on the UNIX, and optionally TCP/IP, sockets and pass them as pre-opened file de� scriptors. In this mode, it is not permitted to pass the --listen parameter, and most of the socket related config options in /etc/libvirt/libvirtd.conf will no longer have any effect. To enable TCP or TLS sockets use either $ systemctl start libvirtd-tls.socket Or $ systemctl start libvirtd-tcp.socket But, on my system, there are no such service like libvirtd-tls.socket or libvirtd-tcp.socket. root@ubts1:~# systemctl | grep libvirt libvirt-guests.service loaded active exited Suspend/Resume Running libvirt Guests libvirtd.service loaded active running Virtualization daemon libvirtd-admin.socket loaded active running Libvirt admin socket libvirtd-ro.socket loaded active running Libvirt local read-only socket libvirtd.socket loaded active running Libvirt local socket How can I open the listener ? Thanks！

2 3

cannot get Libvirt/qemu to use secure boot
by Felix Rubio Dalmau 29 Dec '20

29 Dec '20

Hi everybody, I am having serious trouble enabling secure boot via virt-install... and I do not see clearly even where to look for help :-/. Maybe somebody can point me on the right direction? I am running: arch linux edk2-ovmf 202011-1 libvirt 6.5 virt-install 3.2 qemu 5.2 I am creating the domain with virt-install, and the parameters --features smm.state=on --boot loader=/usr/share/ovmf/x64/OVMF_CODE.secboot.fd,nvram.template=/usr/share/ovmf/x64/OVMF_VARS.fd,loader.readonly=yes,loader.type=pflash,loader_secure=yes If I boot into the UEFI I can see there is the menu for the OVMF and Secure Boot available, but when I get into the Secure Boot entry, I only see it is "disabled" and I cannot tick the "Attempt secure boot" box. As far as I understand, by using OVMF_CODE.secboot.f I should already get the default keys working, so I should be good to go to test this setup, but... to no success. Does anybody have any idea on what might be wrong/where can I get help (should this not be the place?) Thank you! Felix

1 1

Manage libvirt actions through netgroups and PolKit
by Gi Actor 26 Dec '20

26 Dec '20

1 0

libvirt-lxc: Permission issue of /proc/net
by John Hurnett 24 Dec '20

24 Dec '20

Hi, I've encountered a problem that some of /proc/net/ files can't be accessed in unprivileged containers, because it is owned by nobody:nogroup (-1:-1) and have 440 permissions. This exact issue was solved in LXC project by unsharing netns: https://github.com/lxc/lxc/commit/5b1e83cbc498cd3edeaf13afa987d530299a35a7 . Maybe it could be similarly fixed on libvirt-lxc? BR, John H.

2 2

AppArmor issue when using gluster storage pool
by Max Schettler 16 Dec '20

16 Dec '20

Hi, I'm trying to run a VM image that's stored on a gluster storage pool which I added to libvirt (5.0.0) on a Debian 10 installation. Whenever I try to boot a gluster-based VM, I get an error message about a missing AppArmor profile. In fact, the corresponding files (/etc/apparmor.d/libvirt/libvirt-{,.files}) are missing. After some tinkering I noticed that the profile for the VM are in fact missing iff there is a gluster-based disk attached to the VM in question. Whenever I remove the disk, the profile files reappear, and when I add it again, they are not present. I am wondering what might cause this, and how I could fix, or work around it, other than outright disabling AppArmor altogether. Thanks and best regards, Max Schettler -- Max Schettler, M.Sc. TKN, TU Berlin, Germany http://www.ccs-labs.org/team/schettler/

1 0

SASL(-1): generic failure: All-whitespace username - from HA/pacemaker
by lejeczek 15 Dec '20

15 Dec '20

Hi guys, I have a HA/pacemaker cluster with VirtualDomain and it all seems to work fine, VMs start & stop, except for live migration. So I thought I'd start here with errors I see, from 'pacemaker': ... All-whitespace username. notice: vpn1_migrate_to_0[977276] error output [ error: authentication failed: Failed to start SASL negotiation: -1 (SASL(-1): generic failure: All-whitespace username.) ] notice: vpn1_migrate_to_0[977276] error output [ ocf-exit-reason:vpn1: live migration to dzien failed: 1 ] notice: Result of migrate_to operation for vpn1 on swir: error notice: swir-vpn1_migrate_to_0:189 [ error: authentication failed: Failed to start SASL negotiation: -1 (SASL(-1): generic failure: All-whitespace username.)\nocf-exit-reason:vpn1: live migration to dzien failed: 1\n ] notice: Result of stop operation for vpn1 on swir: ok Can you shed more light on what virsh/libvirt says there? many thanks, L.

1 0

live migration with authentication - how?
by lejeczek 15 Dec '20

15 Dec '20

Hi guys. I'm trying I assumed something very crude, logic suggested I should try it first: $ virsh migrate reactos qemu+ssh://dzien/system?authfile=/etc/ovirt-hosted-engine/virsh_auth.conf Please enter your authentication name: vdsm@ovirt Please enter your password: As you can see I still get asked for credentials. Is it possible to live migrate that(or some) way, without being asked for those? many thanks, L.

2 2

Libvirt-lxc: iptables not working in containers
by John Hurnett 15 Dec '20

15 Dec '20

Hi, I can't get iptables to work in libvirt-lxc containers. "iptables -L" command shows empty chains. However I tested the same scenario with pure lxc and iptables works as it should. Has anyone experienced that? It seems like a bug, but maybe there is some libvirt xml parameter I am missing? BR

2 1

Installing Kali Linux as Guest OS in KVM Hypervisor
by Kaushal Shriyan 11 Dec '20

11 Dec '20

Hi, I have run the below command to install Kali Linux using linux-2020.4-installer-amd64.iso from https://www.kali.org/downloads/ #virt-install --name kalilinux --memory 4096 --vcpus=2 --location=/linuxkvmaddgbdisk/kali-linux-2020.4-installer-amd64.iso,kernel=install.amd/gtk/vmlinuz,initrd=install.amd/gtk/initrd.gz --network=bridge:br0 --os-type=linux --os-variant=debian9 --graphics=none --extra-args "console=ttyS0" -v --disk path=/linuxkvmaddgbdisk/kalilinux.img,size=50 I am not able to get the root login prompt when I run the below command to set IP and hostname for the guest OS. Am I missing any parameters from the above virt-install command to install Kali Linux as Guest OS in KVM Hypervisor? #virsh console kalilinux Connected to domain kalilinux Escape character is ^] Any help will be highly appreciated. I look forward to hearing from you. Thanks in Advance. Best Regards, Kaushal

4 6

[CFP] Virtualization & IaaS Devroom
by Piotr Kliczewski 11 Dec '20

11 Dec '20

We are excited to announce that the call for proposals is now open for the Virtualization & IaaS devroom at the upcoming FOSDEM 2021, to be hosted virtually on February 6th 2021. This year will mark FOSDEM’s 21th anniversary as one of the longest-running free and open source software developer events, attracting thousands of developers and users from all over the world. Due to Covid-19, FOSDEM will be held virtually this year on February 6th & 7th, 2021. About the Devroom The Virtualization & IaaS devroom will feature session topics such as open source hypervisors and virtual machine managers such as Xen Project, KVM, bhyve, and VirtualBox, and Infrastructure-as-a-Service projects such as KubeVirt, Apache CloudStack, Foreman, OpenStack, oVirt, QEMU and OpenNebula. This devroom will host presentations that focus on topics of shared interest, such as KVM; libvirt; shared storage; virtualized networking; cloud security; clustering and high availability; interfacing with multiple hypervisors; hyperconverged deployments; and scaling across hundreds or thousands of servers. Presentations in this devroom will be aimed at users or developers working on these platforms who are looking to collaborate and improve shared infrastructure or solve common problems. We seek topics that encourage dialog between projects and continued work post-FOSDEM. Important Dates Submission deadline: 20th of December Acceptance notifications: 25th of December Final schedule announcement: 31st of December Recorded presentations upload deadline: 15th of January Devroom: 6th February 2021 Submit Your Proposal All submissions must be made via the Pentabarf event planning site[1]. If you have not used Pentabarf before, you will need to create an account. If you submitted proposals for FOSDEM in previous years, you can use your existing account. After creating the account, select Create Event to start the submission process. Make sure to select Virtualization and IaaS devroom from the Track list. Please fill out all the required fields, and provide a meaningful abstract and description of your proposed session. Submission Guidelines We expect more proposals than we can possibly accept, so it is vitally important that you submit your proposal on or before the deadline. Late submissions are unlikely to be considered. All presentation slots are 30 minutes, with 20 minutes planned for presentations, and 10 minutes for Q&A. All presentations will need to be pre-recorded and put into our system at least a couple of weeks before the event. The presentations should be uploaded by 15th of January and made available under Creative Commons licenses. In the Submission notes field, please indicate that you agree that your presentation will be licensed under the CC-By-SA-4.0 or CC-By-4.0 license and that you agree to have your presentation recorded. For example: "If my presentation is accepted for FOSDEM, I hereby agree to license all recordings, slides, and other associated materials under the Creative Commons Attribution Share-Alike 4.0 International License. Sincerely, <NAME>." In the Submission notes field, please also confirm that if your talk is accepted, you will be able to attend the virtual FOSDEM event for the Q&A. We will not consider proposals from prospective speakers who are unsure whether they will be able to attend the FOSDEM virtual event. If you are experiencing problems with Pentabarf, the proposal submission interface, or have other questions, you can email our devroom mailing list[2] and we will try to help you. Code of Conduct Following the release of the updated code of conduct for FOSDEM, we'd like to remind all speakers and attendees that all of the presentations and discussions in our devroom are held under the guidelines set in the CoC and we expect attendees, speakers, and volunteers to follow the CoC at all times. If you submit a proposal and it is accepted, you will be required to confirm that you accept the FOSDEM CoC. If you have any questions about the CoC or wish to have one of the devroom organizers review your presentation slides or any other content for CoC compliance, please email us and we will do our best to assist you. Call for Volunteers We are also looking for volunteers to help run the devroom. We need assistance with helping speakers to record the presentation as well as helping with streaming and chat moderation for the devroom. Please contact devroom mailing list [2] for more information. Questions? If you have any questions about this devroom, please send your questions to our devroom mailing list. You can also subscribe to the list to receive updates about important dates, session announcements, and to connect with other attendees. See you all at FOSDEM! [1] <https://penta.fosdem.org/submission/FOSDEM17>https://penta.fosdem .org/submission/FOSDEM21 [2] iaas-virt-devroom at lists.fosdem.org

1 1

Cannot passthrough usb with bus number and device number
by YaoHua Wu 08 Dec '20

08 Dec '20

Sometimes, qemu cannot find correct usb device number Reproduce steps: 1、lsusb Bus 001 Device 011: ID 090c:1000 1、prepare usb device attach xml <hostdev managed="yes" mode="subsystem" type="usb"> <source> <vendor id="0x090c" /> <product id="0x1000" /> <address bus='001' device='011'/> </source><address bus="1" port="1" type="usb" /> </hostdev> 2、virsh attach-device vm usb.xml error: internal error: Did not find USB device 090c:1000 bus:1 device 9 Question: why the device number returned in qemu's error report is not what I wrote in xml， what I mean is that if my dev number is really wrong, the returned error should also be the number I wrote， commonly when using dongle Look forward to your reply yaohua.wu

2 3

unable to migrate when TLS is used
by Vjaceslavs Klimovs 07 Dec '20

07 Dec '20

With libvirt 6.9.0, qemu 5.1.0, and following configurations: libvirt: key_file = "/etc/ssl/libvirt/server.lan.key" cert_file = "/etc/ssl/libvirt/server.lan.crt" ca_file = "/etc/ssl/libvirt/ca.crt" log_filters="3:remote 4:event 3:util.json 3:rpc 1:*" log_outputs="1:file:/var/log/libvirt/libvirtd.log" qemu: default_tls_x509_cert_dir = "/etc/ssl/qemu" default_tls_x509_verify = 1 migration with tls: virsh # migrate vm1 qemu+tls://server2.lan/system --persistent --undefinesource --copy-storage-all --verbose --tls never succeeds. Progress stops typically at high progress amounts (95%-98%), and network traffic drastically drops as well (from 1 gbps+ to nothing). domjobinfo progress also stops. Without --tls migrations succeed without issues without any other changes to hosts or configurations. Logs of failed migration: Source: https://drive.google.com/file/d/1d0dJumicW0TUdG1osNxNnWWiYpfAaIb_/view?usp=… Destination: https://drive.google.com/file/d/1d0dJumicW0TUdG1osNxNnWWiYpfAaIb_/view?usp=… Same exact hosts, successful migration logs (without --tls): Source: https://drive.google.com/file/d/1d0dJumicW0TUdG1osNxNnWWiYpfAaIb_/view?usp=… Destination: https://drive.google.com/file/d/1EWkCkSBhj76T05k86QjdL-6icJyruK5-/view?usp=… Should I report this as a bug or is there an issue with my configuration?

2 3

Nfs mount 'gone' after vm's start
by Marc Roos 06 Dec '20

06 Dec '20

I have had a nfs-ganesha mount provision install images for vm's, and recently I have the mount stall after starting a vm. (even when it does not access an iso image on the nfs mount) I have the host ip on a macvtap of the connected interface. The vm is also having an macvtap on the same interface to allow host-guest communication. I am mounting the nfs with these options. nfs4 ro,vers=4,proto=tcp,soft,nodev,_netdev,noatime,timeo=30,x-systemd.device -timeout=30,x-systemd.mount-timeout=30,x-systemd.automount,x-systemd.idl e-timeout=30 0 0 The problem is fixed by doing a simple 'umount -l' Anyone seen something similar? I suspect this could be related by the macvtap being created, but I cannot remember seeing this mount fail before.

1 0

apparmor DENIED on domain shutdown
by Francesc Guasch 05 Dec '20

05 Dec '20

Hi. I upgraded one of my servers to Ubuntu 20.04. Since then domains won't shutdown. They are in the "in shutdown" state. I googled around and I found it is probably because of apparmor. I see this message in the logs: kernel: [740222.848210] audit: type=1400 audit(1606983397.013:338): apparmor="DENIED" operation="signal" profile="libvirt-a2c1456f-3371-49eb-9fa4-f8576ca4e878" pid=2375 comm="libvirtd" requested_mask="receive" denied_mask="receive" signal=term peer="libvirtd" I tried to run this but it does nothing: aa-complain /usr/sbin/libvirtd The only solution I found was to run aa-disable to the machine id so it can be shut down. I found some similar issues but I can't figure out what I have to tweak in the apparmor files. If you can point me to some doc may be I skipped I will or any solution I would appreciate it. This is - Ubuntu 20.04 - libvirt 6.0.0-0 - qemu-kvm 1:4.2-3 Thank you very much.

2 3

qemu guest agent(QGA) in guest OS
by Henry lol 02 Dec '20

02 Dec '20

Hello, AFAIK, QGA is automatically installed and run in guest OS after installing OS from iso file whereas it's not installed in case of installing OS on the host even with same iso and configuration. So, I am wondering how it works differently depending on the guest or host. Does the OS installer selectively install packages? thanks.

1 0

How to exit console in L2 vm?
by Yalan Zhang 01 Dec '20

01 Dec '20

Hi, I have a question about nested virtualization. The scenario is as below: 1. Prepare the nested environment, start L2 guest. 2. On the host, connect the L1 vm console, then on L1 guest, connect the L2 guest console: (host)# virsh console L1_vm Connected to domain L1_vm Escape character is ^] (Ctrl + ]) ... (L1 vm)# virsh console L2_vm Connected to domain L2_vm Escape character is ^] (Ctrl + ]) ... (L2 vm)# <=== press " ^] " to exit the console, it return to the **host** (host)# Is it expected that "^]" in L2 guest will exit thoroughly to the host, not the L1 guest? Thank you! ------- Best Regards, Yalan Zhang IRC: yalzhang

4 4

qemu no-shutdown behavior in libvirt
by Luna Xu Yamada 30 Nov '20

30 Nov '20

2 2

Debugging virtiofs
by Popog 26 Nov '20

26 Nov '20

I can't seem to start a VM with virtiofs. Everything is running as root (unraid) with a pretty simple setup: <filesystem type='mount' accessmode='passthrough'> <driver type='virtiofs'/> <binary path='/usr/libexec/virtiofsd' /> <source dir='/mnt/user/shared'/> <target dir='shared_mount'/> </filesystem> Even with debug logging at max, all I get in the main log is: qemu-system-x86_64: -device vhost-user-fs-pci,chardev=chr-vu-fs0,tag=shared_mount,bus=pci.5,addr=0x0: Failed to write msg. Wrote -1 instead of 12. qemu-system-x86_64: -device vhost-user-fs-pci,chardev=chr-vu-fs0,tag=shared_mount,bus=pci.5,addr=0x0: vhost_dev_init failed: Operation not permitted shutting down, reason=failed And in the fsd log: [ID: 00029648] virtio_session_mount: Waiting for vhost-user socket connection... [ID: 00029648] virtio_session_mount: Received vhost-user socket connection [ID: 00000001] pivot_root(., .): Invalid argument Nothing else in any other logs (e.g. dmesg). What do these errors mean? How do I troubleshoot this?

1 0

image works in native but not in vm when cpu mode='host-passthrough' is set
by daggs 24 Nov '20

24 Nov '20

Greetings. I have an image I've created with a bunch of chost flags which works on my machine when it comes to native boot. if I take that same image into a vm managed via libvirt, I get kernel panic. I'd assume that something is missing from my vm config, question is what and what I can do about it? here is the flags part of lscpu in native and vm: https://dpaste.com/3TR8QJ5G8 and the vm's xml: https://dpaste.com/984JX4LUQ if I build the image with the default flags (march=x86-64), the vm boots well. my new chost is -O2 -pipe -march=skylake -mabm -mno-adx -mno-avx -mno-avx2 -mno-bmi -mno-bmi2 -mno-f16c -mno-fma -mno-xsave -mno-xsavec -mno-xsaveopt -mno-xsaves -mno-sgx the cpu is Intel(R) Pentium(R) CPU G4560 @ 3.50GHz thoughts? Thanks, Dagg.

3 5

Openshift Kubevirt lab?
by Luis Gonzalez 18 Nov '20

18 Nov '20

Is there an RHPDS lab for Kubevirt? -- Luis Gonzalez Consultant, Container Infrastructure Red Hat <https://www.redhat.com/> lgonzal(a)redhat.com M: 404.784.7166 IM: luisgonzalez GPG: 2800156E8386EA133D4F10AC3381C1457F69FF84 <https://www.redhat.com/>

2 1

DNS forwarding for guest domains on isolated network
by Jörg Kastning 11 Nov '20

11 Nov '20

Hi @all, I'm having trouble to realize my use case and hope somebody could help me. # Use case For a home lab I want to deploy several guest domains. These domains must not have a direct or NAT connection to the internet or my LAN. They should only be able to reach my LAN and the internet through a proxy. # What I've done I've created the following virtual switch in isolated mode: $ sudo virsh net-dumpxml private1 <network connections='3'> <name>private1</name> <uuid>THE-UUID</uuid> <bridge name='virbr1' stp='on' delay='0'/> <mac address='DE:AD:BE:EF:FF:FF'/> <domain name='private1'/> <ip address='192.168.100.1' netmask='255.255.255.0'> <dhcp> <range start='192.168.100.128' end='192.168.100.254'/> </dhcp> </ip> </network> I've setup a guest domain that serves as a proxy and several other guests. # My issue Nameresolution for *.private1 works fine on this network. But I'm not able to resolve domains from the outside world like github.com. I understood that libvirt is forwarding dns resolution requests to the hosts nameserver configured in /etc/resolv.conf in case the dnsmasq instance for the virtual network is not able to resolve the name. My guess, in my setup this don't work, because the virtual switch is in isolated mode, right? # My questions * What can I do to achieve my use case described above? * Is it possible to use the isolated mode here or do I have to use a different mode? It's important that the guest domains could only connect to the internet by using the proxy. Regards, Joerg

2 2

Upgrade CentOS 7 to 8, error: network is already in use by interface
by Filip Hruska 07 Nov '20

07 Nov '20

Hi, I've been trying to migrate some of my CentOS 7 KVM hypervisors to CentOS 8, and I have encountered the following issue while trying to load my network config: virsh: error: Failed to start network test1 error: internal error: Network is already in use by interface virbr2 journalctl: error : networkCheckRouteCollision:123 : internal error: Network is already in use by interface virbr2 I use the following network definitions, which are a bit non-standard, however they work perfectly on CentOS 7: <network> <name>test1</name> <forward mode='open'/> <bridge name='virbr1' stp='off' delay='0'/> <mac address='52:54:00:c1:a7:7c'/> <dns enable='no'/> <ip address='10.0.0.1' netmask='255.255.255.255'></ip> <route address='192.168.1.22' prefix='32' gateway='10.0.0.1'/> </network> <network> <name>test2</name> <forward mode='open'/> <bridge name='virbr2' stp='off' delay='0'/> <mac address='52:54:00:54:09:3c'/> <dns enable='no'/> <ip address='10.0.0.1' netmask='255.255.255.255'></ip> <route address='192.168.1.33' prefix='32' gateway='10.0.0.1'/> </network> My question is, why is the behaviour different across CentOS releases, despite the libvirt versions apparently matching? Output from both systems is the same: # virsh version Compiled against library: libvirt 4.5.0 Using library: libvirt 4.5.0 Using API: QEMU 4.5.0 Running hypervisor: QEMU 2.12.0 What would be the best approach on patching out this check, so I can continue using my network config? Just to summarize the expected output: - virbr1 and virbr2 get created, each one with an address 10.0.0.1/32. - Two routes get created: 192.168.1.22 via 10.0.0.1 dev virbr1 192.168.1.33 via 10.0.0.1 dev virbr2 Thanks, Filip Hruska

1 0

consume existing tap device when libvirt / qemu run as different users
by Miguel Duarte de Mora Barroso 07 Nov '20

07 Nov '20

Hello, I'm having some doubts about consuming an existing - already configured - tap device from libvirt (with `managed='no' ` attribute set). In KubeVirt, we want to have the consumer side of the tap device run without the NET_ADMIN capability, which requires the UID / GID of the tap creator / opener to match, as per the kernel code in [0]. As such, we create the tap device (with the qemu user / group on behalf of qemu), which will ultimately be the tap consumer. This leads me to question: why is libvirt opening / calling `ioctl(..., TUNSETIFF, ...) ` on the tap device when it already exists - [1] & [2] ? Why can't the tap device (already configured) be left alone, and let qemu consume it ? The above is problematic for KubeVirt, since our setup currently has libvirt running as root (while qemu runs as a different user), which is preventing us from removing NET_ADMIN (libvirt & qemu run as different users). Thanks in advance for your time, Miguel [0] - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/dri… [1] - https://github.com/libvirt/libvirt/blob/99a1cfc43889c6d425a64013a12b234dde8… [2] - https://github.com/libvirt/libvirt/blob/v6.0.0/src/util/virnetdevtap.c#L274

2 1