Commit Graph

45022 Commits

Author SHA1 Message Date
Peter Krempa
025555236c docs: formatsnapshot: Move paragraphs describing 'disk' element together
There was another paragraph describing the attribute 'type' of the
'disk' element under the description of the subelements. Move it to the
top to get all relevant information in one place.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 13:16:23 +01:00
Peter Krempa
88525500ed docs: securityprocess: Don't claim that we have maint branches
The 'Branch fixing policy' paragraph claims that we have at least one
actively maintained stable branch which isn't currently the case.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 13:16:23 +01:00
Daniel P. Berrangé
a870801ae1 run: gracefully handle SIGHUP, SIGQUIT, SIGTERM
When using thue 'run' script to launch a daemon, it is intended to
temporarily stop the systemd units and re-start them again after.

When using this script over an SSH connection, it will get SIGHUP
if the connection goes away, and in this case it fails to re-start
the systemd units. We need to catch SIGHUP and turn it into a
normal python exception. For good measure we do the same for
SIGQUIT and SIGTERM too.  SIGINT already gets turned into an
exception by default which we handle.

Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-10 08:06:12 +00:00
Daniel P. Berrangé
a3a40903d9 run: include 'src' in $PATH for the daemons
Currently the 'run' script modifies $PATH to add the 'tools'
directly to pick up client programs. It fails to add the 'src'
directory to pick up the daemons.

Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-10 08:06:08 +00:00
Daniel P. Berrangé
ec8e185cd0 conf: remove misleading comments about access being 'lockless'
For the various structs storing lists of objects, the access
to the hash tables is not lockless. The mutex on the object
owning the hash table must be held.

Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-10 08:05:29 +00:00
Michal Privoznik
79c613ec8a virsh: fflush(stdout) after fputs()
We are not guaranteed that the string we are printing onto stdout
contains '\n' and thus that the stdout is flushed. In fact, I've
met this problem when virsh asked me whether I want to edit the
domain XML again (vshAskReedit()) but the prompt wasn't displayed
(as it does not contain a newline character) and virsh just sat
there waiting for my input, I sat there waiting for virsh's
output. Flush stdout after all fputs()-s  which do not flush
stdout.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 08:57:31 +01:00
Jonathon Jongsma
a5e659f071 qemu: support multiqueue for vdpa net device
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2024406

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
2022-03-09 16:23:02 -06:00
Martin Kletzander
3c052399ea news: Document that we build with musl
A bit of effort by me and Michal helped make this the case, and it helped us
uncover some potential issues.  I am not documenting it as supported or adding
an Alpine container into the CI, but since there were some distribution bugs
mentioning libvirt issues I thing it would be nice of us to notify those
distribution maintainers that read our release news.

Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-09 12:54:21 +01:00
Daniel P. Berrangé
2a95dbd03c nwfilter: drop support for legacy iptables conntrack direction
Long ago we adapted to Linux kernel changes which inverted the
behaviour of the conntrack --ctdir setting:

  commit a6a04ea47a
  Author: Stefan Berger <stefanb@us.ibm.com>
  Date:   Wed May 15 21:02:11 2013 -0400

    nwfilter: check for inverted ctdir

    Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the
    '--ctdir reply' and newer netfilter implementations now expect
    '--ctdir original' instead and vice-versa.
    We check for the kernel version and assume that all Linux kernels with version
    2.6.39 have the newer inverted logic.

    Any distro backporting the Linux kernel patch that inverts the --ctdir logic
    (Linux commit 96120d86f) must also backport this patch for Linux and
    adapt the kernel version being tested for.

    Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>

Given our supported platform targets, we no longer need to
consider a version of Linux before 2.6.39, so can drop
support for the old direction behaviour.

The test suite updates are triggered because that never
probed for the ctdir direction, and so the iptables syntax
generator unconditionally dropped the ctdir args.

Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-09 11:37:32 +00:00
Daniel P. Berrangé
02b8045517 nwfilter: drop support for legacy iptables match syntax
Long ago we adapted to iptables changes by introducing support
for '-m conntrack':

  commit 06844ccbaa
  Author: Stefan Berger <stefanb@us.ibm.com>
  Date:   Tue Aug 6 20:30:46 2013 -0400

    nwfilter: Use -m conntrack rather than -m state

    Since iptables version 1.4.16 '-m state --state NEW' is converted to
    '-m conntrack --ctstate NEW'. Therefore, when encountering this or later
    versions of iptables use '-m conntrack --ctstate'.

Given our supported platform targets, we no longer need to
consider a version of iptables before 1.4.16, so can drop
support for the old syntax.

The test suite updates are triggered because that never
probed for the new syntax, and so unconditionally
generated the old syntax.

Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-09 11:37:12 +00:00
Martin Pitt
7aec69b7fb
apparmor: Fix QEMU access for UEFI variable files
QEMU needs to read, write, and lock the NVRAM *.fd files with UEFI
firmware.

Fixes: https://bugs.debian.org/1006324
Fixes: https://launchpad.net/bugs/1962035

Signed-off-by: Martin Pitt <mpitt@debian.org>
Reviewed-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
2022-03-09 10:50:23 +01:00
Peter Krempa
23ee41152e docs: meson: Restore alphabetical order
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
106b62ebe3 docs: formatsecret: Drop few unneeded empty lines
The examples contain some whitespace and command prompts which just
waste space.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
dc96712099 docs: Convert 'formatsecret' page to rST
Also update the link from 'formatstorageencryption' to the
'usage-type-volume' anchor.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
c6d15e04ae docs: Convert 'drivers' page to rST
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
523f2de82e docs: page.xsl: Update anchor to the 'Code of conduct' paragraph
Use the anchor name as generated by rst2html.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
9f12d96029 docs: Convert 'governance' page to rST
Extra care is taken to preserve the 'codeofconduct' anchor which is used
in our page template. Upcoming patch will change that but we'll retain
the anchor.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
0d379be41b docs: Convert 'securityprocess' page to rST
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
7f3d5914a1 docs: Convert 'support' page to rST
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
3c489dbbe3 docs: Convert 'errors' page to rST
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
ac5c17a2fb docs: Convert 'bugs' page to rST
Special care is given to preserve the 'quality' anchor in the 'bugs'
page as we link to it directly from the gitlab issue template.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
87b2ede00b docs: Convert 'contribute' page to rST
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
127b6d1267 docs: Convert 'strategy' to rST
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
67e0468b94 docs: Convert 'goals' to rST
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
33a751fdc4 docs: formatsnapshot: Convert to 'rst'
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
c30df02ca3 docs: Drop 'devguide' page
The page is not referenced from anywhere and contains dead links for the
output and links to old repos.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Peter Krempa
92ac0f856f docs: Remove 'virshcmdref' page
The page isn't linked from anywhere and the project was archived.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 17:40:47 +01:00
Michal Privoznik
b3ee86d901 libvirt-qemu: Fix capitalization of QEMU
In plenty of places we mention qemu, Qemu but the correct form is
all capitals.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 16:04:24 +01:00
Michal Privoznik
9583b0b7e3 libvirt-qemu: Don't allow NULL cmd in virDomainQemuMonitorCommandWithFiles()
Nothing in daemon code is prepared for the command in
virDomainQemuMonitorCommandWithFiles() to be NULL. In fact, the
client side doesn't expect this either as our RPC describes the
argument as:

    remote_nonnull_string cmd;

Validate the argument in the public API implementation.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-08 16:04:24 +01:00
Daniel P. Berrangé
fd08bf2095 nwfilter: make some gentech driver methods static
The virNWFilterTechDriverForName & virNWFilterUpdateInstantiateFilter
methods are only used within the same source file, so don't need to
be exported.

Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-08 12:19:56 +00:00
Daniel P. Berrangé
d053b8e6cf nwfilter: remove decl of virNWFilterCreateVarHashmap
This method doesn't exist since

  commit d1a7c08eb1
  Author: Daniel P. Berrangé <berrange@redhat.com>
  Date:   Thu Apr 26 12:26:51 2018 +0100

    nwfilter: convert the gentech driver code to use virNWFilterBindingDefPtr

Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-08 12:19:53 +00:00
Daniel P. Berrangé
5f8b090f42 qemu,lxc: remove use to nwfilter update lock
Now that the virNWFilterBinding APIs are using the nwfilter
update lock directly, there is no need for the virt drivers
to do it themselves.

Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-08 12:19:50 +00:00
Daniel P. Berrangé
65dc79f50b nwfilter: hold filter update lock when creating/deleting bindings
The nwfilter update lock is historically acquired by the virt
drivers in order to achieve serialization between nwfilter
define/undefine, and instantiation/teardown of filters.

When running in the modular daemons, however, the mutex that
the virt drivers are locking is in a completely different
process from the mutex that the nwfilter driver is locking.

Serialization is lost and thus call from the virt driver to
virNWFilterBindingCreateXML can deadlock with a concurrent
call to the virNWFilterDefineXML method.

The solution is surprisingly easy, the update lock simply
needs acquiring in the virNWFilterBindingCreateXML method
and virNWFilterBindingUndefine method instead of in the
virt drivers.

The only semantic difference here is that when a virtual
machine has multiple NICs, the instantiation and teardown
of filters is no longer serialized for the whole VM, but
rather for each NIC. This should not be a problem since
the virt drivers already need to cope with tearing down
a partially created VM where only some of the NICs are
setup.

Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-08 12:19:39 +00:00
Jan Kuparinen
34238d7408 Translated using Weblate (Finnish)
Currently translated at 22.9% (2389 of 10404 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/fi/

Co-authored-by: Jan Kuparinen <copper_fin@hotmail.com>
Signed-off-by: Jan Kuparinen <copper_fin@hotmail.com>
2022-03-07 14:28:06 +01:00
Michal Privoznik
09bb46991d meson: Detect newer fuse
Now that we have support for fuse-3 we can detect it during the
configure phase. Even better, we can detect fuse-3 first and
fallback to old fuse only if the newer version doesn't exist.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
d881cefe60 lxc_fuse: Implement support for FUSE3
Plenty of projects switch from FUSE to FUSE3. This commit enables
libvirt to compile with newer fuse-3.1 which allows users to have
just one fuse package on their systems, allows us to set
O_CLOEXEC on the fuse session FD. In general, FUSE3 offers more
features, but apparently we don't need them right now. There is a
rewrite guide at [1] but I've took most inspiration from sshfs
[2].

1: https://github.com/libfuse/libfuse/releases/tag/fuse-3.0.0
2: https://github.com/libfuse/sshfs

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
7664955086 lxc_fuse: Tell FUSE that /proc/meminfo is nonseekable
If an app within a container wishes to read from /proc/meminfo
from a different position than the beginning of the file, we can
have FUSE keep track of all the lseek()-s and reflect them in
@offset argument of read callback (lxcProcRead()). This is done
by setting fuse_file_info::nonseekable. If we don't do this, then
FUSE reports errors back the app that does lseek().

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
3f2454ca0c lxc_fuse: Prefer fuse_file_info::direct_io over mount option
When mounting a FUSE it is possible to bypass kernel cache by
specifying -odirect_io mount option. This is what we currently
do. However, FUSEv3 has a different approach - the open callback
(lxcProcOpen() in our case) can set direct_io member of
fuse_file_info struct. This results in the same behaviour, but
also works with both FUSEv1 and FUSEv3. The latter does not have
the mount option and uses per file approach.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
030faee28d lxcProcReadMeminfo: Fix case when @offset != 0
The idea behind lxcProcReadMeminfo() is that we read the host's
/proc/meminfo and copy it line by line producing the content for
container, changing only those lines we need. Thus, when a
process inside container opens the file and lseek()-s to a
different position (or reads the content in small chunks), we
mirror the seek in host's /proc/meminfo. But this doesn't work
really. We are not guaranteed to end up aligned on the beginning
of new line. It's better if we construct the new content and then
mimic seeking in it.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
2de984a26e lxcProcReadMeminfo: Drop @new_meminfo variable
In the lxcProcReadMeminfo() function we have @buffer variable
which is statically allocated and then @new_meminfo which is just
a pointer to the @buffer. This is needless, the @buffer can be
accessed directly.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
477ae0b868 lxcProcReadMeminfo: Drop needless label
After previous cleanups, the cleanup label is no longer needed
and can be removed.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
8b36a2574f lxc_fuse: Use automatic file closing
There are two functions (lxcProcHostRead() and
lxcProcReadMeminfo()) that could benefit from automatic file
closing.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
d68a8b2109 lxcProcReadMeminfo: Rename @fd to @fp
In lxcProcReadMeminfo() there's a variable named @fd which would
suggest it's type of int, but in fact it's type of FILE *. Rename
it to @fp to avoid confusion.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
c7171f937e lxcSetupFuse: Cleanup error paths
In the lxcSetupFuse() function there are multiple cleanup labels,
but with a bit of rewrite they can be joined into one 'error'
label. And while at it, set the @f argument only in the
successful path (currently is set in error case too).

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
320efa9572 lxc_fuse: Prefer O_ACCMODE instead of & 3
In lxcProcOpen() we want to check whether the /proc/memfile is
being opened only for read. For that we check the fi->flags which
correspond to flags open() call. Instead of explicitly masking
the last two bits use O_ACCMODE constant, which is deemed to be
more portable.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
82e0f18b85 lxc_fuse.c: Modernize function declarations
Our style of writing function declarations has changed since the
time the file was introduced. Fix the whole file.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
fd8c3ad50a lxc_fuse: Drop some G_GNUC_UNUSED attributes
There are few arguments that are marked as G_GNUC_UNUSED even
though they are clearly used within their respective functions.
Drop the annotation in such cases.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
2543cdf982 lxc_fuse: Move #include <fuse.h>
There is no need to include the fuse.h from the header file.
Move the include into the lxc_fuse.c then.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
cc0c775b62 lxc_fuse.h: Don't include lxc_conf.h
Nothing in the lxc_fuse.h header file warrants inclusion of
lxc_conf.h. If anything, virconftypes.h must be included because
of virDomainDef required by lxcSetupFuse().

It's actually lxc_fuse.c that requires some macros from
lxc_fuse.h (e.g. LXC_STATE_DIR).

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00
Michal Privoznik
2cbe2f0960 lxc_fuse: Move virLXCMeminfo struct into lxc_cgroup.h
The function that fills virLXCMeminfo struct
(virLXCCgroupGetMeminfo()) lives in lxc_cgroup.h. Move the struct
there too.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-07 14:01:48 +01:00