- Users - libvirt List Archives

[libvirt-users] Limitations of macvtap devices?
by Lars Kellogg-Stedman 04 May '15

04 May '15

I am running OpenStack inside a libvirt guest that is connected to the local network via a macvtap interface. My experience so far suggests that a macvtap interface will not pass traffic with a source MAC address other than the MAC address of the interface itself...for example, if inside the guest eth0 is attached to a bridge. Is that correct, or is there some setting that will make that work? Outbound traffic doesn't seem to be a problem (I can see, for example, dhcp requests on the local network), but replies get dropped before they reach the guest. Thanks, -- Lars Kellogg-Stedman <lars(a)redhat.com> | larsks @ {freenode,twitter,github} Cloud Engineering / OpenStack | http://blog.oddbit.com/

4 4

[libvirt-users] Improved Shared Folders UX and security
by drift＠ruggedinbox.com 03 May '15

03 May '15

Would it degrade security if libvirt were to handle SELinux labeling of shared folders automatically instead of the manual adjustments needed currently? Would it degrade security if libvirt were allowed to create a non existing shared directory specified in a VM's xml upon import?

1 0

[libvirt-users] SELinux for separate shared folders
by drift＠ruggedinbox.com 03 May '15

03 May '15

How can I enforce SELinux separation between the shared folders belonging to different VMs running with sVirt's SELinux dynamic labels? I want to create a permanent exception for VM 'A' to only be able to read and write to shared folder 'A' and the same for VM 'B' and shared folder 'B' svirt_image_t permits access to a shared folder but for all VMs.

1 0

[libvirt-users] libvirt nwfilter
by drift＠ruggedinbox.com 02 May '15

02 May '15

To take advantage of the filters, is it as simple as adding these couple of lines in a guest's xml file like the example from https://libvirt.org/formatnwfilter.html#nwfconcepts ? <devices> <interface type='bridge'> <mac address='00:16:3e:5d:c7:9e'/> <filterref filter='clean-traffic'> <parameter name='IP' value='10.0.0.1'/> </filterref> </interface> </devices> Can multiple filters be combined together like this? <filterref filter='clean-traffic' filter='no-ip-multicast'> <parameter name='IP' value='10.0.0.1'/> </filterref> Can the IP address parameter override the one in /etc/network/interfaces on the guest? When cloning a vm does it change the ip to avoid conflicts like it would with mac-addresses?

2 1

[libvirt-users] Sometimes libvirt fails to update domain block file after blockcommit.
by Matthew Schumacher 30 Apr '15

30 Apr '15

Posted to https://bugzilla.redhat.com/show_bug.cgi?id=1217185 I just stumbled on another bug while snapshotting and think it's related to 1210903 and 1197592 as it seems like some sort of race condition because it depends on what logging is in place and doesn't happen every time. Here are the details: I wrote this test script to snapshot and commit over and over: #!/bin/sh while [ 1 ]; do echo "Starting snapshot test `date`" virsh snapshot-create-as test 20150429 20150429-backup --disk-only --atomic virsh domblklist test virsh blockcommit test vda --active --pivot --verbose virsh snapshot-delete test 20150429 --metadata virsh domblklist test rm /glustervol1/vm/test/test.20150429 echo "Ending snapshot test `date`" echo echo sleep 2 done If I run libvirtd in the foreground with debug set to 1 I can't get it to fail, it does what it's supposed to do, snapshot and commit over and over. If I run libvirtd in the foreground with debug set to 3, then I will always eventually get this: Starting snapshot test Wed Apr 29 09:34:34 AKDT 2015 Domain snapshot 20150429 created Target Source ------------------------------------------------ vda /glustervol1/vm/test/test.20150429 hdc /dev/sr0 Block Commit: [100 %] Successfully pivoted Domain snapshot 20150429 deleted Target Source ------------------------------------------------ vda /glustervol1/vm/test/test.20150429 hdc /dev/sr0 Ending snapshot test Wed Apr 29 09:34:35 AKDT 2015 Starting snapshot test Wed Apr 29 09:34:37 AKDT 2015 error: unsupported configuration: source for disk 'vda' is not a regular file; refusing to generate external snapshot name Target Source ------------------------------------------------ vda /glustervol1/vm/test/test.20150429 hdc /dev/sr0 error: internal error: qemu block name '/glustervol1/vm/test/test.qcow2' doesn't match expected '/glustervol1/vm/test/test.20150429' error: Domain snapshot not found: no domain snapshot with matching name '20150429' Target Source ------------------------------------------------ vda /glustervol1/vm/test/test.20150429 hdc /dev/sr0 rm: can't remove '/glustervol1/vm/test/test.20150429': No such file or directory Ending snapshot test Wed Apr 29 09:34:37 AKDT 2015 At this point libvirt is confused about which file is the backing store because the first run did pivot after blockcommit, but didn't update the block file. From the logs: 2015-04-29 17:33:41.052+0000: 25192: warning : qemuDomainObjTaint:1972 : Domain id=2 name='test' uuid=4b9cc25b-68d1-4ce8-8a65-2a378e255e36 is tainted: high-privileges 2015-04-29 17:34:37.322+0000: 25191: error : virDomainSnapshotAlignDisks:609 : unsupported configuration: source for disk 'vda' is not a regular file; refusing to generate external snapshot name 2015-04-29 17:34:37.352+0000: 25194: error : qemuMonitorJSONDiskNameLookup:3977 : internal error: unable to find backing name for device drive-virtio-disk0 2015-04-29 17:34:37.354+0000: 25194: error : qemuMonitorJSONDiskNameLookupOne:3914 : internal error: qemu block name '/glustervol1/vm/test/test.qcow2' doesn't match expected '/glustervol1/vm/test/test.20150429' So libvirt insists that the block file is: root@wasvirt2:/glustervol1/vm/waspbx# virsh domblklist test Target Source ------------------------------------------------ vda /glustervol1/vm/test/test.20150429 hdc /dev/sr0 But that file isn't in use and isn't what qemu is using: root@wasvirt2:/glustervol1/vm/waspbx# lsof | grep test 25300 /usr/bin/qemu-system-x86_64 /var/log/libvirt/qemu/test.log 25300 /usr/bin/qemu-system-x86_64 /var/log/libvirt/qemu/test.log 25300 /usr/bin/qemu-system-x86_64 /glustervol1/vm/test/test.qcow2 The only way to straighten this out is to destroy and start the domain.

1 0

[libvirt-users] non failover equivalent to "virsh migrate --copy-storage-all"
by Andreas Buschmann 30 Apr '15

30 Apr '15

Hello, I have two servers where I can push VMs from one to the other by issuing the command virsh migrate --live --persistent --copy-storage-all --verbose \ test6 qemu+ssh://kvmhost2/system on kvmhost1. I can get the VM back by issuing the equivalent command on kvmhost2: virsh migrate --live --persistent --copy-storage-all --verbose \ test6 qemu+ssh://kvmhost1/system virsh copies the local data file /data/vm/test6.qcow2 with the filesystem over to the other server. Is there a way to just copy the data file over to the second server, without moving the VM? I want the equivalent of doing these two migrations is sequence, but without moving the VM. The goal is to get a backup copy of a running system onto a second system (kvmhost2). The copy (snapshot) from kvmhost2 can then be copied to a backup server, and can be used for a fast recovery point if kvmhost1 dies. Mit freundlichen Gruessen Andreas Buschmann -- Andreas Buschmann [Senior Systems Engineer] net.DE AG

3 3

[libvirt-users] Semantics of "virsh migrate --copy-storage-all" vs. --copy-storage-inc
by Andreas Buschmann 30 Apr '15

30 Apr '15

Hello, what is really the difference between virsh migrate --copy-storage-all and virsh migrate --copy-storage-inc ? There are some documents talking about NBD snapshots, but the user visible semantics are incomplete. Where does the incremental stuff happen? Does it require qcow2 files? Does it work with raw files? Does "--copy-storage-inc" require existing snapshots? Does "--copy-storage-inc" require existing snapshots which are in an external file so that there is a visible chain [base] <- [sn1] <- [sn2] Background: I am trying to understand what really happens, so I can use the tools for a reasonable fast failover between two servers with local storage. more Background: I have VMs and bare metal servers which do use expensive shared storages like NetApp, EMC² VNX, HP and others, but the shared storage boxes all require customer visible maintenance downtimes every 12 to 20 month. And these downtimes take a long lead time and are between 01:00 and 05:00. Mit freundlichen Gruessen Andreas Buschmann -- Andreas Buschmann [Senior Systems Engineer] net.DE AG

2 1

[libvirt-users] Virtual Smartcard GPG
by roky＠openmailbox.org 29 Apr '15

29 Apr '15

Hi. Is is possible to use GPG on the host instead of NSS with virtual smartcards? Please document how or add support for it. Can a virtual smartcard make the host less secure? If there are bugs in GPG/NSS backend on the host can they be abused by untrusted code in the vm?

2 1

[libvirt-users] Disable weak ciphers in vnc_tls
by Matthias Fenner 29 Apr '15

29 Apr '15

Dear libvirt team, we a currently in a pci-dss certification process and our security scanner found weak ciphers in the vlc_tls service on our centos6 box: When I scan using sslscan I can see that sslv3 and rc4 is accepted: inf0rmix@tardis:~$ sslscan myhost:16514 | grep Accepted Accepted SSLv3 256 bits DHE-RSA-AES256-SHA Accepted SSLv3 256 bits AES256-SHA Accepted SSLv3 128 bits DHE-RSA-AES128-SHA Accepted SSLv3 128 bits AES128-SHA Accepted SSLv3 128 bits RC4-SHA Accepted SSLv3 128 bits RC4-MD5 Accepted SSLv3 112 bits EDH-RSA-DES-CBC3-SHA Accepted SSLv3 112 bits DES-CBC3-SHA Accepted TLSv1 256 bits DHE-RSA-AES256-SHA Accepted TLSv1 256 bits DHE-RSA-CAMELLIA256-SHA Accepted TLSv1 256 bits AES256-SHA Accepted TLSv1 256 bits CAMELLIA256-SHA Accepted TLSv1 128 bits DHE-RSA-AES128-SHA Accepted TLSv1 128 bits DHE-RSA-CAMELLIA128-SHA Accepted TLSv1 128 bits AES128-SHA Accepted TLSv1 128 bits CAMELLIA128-SHA Accepted TLSv1 128 bits RC4-SHA Accepted TLSv1 128 bits RC4-MD5 Accepted TLSv1 112 bits EDH-RSA-DES-CBC3-SHA Accepted TLSv1 112 bits DES-CBC3-SHA how do we turn it off and only allow tlv>=1.1 Kind regards, Matthias Fenner

2 1

[libvirt-users] QemuDomainObjEndJob called when libvirtd is started and libvirt insists qemu is using the wrong disk source.
by Matthew Schumacher 29 Apr '15

29 Apr '15

List, I was under the impression that I could restart libvirtd without it destroying my VMs, but am not finding that to be true. When I killall libvirtd then my VM's keep running, but then when I start libvirtd it calls qemuDomainObjEndJob:1542 : Stopping job: modify (async=none vm=0x7fb8cc0d8510 name=test) and my domain gets whacked. Any way to disable this behavior? Also, while I'm at it, due to issues with snapshotting, I ended up with two domains where libvirt insists the disk source is incorrect which causes many things to break like this: root@wasvirt1:/etc/libvirt# virsh domblklist wasdev Target Source ------------------------------------------------ vda /glustervol1/vm/wasdev/wasdev.reboot hdc /dev/sr0 Yet: root@wasvirt1:/etc/libvirt# lsof | grep wasdev 2235 /usr/bin/qemu-system-x86_64 /var/log/libvirt/qemu/wasdev.log 2235 /usr/bin/qemu-system-x86_64 /var/log/libvirt/qemu/wasdev.log 2235 /usr/bin/qemu-system-x86_64 /glustervol1/vm/wasdev/wasdev.qcow2 The reason is because a blockcommit --active --pivot doesn't work, I blockjob --abort, then try again, it works the second time, but then the disk is wrong. Help would be greatly appreciated. Thanks, schu

3 10