External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-10-03 12:55:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

qemu_process.c: Propagate hugetlbfs mounts on reconnect

Browse Source 
When reconnecting to a running QEMU process, we construct the
per-domain path in all hugetlbfs mounts. This is a relict from
the past (v3.4.0-100-g5b24d25062) where we switched to a
per-domain path and we want to create those paths when libvirtd
restarts on upgrade.

And with namespaces enabled there is one corner case where the
path is not created. In fact an error is reported and the
reconnect fails. Ideally, all mount events are propagated into
the QEMU's namespace. And they probably are, except when the
target path does not exist inside the namespace. Now, it's pretty
common for users to mount hugetlbfs under /dev (e.g.
/dev/hugepages), but if domain is started without hugepages (or
more specifically - private hugetlbfs path wasn't created on
domain startup), then the reconnect code tries to create it.
But it fails to do so, well, it fails to set seclabels on the
path because, because the path does not exist in the private
namespace. And it doesn't exist because we specifically create
only a subset of all possible /dev nodes. Therefore, the mount
event, whilst propagated, is not successful and hence the
filesystem is not mounted. We have to do it ourselves.

If hugetlbfs is mount anywhere else there's no problem and this
is effectively a dead code.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2123196
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
This commit is contained in:
Michal Privoznik 2022-09-06 13:45:51 +02:00
parent 5853d70718
commit 0377177c78
2 changed files with 3 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
docs/kbase/qemu-passthrough-security.rst
View File

@ -172,9 +172,3 @@ command before any guest is started:
::
# mount --make-rshared /
Another requirement for dynamic mount point propagation is to not place
``hugetlbfs`` mount points under ``/dev`` because these won't be propagated as
corresponding directories do not exist in the private namespace. Or just use
``memfd`` memory backend instead which does not require ``hugetlbfs`` mount
points.

3
src/qemu/qemu_process.c
View File

@ -3976,6 +3976,9 @@ qemuProcessBuildDestroyMemoryPathsImpl(virQEMUDriver *driver,
return -1;
}
if (qemuDomainNamespaceSetupPath(vm, path, NULL) < 0)
return -1;
if (qemuSecurityDomainSetPathLabel(driver, vm, path, true) < 0)
return -1;
} else {