- Users - libvirt List Archives

[libvirt-users] libvirt, selinux, moving images to ~/images does not work
by Alexey Kardashevskiy 08 Apr '13

08 Apr '13

Hi! I am trying libvirt on POWERPC64 with the default settings such as selinux enabled. It is all good till I move images out of /var/lib/libvirt/images/. http://libvirt.org/drvqemu.html#securityselinux is saying that "If attempting to use disk images in another location, the user/administrator must ensure the directory has be given this requisite label. Likewise physical block devices must be labelled system_u:object_r:virt_image_t.". So did I: [root@vpl2 ~]# ls -dlZ /home/aik/virtimg /var/lib/libvirt/images drwxr-xr-x. root root system_u:object_r:virt_image_t:s0 /home/aik/virtimg drwxr-xr-x. root root system_u:object_r:virt_image_t:s0 /var/lib/libvirt/images [root@vpl2 ~]# ls -lZ /home/aik/virtimg /var/lib/libvirt/images /home/aik/virtimg: -rwxrwxrwx. root root system_u:object_r:virt_content_t:s0 Fedora-18-ppc64-DVD.iso /var/lib/libvirt/images: -rwxrwxrwx. root root system_u:object_r:virt_image_t:s0 fc18guest However "virsh -c qemu:///system create libvirtguest-aik.xml" failes with "avc: denied { dac_override }" and "avc: denied { dac_read_search }". Also, there is "user system_u is not defined" in /var/log/messages what is confusing as "semanage user -l" says it is there. If I simply move Fedora-18-ppc64-DVD.iso to /var/lib/libvirt/images, the problem goes away and everything works fine. I am running custom build 3.8 kernel and libvirt from git ("eebbb23 qemu: support URI syntax for NBD"). More detailed output is below, this is all from the host system. What do I miss? Thank you. [root@vpl2 ~]# tail /var/log/messages Apr 8 16:47:48 vpl2 dbus-daemon[2903]: libsepol.sepol_context_to_sid: could not convert system_u:system_r:svirt_t:s0:c263,c837 to sid Apr 8 16:47:48 vpl2 dbus-daemon[2903]: libsepol.context_from_record: user system_u is not defined Apr 8 16:47:48 vpl2 dbus-daemon[2903]: libsepol.context_from_record: could not create context structure Apr 8 16:47:48 vpl2 dbus-daemon[2903]: libsepol.context_from_string: could not create context structure Apr 8 16:47:48 vpl2 dbus-daemon[2903]: libsepol.sepol_context_to_sid: could not convert system_u:system_r:svirt_t:s0:c263,c837 to sid Apr 8 16:47:48 vpl2 dbus-daemon[2903]: libsepol.context_from_record: user system_u is not defined Apr 8 16:47:48 vpl2 dbus-daemon[2903]: libsepol.context_from_record: could not create context structure Apr 8 16:47:48 vpl2 dbus-daemon[2903]: libsepol.context_from_string: could not create context structure Apr 8 16:47:48 vpl2 dbus-daemon[2903]: libsepol.sepol_context_to_sid: could not convert system_u:system_r:svirt_t:s0:c263,c837 to sid Apr 8 16:47:48 vpl2 libvirtd[5041]: failed to connect to monitor socket: No such process [root@vpl2 ~]# semanage user -l Labeling MLS/ MLS/ SELinux User Prefix MCS Level MCS Range SELinux Roles git_shell_u user s0 s0 git_shell_r guest_u user s0 s0 guest_r root user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r unconfined_r staff_u user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r unconfined_r sysadm_u user s0 s0-s0:c0.c1023 sysadm_r system_u user s0 s0-s0:c0.c1023 system_r unconfined_r unconfined_u user s0 s0-s0:c0.c1023 system_r unconfined_r user_u user s0 s0 user_r xguest_u user s0 s0 xguest_r [root@vpl2 ~]# tail /var/log/audit/audit.log type=NETFILTER_CFG msg=audit(1365403596.177:4507): table=nat family=2 entries=60 type=NETFILTER_CFG msg=audit(1365403596.177:4508): table=nat family=2 entries=61 type=AVC msg=audit(1365403606.017:4509): avc: denied { dac_override } for pid=8944 comm="qemu-system-ppc" capability=1 scontext=system_u:system_r:svirt_t:s0:c574,c809 tcontext=system_u:system_r:svirt_t:s0:c574,c809 tclass=capability type=AVC msg=audit(1365403606.017:4510): avc: denied { dac_read_search } for pid=8944 comm="qemu-system-ppc" capability=2 scontext=system_u:system_r:svirt_t:s0:c574,c809 tcontext=system_u:system_r:svirt_t:s0:c574,c809 tclass=capability type=AVC msg=audit(1365403606.017:4511): avc: denied { dac_override } for pid=8944 comm="qemu-system-ppc" capability=1 scontext=system_u:system_r:svirt_t:s0:c574,c809 tcontext=system_u:system_r:svirt_t:s0:c574,c809 tclass=capability type=AVC msg=audit(1365403606.017:4512): avc: denied { dac_read_search } for pid=8944 comm="qemu-system-ppc" capability=2 scontext=system_u:system_r:svirt_t:s0:c574,c809 tcontext=system_u:system_r:svirt_t:s0:c574,c809 tclass=capability type=AVC msg=audit(1365403606.017:4513): avc: denied { dac_override } for pid=8944 comm="qemu-system-ppc" capability=1 scontext=system_u:system_r:svirt_t:s0:c574,c809 tcontext=system_u:system_r:svirt_t:s0:c574,c809 tclass=capability type=AVC msg=audit(1365403606.017:4514): avc: denied { dac_read_search } for pid=8944 comm="qemu-system-ppc" capability=2 scontext=system_u:system_r:svirt_t:s0:c574,c809 tcontext=system_u:system_r:svirt_t:s0:c574,c809 tclass=capability type=AVC msg=audit(1365403606.017:4515): avc: denied { dac_override } for pid=8944 comm="qemu-system-ppc" capability=1 scontext=system_u:system_r:svirt_t:s0:c574,c809 tcontext=system_u:system_r:svirt_t:s0:c574,c809 tclass=capability type=AVC msg=audit(1365403606.017:4516): avc: denied { dac_read_search } for pid=8944 comm="qemu-system-ppc" capability=2 scontext=system_u:system_r:svirt_t:s0:c574,c809 tcontext=system_u:system_r:svirt_t:s0:c574,c809 tclass=capability [root@vpl2 ~]# libvirtd --version libvirtd (libvirt) 1.0.3 [root@vpl2 ~]# yum info policycoreutils [...] Arch : ppc64 Version : 2.1.13 Release : 59.fc18 Size : 3.8 M [root@vpl2 ~]# cat /etc/fedora-release Fedora release 18 (Spherical Cow) [root@vpl2 ~]# uname -a Linux vpl2.ozlabs.ibm.com 3.8.0-kvm-64k-aik+ #376 SMP Mon Apr 8 14:40:40 EST 2013 ppc64 ppc64 ppc64 GNU/Linux [aik@vpl2 ~]$ cat libvirtguest-aik.xml <domain type='kvm'> <name>AikLibvirtTest</name> <memory>2097152</memory> <vcpu>2</vcpu> <os> <type arch='ppc64' machine='pseries'>hvm</type> <boot dev='cdrom'/> <boot dev='hd'/> </os> <clock offset='utc'/> <devices> <emulator>/usr/local/bin/qemu-system-ppc64</emulator> <disk type='file' device='disk' > <driver name='qemu' type='raw'/> <source file='/var/lib/libvirt/images/fc18guest'/> <target dev='sda' bus='scsi'/> </disk> <disk type='file' device='cdrom' > <driver name='qemu' type='raw'/> <source file='/home/aik/virtimg/Fedora-18-ppc64-DVD.iso'/> <target dev='sdc' bus='scsi'/> <readonly/> </disk> <serial type='pty'> <target port='0'/> </serial> <console type='pty'> <target type='serial' port='0'/> </console> <memballoon model='virtio'/> </devices> </domain> -- Alexey

3 4

[libvirt-users] VNC Server in libvirt
by Jaime Loureiro Acuña 08 Apr '13

08 Apr '13

My name is Jaime Loureiro and I work in the Network & Applications area in University of Vigo. I am writing to you hoping you can help me with some libvirt graphics issues. I was analysing the source code of the libvirt in order to find how to access the display of each virtual machine. We are trying to generate a video streaming from the graphics content, though it is not easy to find what function is the most appropriate to do that. We tried to use the screenshot feature, but the rate is to low to generate a smooth streaming. I suposse the vnc server is reading the graphics output of each virtual machine at a low level, however I cannot find the exact point where the server is. Currently I am trying to understand the function "virDomainOpenGraphics" in libvirt.c and, at a lower level, the function "qemuProcessHandleGraphics" in qemu_process.c, but I 'm not sure if it is possible to get what we need from them. I would appreciate any help or clue you could provide regarding this issue. Thank you very much in advance. Best regards,

2 1

[libvirt-users] reset = destroy start
by 邓焕聪 08 Apr '13

08 Apr '13

what is different between destroy -> start and reset in virsh? i meet this position , when i reset a domain, it cannot start , it stoped at initialize initd.but when i destory it ,and start it , it can run normally. i am very confuse about them. who can tell me the difference.... thanks a lots.

2 1

[libvirt-users] 2 Problems with attaching/detaching disks with virsh and KVM
by Daniele Testa 07 Apr '13

07 Apr '13

Hi, I am having 2 issues with disks and KVM. ISSUE 1: I am unable to detach a disk from a running KVM. (root@h2)-(/tmp)# virsh dumpxml vps_99 <domain type='kvm' id='224'> <name>vps_99</name> <uuid>5e24e17c-f0e4-1030-ac57-0050560018a2</uuid> <memory>524288</memory> <currentMemory>524288</currentMemory> <vcpu>1</vcpu> <os> <type arch='x86_64' machine='pc-0.12'>hvm</type> <boot dev='hd'/> </os> <features> <acpi/> <apic/> <pae/> </features> <clock offset='utc'/> <on_poweroff>restart</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>restart</on_crash> <devices> <emulator>/usr/bin/kvm</emulator> <disk type='block' device='disk'> <driver name='qemu' type='raw'/> <source dev='/dev/nbd1'/> <target dev='vda' bus='virtio'/> </disk> <disk type='block' device='disk'> <driver name='qemu' type='raw'/> <source dev='/dev/nbd2'/> <target dev='vdb' bus='virtio'/> </disk> <disk type='block' device='disk'> <driver name='qemu' type='raw'/> <source dev='/dev/nbd3'/> <target dev='vde' bus='virtio'/> </disk> <disk type='block' device='disk'> <driver name='qemu' type='raw'/> <source dev='/dev/nbd4'/> <target dev='vdg' bus='virtio'/> </disk> <disk type='block' device='disk'> <driver name='qemu' type='raw'/> <source dev='/dev/nbd5'/> <target dev='vdi' bus='virtio'/> </disk> <interface type='bridge'> <mac address='00:50:56:00:1b:24'/> <source bridge='br0'/> <target dev='vnet3'/> <model type='virtio'/> </interface> <input type='mouse' bus='ps2'/> <graphics type='vnc' port='5999' autoport='no' keymap='en-us'/> <video> <model type='cirrus' vram='9216' heads='1'/> </video> </devices> <seclabel type='dynamic' model='apparmor'> <label>libvirt-5e24e17c-f0e4-1030-ac57-0050560018a2</label> <imagelabel>libvirt-5e24e17c-f0e4-1030-ac57-0050560018a2</imagelabel> </seclabel> </domain> (root@h2)-(/tmp)# cat disk.xml <disk type='block' device='disk'> <driver name='qemu' type='raw'/> <source dev='/dev/nbd5'/> <target dev='vdi' bus='virtio'/> </disk> (root@h2)-(/tmp)# virsh detach-device vps_99 disk.xml error: Failed to detach device from disk.xml error: operation failed: disk vdi cannot be detached - no PCI address for device (root@h2)-(/tmp)# virsh detach-disk vps_99 vdi error: operation failed: disk vdi cannot be detached - no PCI address for device I have tried specifing a <address> for each disk, ie: address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> However, I still get the same "no PCI" error. I am able to add and remove NEW disks to the virtual server after it has been started, but I can't detach the disks that were defined when the KVM was created (even though it looks exactly the same in the XML-file). ISSUE 2: When I add a disk to a KVM running linux (ubuntu in this case), it totally ignores my "target dev". I.e if I specify this: <target dev='vdi' bus='virtio'/> The disk is still being detected as "vdc". Removing the disk and adding it again, gives it "vdd" etc. So it seems it is pretty much just increamenting the letter and totally ignore my config. I read in the documentation that the target defined is just a "hint" for the system and is not always honered, but sorry, I simply cannot accept that :) There must be a way to specify the device the disk should be connected to. Amazon Web Services seems to be able to do this just fine. It will be a pain to write automated scripts when new disks are just attached to random devices. Regards, Daniele

1 0

[libvirt-users] URL to install Ubuntu Server guest
by Javi Legido 05 Apr '13

05 Apr '13

Hi there. Can somebody please confirm if the url to install an Ubuntu Server is http://archive.ubuntu.com/ubuntu/dists/quantal/main/installer-amd64/ ? If not kindly provide the right one. I want to perform a net installation, rather than point to an .iso image. Regards. Javier

1 1

[libvirt-users] virt-manager slow to connect, hangs on new host dialog
by martin f krafft 03 Apr '13

03 Apr '13

Hello, I am using virt-manager 0.9.4 on a Debian unstable system (libvirt 0.9.12) to connect to a libvirtd via SSH running on a Debian testing system (also version 0.9.12), and I have a problem using virt-manager, which first takes ages to connect, then freezes. The SSH connection is top-quality, the hosts are next to each other and connected by Gigabit Ethernet. virsh connections work fine. Unfortunately, when I run virt-manager and connect to the host, the host's capabilities are fetched very quickly (according to virt-manager's debug output), but it then takes 20–30 seconds until the connection is established. Logging libvirtd with log_level=2 produces nothing useful. Hence I tried with log_level=1, which is mayhem. Attached is the log output from the moment I told virt-manager to connect until shortly after the connection has been established. Maybe someone can figure out what's going on? I cannot… The next problem is that when I then try to create a host, I am shown the dialog and can enter one or two characters into the name field, then the GUI completely freezes, and so does libvirtd on the other system (ctrl-c does not work anymore). I have also captured this part of the session in a second log file, which provides no clues for me. Does anyone else know what might be going on? Thanks, -- martin | http://madduck.net/ | http://two.sentenc.es/ "es ist immer etwas wahnsinn in der liebe. es ist aber auch immer etwas vernunft im wahnsinn." - friedrich nietzsche spamtraps: madduck.bogus(a)madduck.net

2 8

[libvirt-users] Host modifications
by Benoit Friry 03 Apr '13

03 Apr '13

Hello, I test libvirt 0.9.12 on Debian. I am disappointed by changes made on my host without any notice. Examples: - editing interfaces with virsh or virt-manager modifies my /etc/network/interfaces. It's not clear at first glance that I can even cut myself from the host when editing remotely. The initial file is not even saved. - starting default network (nat) adds rules in netfilter. I have not seen how to create another network nat conf without calling clean-traffic nwfilter (it is not explicit in network XML file). Is it hardcoded ? I think it would be nice: - to be alerted before any host modification, - to be able to change the templates, for instance: - not including any nwfilter when creating a network, - script called when adding a file in a dir pool, - and so on. Did I miss something? Am I alone to disappointed by such behavior? Thanks, Benoit

3 4

Re: [libvirt-users] [libvirt] how to use svirt
by Alex Jia 03 Apr '13

03 Apr '13

On 04/03/2013 10:25 AM, yue wrote: > > hi,all > > i know svirt is merged into libvirt upstream, but how to use them? > You had better to ask this kind of question to libvirt-users(a)redhat.com in the future, it's a user mail listing, you may ask all kind of libvirt usage questions if you want, the following is some reference: https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/h… http://libvirt.org/drvqemu.html#securitysvirt http://danwalsh.livejournal.com/30565.html > > thanks > > > > > -- > libvir-list mailing list > libvir-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/libvir-list

2 1

[libvirt-users] Cannot recv data: Connection reset by peer
by Guillaume Thouvenin 03 Apr '13

03 Apr '13

Hello, I'm trying to install and use libvirt 1.0.4 on an Ubuntu 12.04.2. I compiled libvirt by doing: $ ./configure --with-selinux=no --with-gnutls $ make $ sudo make install Everything works fine and are installed under /usr/local Then I started the libvirtd manually and try to start a linux container that has the following configuration: $ virsh -c lxc:/// dumpxml lxcvm1 <domain type='lxc'> <name>lxcvm1</name> <uuid>168edaae-e3b5-2d06-7c65-9aa444a6f234</uuid> <memory unit='KiB'>2097152</memory> <currentMemory unit='KiB'>2097152</currentMemory> <vcpu placement='static'>1</vcpu> <os> <type arch='x86_64'>exe</type> <init>/bin/sh</init> </os> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/local/libexec/libvirt_lxc</emulator> <filesystem type='mount' accessmode='passthrough'> <source dir='/home/thouveng/lxc_dir/lxcvm1/rootfs'/> <target dir='/'/> </filesystem> <console type='pty'> <target type='lxc' port='0'/> </console> </devices> </domain> When I start the container I have the following error: $ virsh -c lxc:/// start lxcvm1 error: Failed to start domain lxcvm1 error: internal error guest failed to start: PATH=/bin:/sbin TERM=linux container=lxc-libvirt container_uuid=168edaae-e3b5-2d06-7c65-9aa444a6f234 LIBVIRT_LXC_UUID=168edaae-e3b5-2d06-7c65-9aa444a6f234 LIBVIRT_LXC_NAME=lxcvm1 /bin/sh error receiving signal from container: Input/output error The libvirtd is started with info option so I can see: 2013-04-03 08:49:20.167+0000: 17046: error : virNetSocketReadWire:1362 : Cannot recv data: Connection reset by peer 2013-04-03 08:49:20.267+0000: 17051: error : virLXCProcessStart:1248 : internal error guest failed to start: PATH=/bin:/sbin TERM=linux container=lxc-libvirt container_uuid=168edaae-e3b5-2d06-7c65-9aa444a6f234 LIBVIRT_LXC_UUID=168edaae-e3b5-2d06-7c65-9aa444a6f234 LIBVIRT_LXC_NAME=lxcvm1 /bin/sh error receiving signal from container: Input/output error In libvirtd.conf I have: auth_unix_ro = "none" auth_unix_rw = "none" auth_tcp = "none" auth_tls = "none" And in libvirt.conf everything is commented. I have this error as normal user (in libvirtd group) and also as root. Any hints to go further in the debugging are welcome. Regards, Guillaume

2 2

[libvirt-users] migrate qemu domains
by Yin Olivia-R63875 03 Apr '13

03 Apr '13

Hi, I tried to migrate qemu domains between same two Freescale PPC platforms. 1) Migrate test domain from Host1(10.193.20.109) to Host2(10.193.20.181). root@ppc-host1:~# virsh migrate test qemu+tls://10.193.20.181/system or root@ppc-host2:~# virsh -c qemu+tls://10.193.20.109/system migrate test qemu:///system I waited for a while and finally got error message as below: error: Unable to read from monitor: Connection reset by peer Exactly, when waiting (I guess during migration), the migrated domain is pasued on both source and destination nodes. root@ppc-host1:~# virsh -c qemu:///system list --all Id Name State ---------------------------------------------------- 5 test paused And meanwhile, the destination domain is also paused when waiting root@ppc-host2:~# virsh -c qemu:///system list --all Id Name State ---------------------------------------------------- 2 test paused Finally, the migrated domain on source node is shut off. root@ppc-host1:~# virsh -c qemu:///system list --all Id Name State ---------------------------------------------------- - test shut off But can't find any domain on destination node any longer. root@ppc-host2:~# virsh -c qemu:///system list --all Id Name State ---------------------------------------------------- As I know qemu-system-ppc doesn't support live migration on Freescale PPC platform yet. My question is whether it depends on qemu implementation to migrate qemu hypervisor with libvirt? >From the above experiment, it seemed that migration happened but not succeeded finally. Best Regards, Olivia

3 4