Compare commits
6 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Cole Robinson
|
a8bac7d647 | ||
|
Daniel Veillard
|
74d9fb3860 | ||
|
Daniel Veillard
|
1b3b9bf1cc | ||
|
Adam Jackson
|
1d1a47ccaf | ||
|
Adam Jackson
|
14f81abaae | ||
|
Jesse Keating
|
6b3af81b0e |
+18
@@ -0,0 +1,18 @@
|
||||
.build*.log
|
||||
*.rpm
|
||||
i686
|
||||
x86_64
|
||||
libvirt-*.tar.gz
|
||||
libvirt-0.6.0.tar.gz
|
||||
libvirt-0.6.1.tar.gz
|
||||
libvirt-0.6.2.tar.gz
|
||||
libvirt-0.6.3.tar.gz
|
||||
libvirt-0.6.4.tar.gz
|
||||
libvirt-0.6.5.tar.gz
|
||||
libvirt-0.7.0.tar.gz
|
||||
libvirt-0.7.1.tar.gz
|
||||
libvirt-0.7.2.tar.gz
|
||||
libvirt-0.7.3.tar.gz
|
||||
libvirt-0.7.4.tar.gz
|
||||
libvirt-0.7.5.tar.gz
|
||||
libvirt-0.7.6.tar.gz
|
||||
@@ -1,5 +0,0 @@
|
||||
.build*.log
|
||||
*.rpm
|
||||
i686
|
||||
x86_64
|
||||
libvirt-*.tar.xz
|
||||
@@ -1,55 +0,0 @@
|
||||
From: "Daniel P. Berrange" <berrange@redhat.com>
|
||||
Date: Tue, 2 May 2017 11:32:43 +0100
|
||||
Subject: [PATCH] Fix padding of encrypted data
|
||||
|
||||
If we are encoding a block of data that is 16 bytes in length,
|
||||
we cannot leave it as 16 bytes, we must pad it out to the next
|
||||
block boundary, 32 bytes. Without this padding, the decoder will
|
||||
incorrectly treat the last byte of plain text as the padding
|
||||
length, as it can't distinguish padded from non-padded data.
|
||||
|
||||
The problem exhibited itself when using a 16 byte passphrase
|
||||
for a LUKS volume
|
||||
|
||||
$ virsh secret-set-value 55806c7d-8e93-456f-829b-607d8c198367 \
|
||||
$(echo -n 1234567812345678 | base64)
|
||||
Secret value set
|
||||
|
||||
$ virsh start demo
|
||||
error: Failed to start domain demo
|
||||
error: internal error: process exited while connecting to monitor: >>>>>>>>>>Len 16
|
||||
2017-05-02T10:35:40.016390Z qemu-system-x86_64: -object \
|
||||
secret,id=virtio-disk1-luks-secret0,data=SEtNi5vDUeyseMKHwc1c1Q==,\
|
||||
keyid=masterKey0,iv=zm7apUB1A6dPcH53VW960Q==,format=base64: \
|
||||
Incorrect number of padding bytes (56) found on decrypted data
|
||||
|
||||
Notice how the padding '56' corresponds to the ordinal value of
|
||||
the character '8'.
|
||||
|
||||
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
|
||||
(cherry picked from commit 71890992daf37ec78b00b4ce873369421dc99731)
|
||||
---
|
||||
src/util/vircrypto.c | 10 ++++++++--
|
||||
1 file changed, 8 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/util/vircrypto.c b/src/util/vircrypto.c
|
||||
index 03410a1a4..8f1e0b7b7 100644
|
||||
--- a/src/util/vircrypto.c
|
||||
+++ b/src/util/vircrypto.c
|
||||
@@ -152,8 +152,14 @@ virCryptoEncryptDataAESgnutls(gnutls_cipher_algorithm_t gnutls_enc_alg,
|
||||
uint8_t *ciphertext;
|
||||
size_t ciphertextlen;
|
||||
|
||||
- /* Allocate a padded buffer, copy in the data */
|
||||
- ciphertextlen = VIR_ROUND_UP(datalen, 16);
|
||||
+ /* Allocate a padded buffer, copy in the data.
|
||||
+ *
|
||||
+ * NB, we must *always* have at least 1 byte of
|
||||
+ * padding - we can't skip it on multiples of
|
||||
+ * 16, otherwise decoder can't distinguish padded
|
||||
+ * data from non-padded data. Hence datalen + 1
|
||||
+ */
|
||||
+ ciphertextlen = VIR_ROUND_UP(datalen + 1, 16);
|
||||
if (VIR_ALLOC_N(ciphertext, ciphertextlen) < 0)
|
||||
return -1;
|
||||
memcpy(ciphertext, data, datalen);
|
||||
@@ -1,90 +0,0 @@
|
||||
From: Neal Gompa <ngompa13@gmail.com>
|
||||
Date: Mon, 17 Jul 2017 11:32:46 -0400
|
||||
Subject: [PATCH] spec: Add support for building the zfs storage driver
|
||||
|
||||
Where it can be supported in Fedora, the driver is built and made
|
||||
available as a subpackage.
|
||||
|
||||
Signed-off-by: Neal Gompa <ngompa13@gmail.com>
|
||||
(cherry picked from commit 9af764e86aef7dfb0191a9561bf1d1abf941da05)
|
||||
---
|
||||
libvirt.spec.in | 31 +++++++++++++++++++++++++++++++
|
||||
1 file changed, 31 insertions(+)
|
||||
|
||||
diff --git a/libvirt.spec.in b/libvirt.spec.in
|
||||
index 8eb67fa2e..f9a705e7c 100644
|
||||
--- a/libvirt.spec.in
|
||||
+++ b/libvirt.spec.in
|
||||
@@ -70,6 +70,13 @@
|
||||
%define with_storage_gluster 0%{!?_without_storage_gluster:1}
|
||||
%define with_numactl 0%{!?_without_numactl:1}
|
||||
|
||||
+# F25+ has zfs-fuse
|
||||
+%if 0%{?fedora} >= 25
|
||||
+ %define with_storage_zfs 0%{!?_without_storage_zfs:1}
|
||||
+%else
|
||||
+ %define with_storage_zfs 0
|
||||
+%endif
|
||||
+
|
||||
# A few optional bits off by default, we enable later
|
||||
%define with_fuse 0%{!?_without_fuse:0}
|
||||
%define with_cgconfig 0%{!?_without_cgconfig:0}
|
||||
@@ -113,6 +120,12 @@
|
||||
%endif
|
||||
%endif
|
||||
|
||||
+# zfs-fuse is not available on some architectures
|
||||
+%ifarch s390 s390x aarch64
|
||||
+ %define with_storage_zfs 0
|
||||
+%endif
|
||||
+
|
||||
+
|
||||
# RHEL doesn't ship OpenVZ, VBox, UML, PowerHypervisor,
|
||||
# VMware, libxenserver (xenapi), libxenlight (Xen 4.1 and newer),
|
||||
# or HyperV.
|
||||
@@ -364,6 +377,12 @@ BuildRequires: glusterfs-devel >= 3.4.1
|
||||
%if %{with_storage_sheepdog}
|
||||
BuildRequires: sheepdog
|
||||
%endif
|
||||
+%if %{with_storage_zfs}
|
||||
+# Support any conforming implementation of zfs. On stock Fedora
|
||||
+# this is zfs-fuse, but could be zfsonlinux upstream RPMs
|
||||
+BuildRequires: /sbin/zfs
|
||||
+BuildRequires: /sbin/zpool
|
||||
+%endif
|
||||
%if %{with_numactl}
|
||||
# For QEMU/LXC numa info
|
||||
BuildRequires: numactl-devel
|
||||
@@ -597,6 +616,11 @@ Requires: device-mapper
|
||||
# For Sheepdog support
|
||||
Requires: sheepdog
|
||||
%endif
|
||||
+%if %{with_storage_zfs}
|
||||
+# Support any conforming implementation of zfs
|
||||
+Requires: /sbin/zfs
|
||||
+Requires: /sbin/zpool
|
||||
+%endif
|
||||
%if %{with_qemu}
|
||||
# From QEMU RPMs
|
||||
Requires: /usr/bin/qemu-img
|
||||
@@ -1063,6 +1087,12 @@ rm -rf .git
|
||||
%define arg_storage_gluster --without-storage-gluster
|
||||
%endif
|
||||
|
||||
+%if %{with_storage_zfs}
|
||||
+ %define arg_storage_zfs --with-storage-zfs
|
||||
+%else
|
||||
+ %define arg_storage_zfs --without-storage-zfs
|
||||
+%endif
|
||||
+
|
||||
%if %{with_numactl}
|
||||
%define arg_numactl --with-numactl
|
||||
%else
|
||||
@@ -1170,6 +1200,7 @@ rm -f po/stamp-po
|
||||
%{?arg_storage_rbd} \
|
||||
%{?arg_storage_sheepdog} \
|
||||
%{?arg_storage_gluster} \
|
||||
+ %{?arg_storage_zfs} \
|
||||
%{?arg_numactl} \
|
||||
%{?arg_numad} \
|
||||
--with-capng \
|
||||
@@ -1,150 +0,0 @@
|
||||
From: Juan Hernandez <jhernand@redhat.com>
|
||||
Date: Thu, 6 Jul 2017 17:03:31 +0200
|
||||
Subject: [PATCH] Avoid hidden cgroup mount points
|
||||
|
||||
Currently the scan of the /proc/mounts file used to find cgroup mount
|
||||
points doesn't take into account that mount points may hidden by other
|
||||
mount points. For, example in certain Kubernetes environments the
|
||||
/proc/mounts contains the following lines:
|
||||
|
||||
cgroup /sys/fs/cgroup/net_prio,net_cls cgroup ...
|
||||
tmpfs /sys/fs/cgroup tmpfs ...
|
||||
cgroup /sys/fs/cgroup/net_cls,net_prio cgroup ...
|
||||
|
||||
In this particular environment the first mount point is hidden by the
|
||||
second one. The correct mount point is the third one, but libvirt will
|
||||
never process it because it only checks the first mount point for each
|
||||
controller (net_cls in this case). So libvirt will try to use the first
|
||||
mount point, which doesn't actually exist, and the complete detection
|
||||
process will fail.
|
||||
|
||||
To avoid that issue this patch changes the virCgroupDetectMountsFromFile
|
||||
function so that when there are duplicates it takes the information from
|
||||
the last line in /proc/mounts. This requires removing the previous
|
||||
explicit condition to skip duplicates, and adding code to free the
|
||||
memory used by the processing of duplicated lines.
|
||||
|
||||
Related-To: https://bugzilla.redhat.com/1468214
|
||||
Related-To: https://github.com/kubevirt/libvirt/issues/4
|
||||
Signed-off-by: Juan Hernandez <jhernand@redhat.com>
|
||||
(cherry picked from commit dacd160d7479e0ec2d8a63f102145fd30636a1c8)
|
||||
---
|
||||
src/util/vircgroup.c | 23 ++++++++++++++---------
|
||||
tests/vircgroupdata/kubevirt.mounts | 25 +++++++++++++++++++++++++
|
||||
tests/vircgroupdata/kubevirt.parsed | 10 ++++++++++
|
||||
tests/vircgrouptest.c | 1 +
|
||||
4 files changed, 50 insertions(+), 9 deletions(-)
|
||||
create mode 100644 tests/vircgroupdata/kubevirt.mounts
|
||||
create mode 100644 tests/vircgroupdata/kubevirt.parsed
|
||||
|
||||
diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c
|
||||
index f2477d5e9..322f7fb54 100644
|
||||
--- a/src/util/vircgroup.c
|
||||
+++ b/src/util/vircgroup.c
|
||||
@@ -396,6 +396,7 @@ virCgroupDetectMountsFromFile(virCgroupPtr group,
|
||||
const char *typestr = virCgroupControllerTypeToString(i);
|
||||
int typelen = strlen(typestr);
|
||||
char *tmp = entry.mnt_opts;
|
||||
+ struct virCgroupController *controller = &group->controllers[i];
|
||||
while (tmp) {
|
||||
char *next = strchr(tmp, ',');
|
||||
int len;
|
||||
@@ -405,18 +406,22 @@ virCgroupDetectMountsFromFile(virCgroupPtr group,
|
||||
} else {
|
||||
len = strlen(tmp);
|
||||
}
|
||||
- /* NB, the same controller can appear >1 time in mount list
|
||||
- * due to bind mounts from one location to another. Pick the
|
||||
- * first entry only
|
||||
- */
|
||||
- if (typelen == len && STREQLEN(typestr, tmp, len) &&
|
||||
- !group->controllers[i].mountPoint) {
|
||||
+
|
||||
+ if (typelen == len && STREQLEN(typestr, tmp, len)) {
|
||||
char *linksrc;
|
||||
struct stat sb;
|
||||
char *tmp2;
|
||||
|
||||
- if (VIR_STRDUP(group->controllers[i].mountPoint,
|
||||
- entry.mnt_dir) < 0)
|
||||
+ /* Note that the lines in /proc/mounts have the same
|
||||
+ * order than the mount operations, and that there may
|
||||
+ * be duplicates due to bind mounts. This means
|
||||
+ * that the same mount point may be processed more than
|
||||
+ * once. We need to save the results of the last one,
|
||||
+ * and we need to be careful to release the memory used
|
||||
+ * by previous processing. */
|
||||
+ VIR_FREE(controller->mountPoint);
|
||||
+ VIR_FREE(controller->linkPoint);
|
||||
+ if (VIR_STRDUP(controller->mountPoint, entry.mnt_dir) < 0)
|
||||
goto error;
|
||||
|
||||
tmp2 = strrchr(entry.mnt_dir, '/');
|
||||
@@ -452,7 +457,7 @@ virCgroupDetectMountsFromFile(virCgroupPtr group,
|
||||
VIR_WARN("Expecting a symlink at %s for controller %s",
|
||||
linksrc, typestr);
|
||||
} else {
|
||||
- group->controllers[i].linkPoint = linksrc;
|
||||
+ controller->linkPoint = linksrc;
|
||||
}
|
||||
}
|
||||
}
|
||||
diff --git a/tests/vircgroupdata/kubevirt.mounts b/tests/vircgroupdata/kubevirt.mounts
|
||||
new file mode 100644
|
||||
index 000000000..ca036196b
|
||||
--- /dev/null
|
||||
+++ b/tests/vircgroupdata/kubevirt.mounts
|
||||
@@ -0,0 +1,25 @@
|
||||
+rootfs / rootfs rw 0 0
|
||||
+proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0
|
||||
+udev /dev devtmpfs rw,nosuid,relatime,size=10240k,nr_inodes=1006404,mode=755 0 0
|
||||
+devpts /dev/pts devpts rw,relatime,gid=5,mode=620,ptmxmode=000 0 0
|
||||
+sysfs /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0
|
||||
+/dev/sda1 / ext4 rw,noatime,data=ordered 0 0
|
||||
+tmpfs /run tmpfs rw,nodev,relatime,size=812296k,mode=755 0 0
|
||||
+mqueue /dev/mqueue mqueue rw,nosuid,nodev,noexec,relatime 0 0
|
||||
+shm /dev/shm tmpfs rw,nosuid,nodev,noexec,relatime 0 0
|
||||
+debugfs /sys/kernel/debug debugfs rw,nosuid,nodev,noexec,relatime 0 0
|
||||
+cgroup_root /sys/fs/cgroup tmpfs rw,nosuid,nodev,noexec,relatime,size=10240k,mode=755 0 0
|
||||
+openrc /sys/fs/cgroup/openrc cgroup rw,nosuid,nodev,noexec,relatime,release_agent=/lib64/rc/sh/cgroup-release-agent.sh,name=openrc 0 0
|
||||
+cpuset /some/random/location/cpuset cgroup rw,nosuid,nodev,noexec,relatime,cpuset 0 0
|
||||
+cpuset /sys/fs/cgroup/cpuset cgroup rw,nosuid,nodev,noexec,relatime,cpuset 0 0
|
||||
+cpu /sys/fs/cgroup/cpu cgroup rw,nosuid,nodev,noexec,relatime,cpu 0 0
|
||||
+cpuacct /some/random/location/cpuset cgroup rw,nosuid,nodev,noexec,relatime,cpuacct 0 0
|
||||
+cpuacct /sys/fs/cgroup/cpuacct cgroup rw,nosuid,nodev,noexec,relatime,cpuacct 0 0
|
||||
+memory /sys/fs/cgroup/memory cgroup rw,nosuid,nodev,noexec,relatime,memory 0 0
|
||||
+devices /sys/fs/cgroup/devices cgroup rw,nosuid,nodev,noexec,relatime,devices 0 0
|
||||
+freezer /sys/fs/cgroup/freezer cgroup rw,nosuid,nodev,noexec,relatime,freezer 0 0
|
||||
+blkio /sys/fs/cgroup/blkio cgroup rw,nosuid,nodev,noexec,relatime,blkio 0 0
|
||||
+perf_event /sys/fs/cgroup/perf_event cgroup rw,nosuid,nodev,noexec,relatime,perf_event 0 0
|
||||
+hugetlb /sys/fs/cgroup/hugetlb cgroup rw,nosuid,nodev,noexec,relatime,hugetlb 0 0
|
||||
+binfmt_misc /proc/sys/fs/binfmt_misc binfmt_misc rw,nosuid,nodev,noexec,relatime 0 0
|
||||
+freezer /some/random/location/freezer cgroup rw,nosuid,nodev,noexec,relatime,freezer 0 0
|
||||
diff --git a/tests/vircgroupdata/kubevirt.parsed b/tests/vircgroupdata/kubevirt.parsed
|
||||
new file mode 100644
|
||||
index 000000000..694870723
|
||||
--- /dev/null
|
||||
+++ b/tests/vircgroupdata/kubevirt.parsed
|
||||
@@ -0,0 +1,10 @@
|
||||
+cpu /sys/fs/cgroup/cpu
|
||||
+cpuacct /sys/fs/cgroup/cpuacct
|
||||
+cpuset /sys/fs/cgroup/cpuset
|
||||
+memory /sys/fs/cgroup/memory
|
||||
+devices /sys/fs/cgroup/devices
|
||||
+freezer /some/random/location/freezer
|
||||
+blkio /sys/fs/cgroup/blkio
|
||||
+net_cls <null>
|
||||
+perf_event /sys/fs/cgroup/perf_event
|
||||
+name=systemd <null>
|
||||
diff --git a/tests/vircgrouptest.c b/tests/vircgrouptest.c
|
||||
index f55ef74a1..cf0315f16 100644
|
||||
--- a/tests/vircgrouptest.c
|
||||
+++ b/tests/vircgrouptest.c
|
||||
@@ -885,6 +885,7 @@ mymain(void)
|
||||
DETECT_MOUNTS("cgroups3");
|
||||
DETECT_MOUNTS("all-in-one");
|
||||
DETECT_MOUNTS("no-cgroups");
|
||||
+ DETECT_MOUNTS("kubevirt");
|
||||
|
||||
if (virTestRun("New cgroup for self", testCgroupNewForSelf, NULL) < 0)
|
||||
ret = -1;
|
||||
@@ -1,53 +0,0 @@
|
||||
From: Jim Fehlig <jfehlig@suse.com>
|
||||
Date: Tue, 18 Jul 2017 10:20:35 -0600
|
||||
Subject: [PATCH] docs: schema: make disk driver name attribute optional
|
||||
|
||||
/domain/devices/disk/driver/@name is not a required or mandatory
|
||||
attribute according to formatdomain, and indeed it was agreed on
|
||||
IRC that the attribute is "optional for input, recommended (but
|
||||
not required) for output". Currently the schema requires the
|
||||
attribute, causing virt-xml-validate to fail on disk config where
|
||||
the driver name is not explicitly specified. E.g.
|
||||
|
||||
# cat test.xml | grep -A 5 cdrom
|
||||
<disk type='file' device='cdrom'>
|
||||
<driver type='raw'/>
|
||||
<target dev='hdb' bus='ide'/>
|
||||
<readonly/>
|
||||
<address type='drive' controller='0' bus='0' target='0' unit='1'/>
|
||||
</disk>
|
||||
|
||||
# virt-xml-validate test.xml
|
||||
Relax-NG validity error : Extra element devices in interleave
|
||||
test.xml:21: element devices: Relax-NG validity error : Element domain failed to validate content
|
||||
test.xml fails to validate
|
||||
|
||||
Relaxing the name attribute to be optional fixes the validation
|
||||
|
||||
# virt-xml-validate test.xml
|
||||
test.xml validates
|
||||
|
||||
(cherry picked from commit b494e09d058f09b48d0fd8855edd557101294671)
|
||||
---
|
||||
docs/schemas/domaincommon.rng | 8 +++++---
|
||||
1 file changed, 5 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
|
||||
index 9a7d03ed9..38dda780e 100644
|
||||
--- a/docs/schemas/domaincommon.rng
|
||||
+++ b/docs/schemas/domaincommon.rng
|
||||
@@ -1670,9 +1670,11 @@
|
||||
</element>
|
||||
</define>
|
||||
<define name="driverFormat">
|
||||
- <attribute name="name">
|
||||
- <ref name="genericName"/>
|
||||
- </attribute>
|
||||
+ <optional>
|
||||
+ <attribute name="name">
|
||||
+ <ref name="genericName"/>
|
||||
+ </attribute>
|
||||
+ </optional>
|
||||
<optional>
|
||||
<attribute name='type'>
|
||||
<choice>
|
||||
@@ -0,0 +1,233 @@
|
||||
From 3a441522017aa9c1b8b54d2ce4569d0f0d96fa72 Mon Sep 17 00:00:00 2001
|
||||
From: Cole Robinson <crobinso@redhat.com>
|
||||
Date: Fri, 12 Mar 2010 12:36:56 -0500
|
||||
Subject: [PATCH] qemu: Add some debugging at domain startup
|
||||
|
||||
---
|
||||
src/qemu/qemu_driver.c | 24 +++++++++++++++++++++++-
|
||||
1 files changed, 23 insertions(+), 1 deletions(-)
|
||||
|
||||
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
|
||||
index f8ab545..040d645 100644
|
||||
--- a/src/qemu/qemu_driver.c
|
||||
+++ b/src/qemu/qemu_driver.c
|
||||
@@ -2695,6 +2695,8 @@ static int qemudStartVMDaemon(virConnectPtr conn,
|
||||
|
||||
FD_ZERO(&keepfd);
|
||||
|
||||
+ DEBUG0("Beginning VM startup process");
|
||||
+
|
||||
if (virDomainObjIsActive(vm)) {
|
||||
qemuReportError(VIR_ERR_OPERATION_INVALID,
|
||||
"%s", _("VM is already active"));
|
||||
@@ -2703,22 +2705,27 @@ static int qemudStartVMDaemon(virConnectPtr conn,
|
||||
|
||||
/* If you are using a SecurityDriver with dynamic labelling,
|
||||
then generate a security label for isolation */
|
||||
+ DEBUG0("Generating domain security label (if required)");
|
||||
if (driver->securityDriver &&
|
||||
driver->securityDriver->domainGenSecurityLabel &&
|
||||
driver->securityDriver->domainGenSecurityLabel(vm) < 0)
|
||||
return -1;
|
||||
|
||||
+ DEBUG0("Generating setting domain security labels (if required)");
|
||||
if (driver->securityDriver &&
|
||||
driver->securityDriver->domainSetSecurityAllLabel &&
|
||||
driver->securityDriver->domainSetSecurityAllLabel(vm) < 0)
|
||||
goto cleanup;
|
||||
|
||||
- /* Ensure no historical cgroup for this VM is lieing around bogus settings */
|
||||
+ /* Ensure no historical cgroup for this VM is lying around bogus
|
||||
+ * settings */
|
||||
+ DEBUG0("Ensuring no historical cgroup is lying around");
|
||||
qemuRemoveCgroup(driver, vm, 1);
|
||||
|
||||
if ((vm->def->ngraphics == 1) &&
|
||||
vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC &&
|
||||
vm->def->graphics[0]->data.vnc.autoport) {
|
||||
+ DEBUG0("Determining VNC port");
|
||||
int port = qemudNextFreeVNCPort(driver);
|
||||
if (port < 0) {
|
||||
qemuReportError(VIR_ERR_INTERNAL_ERROR,
|
||||
@@ -2735,6 +2742,7 @@ static int qemudStartVMDaemon(virConnectPtr conn,
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
+ DEBUG0("Creating domain log file");
|
||||
if ((logfile = qemudLogFD(driver, vm->def->name)) < 0)
|
||||
goto cleanup;
|
||||
|
||||
@@ -2751,14 +2759,17 @@ static int qemudStartVMDaemon(virConnectPtr conn,
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
+ DEBUG0("Determing emulator version");
|
||||
if (qemudExtractVersionInfo(emulator,
|
||||
NULL,
|
||||
&qemuCmdFlags) < 0)
|
||||
goto cleanup;
|
||||
|
||||
+ DEBUG0("Setting up domain cgroup (if required)");
|
||||
if (qemuSetupCgroup(driver, vm) < 0)
|
||||
goto cleanup;
|
||||
|
||||
+ DEBUG0("Preparing host devices");
|
||||
if (qemuPrepareHostDevices(driver, vm->def) < 0)
|
||||
goto cleanup;
|
||||
|
||||
@@ -2767,6 +2778,7 @@ static int qemudStartVMDaemon(virConnectPtr conn,
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
+ DEBUG0("Preparing monitor state");
|
||||
if (qemuPrepareMonitorChr(driver, priv->monConfig, vm->def->name) < 0)
|
||||
goto cleanup;
|
||||
|
||||
@@ -2798,6 +2810,7 @@ static int qemudStartVMDaemon(virConnectPtr conn,
|
||||
* use in hotplug
|
||||
*/
|
||||
if (qemuCmdFlags & QEMUD_CMD_FLAG_DEVICE) {
|
||||
+ DEBUG0("Assigning domain PCI addresses");
|
||||
/* Populate cache with current addresses */
|
||||
if (priv->pciaddrs) {
|
||||
qemuDomainPCIAddressSetFree(priv->pciaddrs);
|
||||
@@ -2816,6 +2829,7 @@ static int qemudStartVMDaemon(virConnectPtr conn,
|
||||
priv->persistentAddrs = 0;
|
||||
}
|
||||
|
||||
+ DEBUG0("Building emulator command line");
|
||||
vm->def->id = driver->nextvmid++;
|
||||
if (qemudBuildCommandLine(conn, driver, vm->def, priv->monConfig,
|
||||
priv->monJSON, qemuCmdFlags, &argv, &progenv,
|
||||
@@ -2899,25 +2913,31 @@ static int qemudStartVMDaemon(virConnectPtr conn,
|
||||
if (ret == -1) /* The VM failed to start */
|
||||
goto cleanup;
|
||||
|
||||
+ DEBUG0("Waiting for monitor to show up");
|
||||
if (qemudWaitForMonitor(driver, vm, pos) < 0)
|
||||
goto abort;
|
||||
|
||||
+ DEBUG0("Detecting VCPU PIDs");
|
||||
if (qemuDetectVcpuPIDs(driver, vm) < 0)
|
||||
goto abort;
|
||||
|
||||
+ DEBUG0("Setting CPU affinity");
|
||||
if (qemudInitCpuAffinity(vm) < 0)
|
||||
goto abort;
|
||||
|
||||
+ DEBUG0("Setting any required VM passwords");
|
||||
if (qemuInitPasswords(conn, driver, vm, qemuCmdFlags) < 0)
|
||||
goto abort;
|
||||
|
||||
/* If we have -device, then addresses are assigned explicitly.
|
||||
* If not, then we have to detect dynamic ones here */
|
||||
if (!(qemuCmdFlags & QEMUD_CMD_FLAG_DEVICE)) {
|
||||
+ DEBUG0("Determining domain device PCI addresses");
|
||||
if (qemuInitPCIAddresses(driver, vm) < 0)
|
||||
goto abort;
|
||||
}
|
||||
|
||||
+ DEBUG0("Setting initial memory amount");
|
||||
qemuDomainObjEnterMonitorWithDriver(driver, vm);
|
||||
if (qemuMonitorSetBalloon(priv->mon, vm->def->memory) < 0) {
|
||||
qemuDomainObjExitMonitorWithDriver(driver, vm);
|
||||
@@ -2925,6 +2945,7 @@ static int qemudStartVMDaemon(virConnectPtr conn,
|
||||
}
|
||||
|
||||
if (migrateFrom == NULL) {
|
||||
+ DEBUG0("Starting domain CPUs");
|
||||
/* Allow the CPUS to start executing */
|
||||
if (qemuMonitorStartCPUs(priv->mon, conn) < 0) {
|
||||
if (virGetLastError() == NULL)
|
||||
@@ -2937,6 +2958,7 @@ static int qemudStartVMDaemon(virConnectPtr conn,
|
||||
qemuDomainObjExitMonitorWithDriver(driver, vm);
|
||||
|
||||
|
||||
+ DEBUG0("Writing domain status to disk");
|
||||
if (virDomainSaveStatus(driver->caps, driver->stateDir, vm) < 0)
|
||||
goto abort;
|
||||
|
||||
--
|
||||
1.6.6.1
|
||||
|
||||
From 6d5c8a8f51db8ce97ab35ab6022dd5c94ab016b4 Mon Sep 17 00:00:00 2001
|
||||
From: Cole Robinson <crobinso@redhat.com>
|
||||
Date: Fri, 12 Mar 2010 12:37:52 -0500
|
||||
Subject: [PATCH] qemu: Fix USB by product with security enabled
|
||||
|
||||
We need to call PrepareHostdevs to determine the USB device path before
|
||||
any security calls. PrepareHostUSBDevices was also incorrectly skipping
|
||||
all USB devices.
|
||||
---
|
||||
src/qemu/qemu_driver.c | 11 ++++++-----
|
||||
1 files changed, 6 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
|
||||
index 040d645..b17d26d 100644
|
||||
--- a/src/qemu/qemu_driver.c
|
||||
+++ b/src/qemu/qemu_driver.c
|
||||
@@ -2360,7 +2360,7 @@ qemuPrepareHostUSBDevices(struct qemud_driver *driver ATTRIBUTE_UNUSED,
|
||||
|
||||
if (hostdev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS)
|
||||
continue;
|
||||
- if (hostdev->source.subsys.type != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI)
|
||||
+ if (hostdev->source.subsys.type != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB)
|
||||
continue;
|
||||
|
||||
/* Resolve a vendor/product to bus/device */
|
||||
@@ -2703,6 +2703,11 @@ static int qemudStartVMDaemon(virConnectPtr conn,
|
||||
return -1;
|
||||
}
|
||||
|
||||
+ /* Must be run before security labelling */
|
||||
+ DEBUG0("Preparing host devices");
|
||||
+ if (qemuPrepareHostDevices(driver, vm->def) < 0)
|
||||
+ goto cleanup;
|
||||
+
|
||||
/* If you are using a SecurityDriver with dynamic labelling,
|
||||
then generate a security label for isolation */
|
||||
DEBUG0("Generating domain security label (if required)");
|
||||
@@ -2769,10 +2774,6 @@ static int qemudStartVMDaemon(virConnectPtr conn,
|
||||
if (qemuSetupCgroup(driver, vm) < 0)
|
||||
goto cleanup;
|
||||
|
||||
- DEBUG0("Preparing host devices");
|
||||
- if (qemuPrepareHostDevices(driver, vm->def) < 0)
|
||||
- goto cleanup;
|
||||
-
|
||||
if (VIR_ALLOC(priv->monConfig) < 0) {
|
||||
virReportOOMError();
|
||||
goto cleanup;
|
||||
--
|
||||
1.6.6.1
|
||||
|
||||
From 65e97240e6e4606820dd1c42ac172319e0af4d8d Mon Sep 17 00:00:00 2001
|
||||
From: Cole Robinson <crobinso@redhat.com>
|
||||
Date: Mon, 22 Mar 2010 10:45:36 -0400
|
||||
Subject: [PATCH] security: selinux: Fix crash when releasing non-existent label
|
||||
|
||||
This can be triggered by the qemuStartVMDaemon cleanup path if a
|
||||
VM references a non-existent USB device (by product) in the XML.
|
||||
|
||||
Signed-off-by: Cole Robinson <crobinso@redhat.com>
|
||||
---
|
||||
src/security/security_selinux.c | 3 ++-
|
||||
1 files changed, 2 insertions(+), 1 deletions(-)
|
||||
|
||||
diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
|
||||
index 975b315..6680e2d 100644
|
||||
--- a/src/security/security_selinux.c
|
||||
+++ b/src/security/security_selinux.c
|
||||
@@ -632,7 +632,8 @@ SELinuxReleaseSecurityLabel(virDomainObjPtr vm)
|
||||
{
|
||||
const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
|
||||
|
||||
- if (secdef->type == VIR_DOMAIN_SECLABEL_STATIC)
|
||||
+ if (secdef->type == VIR_DOMAIN_SECLABEL_STATIC ||
|
||||
+ secdef->label == NULL)
|
||||
return 0;
|
||||
|
||||
context_t con = context_new(secdef->label);
|
||||
--
|
||||
1.6.6.1
|
||||
|
||||
@@ -0,0 +1,87 @@
|
||||
From 3f1aa08af6580c215d973bc6bf57f505dbf8b926 Mon Sep 17 00:00:00 2001
|
||||
From: Cole Robinson <crobinso@redhat.com>
|
||||
Date: Fri, 12 Mar 2010 13:38:39 -0500
|
||||
Subject: [PATCH] security: Set permissions for kernel/initrd
|
||||
|
||||
Fixes URL installs when running virt-install as root on Fedora.
|
||||
---
|
||||
src/qemu/qemu_security_dac.c | 21 +++++++++++++++++++++
|
||||
src/security/security_selinux.c | 16 ++++++++++++++++
|
||||
2 files changed, 37 insertions(+), 0 deletions(-)
|
||||
|
||||
diff --git a/src/qemu/qemu_security_dac.c b/src/qemu/qemu_security_dac.c
|
||||
index 6911f48..1883fbe 100644
|
||||
--- a/src/qemu/qemu_security_dac.c
|
||||
+++ b/src/qemu/qemu_security_dac.c
|
||||
@@ -332,6 +332,15 @@ qemuSecurityDACRestoreSecurityAllLabel(virDomainObjPtr vm)
|
||||
vm->def->disks[i]) < 0)
|
||||
rc = -1;
|
||||
}
|
||||
+
|
||||
+ if (vm->def->os.kernel &&
|
||||
+ qemuSecurityDACRestoreSecurityFileLabel(vm->def->os.kernel) < 0)
|
||||
+ rc = -1;
|
||||
+
|
||||
+ if (vm->def->os.initrd &&
|
||||
+ qemuSecurityDACRestoreSecurityFileLabel(vm->def->os.initrd) < 0)
|
||||
+ rc = -1;
|
||||
+
|
||||
return rc;
|
||||
}
|
||||
|
||||
@@ -356,6 +365,18 @@ qemuSecurityDACSetSecurityAllLabel(virDomainObjPtr vm)
|
||||
return -1;
|
||||
}
|
||||
|
||||
+ if (vm->def->os.kernel &&
|
||||
+ qemuSecurityDACSetOwnership(vm->def->os.kernel,
|
||||
+ driver->user,
|
||||
+ driver->group) < 0)
|
||||
+ return -1;
|
||||
+
|
||||
+ if (vm->def->os.initrd &&
|
||||
+ qemuSecurityDACSetOwnership(vm->def->os.initrd,
|
||||
+ driver->user,
|
||||
+ driver->group) < 0)
|
||||
+ return -1;
|
||||
+
|
||||
return 0;
|
||||
}
|
||||
|
||||
diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
|
||||
index b2c8581..975b315 100644
|
||||
--- a/src/security/security_selinux.c
|
||||
+++ b/src/security/security_selinux.c
|
||||
@@ -616,6 +616,14 @@ SELinuxRestoreSecurityAllLabel(virDomainObjPtr vm)
|
||||
rc = -1;
|
||||
}
|
||||
|
||||
+ if (vm->def->os.kernel &&
|
||||
+ SELinuxRestoreSecurityFileLabel(vm->def->os.kernel) < 0)
|
||||
+ rc = -1;
|
||||
+
|
||||
+ if (vm->def->os.initrd &&
|
||||
+ SELinuxRestoreSecurityFileLabel(vm->def->os.initrd) < 0)
|
||||
+ rc = -1;
|
||||
+
|
||||
return rc;
|
||||
}
|
||||
|
||||
@@ -736,6 +744,14 @@ SELinuxSetSecurityAllLabel(virDomainObjPtr vm)
|
||||
return -1;
|
||||
}
|
||||
|
||||
+ if (vm->def->os.kernel &&
|
||||
+ SELinuxSetFilecon(vm->def->os.kernel, default_content_context) < 0)
|
||||
+ return -1;
|
||||
+
|
||||
+ if (vm->def->os.initrd &&
|
||||
+ SELinuxSetFilecon(vm->def->os.initrd, default_content_context) < 0)
|
||||
+ return -1;
|
||||
+
|
||||
return 0;
|
||||
}
|
||||
|
||||
--
|
||||
1.6.6.1
|
||||
|
||||
+573
-2440
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user