Commit Graph

3995 Commits

Author SHA1 Message Date
Daniel Veillard
e5df24a11c Fix an error when looking for devices in syspath
* src/node_device/node_device_udev.c: udevSetupSystemDev() only print the
  error message if lookup failed in both DMI_DEVPATH and DMI_DEVPATH_FALLBACK
2010-01-21 15:45:44 +01:00
Dan Kenigsberg
ca18b7108d Allow surrounding whitespace in uuid
* src/util/uuid.c: extend virUUIDParse to allow leading and trailing
  spaces in UUIDs
2010-01-21 15:32:37 +01:00
Jim Meyering
2c8eb68969 fix "make distcheck" failure
* tests/Makefile.am (qemuhelpdata): Add qemu-0.12.1.
2010-01-21 15:24:15 +01:00
Jim Meyering
d47b6e54fd avoid more format-related warnings
* src/qemu/qemu_conf.c (qemuBuildDriveStr): Use "%s".
* src/qemu/qemu_monitor_json.c (qemuMonitorJSONGetGuestPCIAddress):
(qemuMonitorJSONGetGuestDriveAddress): Likewise.
2010-01-21 15:12:12 +01:00
Jim Meyering
dfff67c082 avoid format-related warnings
* src/conf/domain_conf.c (virDomainDeviceInfoParseXML): Use "%s".
2010-01-21 15:08:25 +01:00
Daniel P. Berrange
6512d09cf8 Fix off-by-1 in SCSI drive hotplug
The loop looking for the controller associated with a SCI drive had
an off by one, causing it to miss the last controller.

* src/qemu/qemu_driver.c: Fix off-by-1 in searching for SCSI
  drive hotplug
2010-01-21 14:00:17 +00:00
Daniel P. Berrange
e3a0c80f1d Fix leak in hotplug code in QEMU driver
The hotplug code in QEMU was leaking memory because although the
inner device object was being moved into the main virDomainDefPtr
config object, the outer container virDomainDeviceDefPtr was not.

 * src/qemu/qemu_driver.c: Clarify code to show that the inner
   device object is owned by the main domain config upon
   successfull attach.
2010-01-21 14:00:16 +00:00
Daniel P. Berrange
5b6782f941 Add configuration option to turn off dynamic permissions management
Add the ability to turn off dynamic management of file permissions
for libvirt guests.

* qemu/libvirtd_qemu.aug: Support 'dynamic_ownership' flag
* qemu/qemu.conf: Document 'dynamic_ownership' flag.
* qemu/qemu_conf.c: Load 'dynamic_ownership' flag
* qemu/test_libvirtd_qemu.aug: Test 'dynamic_ownership' flag
2010-01-21 14:00:16 +00:00
Daniel P. Berrange
2df1657686 Fix security driver calls in hotplug cleanup paths
The hotplug code was not correctly invoking the security driver
in error paths. If a hotplug attempt failed, the device would
be left with VM permissions applied, rather than restored to the
original permissions. Also, a CDROM media that is ejected was
not restored to original permissions. Finally there was a bogus
call to set hostdev permissions in the hostdev unplug code

* qemu/qemu_driver.c: Fix security driver usage in hotplug/unplug
2010-01-21 14:00:16 +00:00
Daniel P. Berrange
b2a2ba71b4 Add missing call to re-attach host devices if VM startup fails
If there is a problem with VM startup, PCI devices may be left
assigned to pci-stub / pci-back. Adding a call to reattach
host devices in the cleanup path is required.

* qemu/qemu_driver.c: qemuDomainReAttachHostDevices() when
  VM startup fails
2010-01-21 14:00:16 +00:00
Daniel P. Berrange
3812c7b42d Switch QEMU driver over to use the DAC security driver
Remove all the QEMU driver calls for setting file ownership and
process uid/gid. Instead wire in the QEMU DAC security driver,
stacking it ontop of the primary SELinux/AppArmour driver.

* qemu/qemu_driver.c: Switch over to new DAC security driver
2010-01-21 14:00:16 +00:00
Daniel P. Berrange
15f5eaa098 Introduce a new DAC security driver for QEMU
This new security driver is responsible for managing UID/GID changes
to the QEMU process, and any files/disks/devices assigned to it.

* qemu/qemu_conf.h: Add flag for disabling automatic file permission
  changes
* qemu/qemu_security_dac.h, qemu/qemu_security_dac.c: New DAC driver
  for QEMU guests
* Makefile.am: Add new files
2010-01-21 14:00:16 +00:00
Daniel P. Berrange
80fd73ca09 Introduce a stacked security driver impl for QEMU
* qemu/qemu_conf.h: Add securityPrimaryDriver and
  securitySecondaryDriver fields to 'struct qemud_driver'
* Makefile.am: Add new files
* qemu/qemu_security_stacked.c, qemu/qemu_security_stacked.h: A
  simple stacked security driver
2010-01-21 14:00:16 +00:00
Daniel P. Berrange
08fd20b04a Pull initial disk labelling out into libvirtd instead of exec hook
Pulling the disk labelling code out of the exec hook, and into
libvirtd will allow it to access shared state in the daemon. It
will also make debugging & error reporting easier / more reliable.

* qemu/qemu_driver.c: Move initial disk labelling calls up into
  libvirtd. Add cleanup of disk labels upon failure
2010-01-21 14:00:16 +00:00
Daniel P. Berrange
9c48360b1a Fix leak of allocated security label
If a VM fails to start, we can't simply free the security label
strings, we must call the domainReleaseSecurityLabel() method
otherwise the reserved 'mcs' level will be leaked in SElinux

* src/qemu/qemu_driver.c: Invoke domainReleaseSecurityLabel()
  when domain fails to start
2010-01-21 14:00:16 +00:00
Daniel P. Berrange
0c0e0d0263 Refactor setup & cleanup of security labels in security driver
The current security driver architecture has the following
split of logic

 * domainGenSecurityLabel

    Allocate the unique label for the domain about to be started

 * domainGetSecurityLabel

    Retrieve the current live security label for a process

 * domainSetSecurityLabel

    Apply the previously allocated label to the current process
    Setup all disk image / device labelling

 * domainRestoreSecurityLabel

    Restore the original disk image / device labelling.
    Release the unique label for the domain

The 'domainSetSecurityLabel' method is special because it runs
in the context of the child process between the fork + exec.

This is require in order to set the process label. It is not
required in order to label disks/devices though. Having the
disk labelling code run in the child process limits what it
can do.

In particularly libvirtd would like to remember the current
disk image label, and only change shared image labels for the
first VM to start. This requires use & update of global state
in the libvirtd daemon, and thus cannot run in the child
process context.

The solution is to split domainSetSecurityLabel into two parts,
one applies process label, and the other handles disk image
labelling. At the same time domainRestoreSecurityLabel is
similarly split, just so that it matches the style. Thus the
previous 4 methods are replaced by the following 6 new methods

 * domainGenSecurityLabel

    Allocate the unique label for the domain about to be started
    No actual change here.

 * domainReleaseSecurityLabel

   Release the unique label for the domain

 * domainGetSecurityProcessLabel

   Retrieve the current live security label for a process
   Merely renamed for clarity.

 * domainSetSecurityProcessLabel

   Apply the previously allocated label to the current process

 * domainRestoreSecurityAllLabel

    Restore the original disk image / device labelling.

 * domainSetSecurityAllLabel

    Setup all disk image / device labelling

The SELinux and AppArmour drivers are then updated to comply with
this new spec. Notice that the AppArmour driver was actually a
little different. It was creating its profile for the disk image
and device labels in the 'domainGenSecurityLabel' method, where as
the SELinux driver did it in 'domainSetSecurityLabel'. With the
new method split, we can have consistency, with both drivers doing
that in the domainSetSecurityAllLabel method.

NB, the AppArmour changes here haven't been compiled so may not
build.
2010-01-21 14:00:16 +00:00
Daniel P. Berrange
81fbb4cb23 Make security drivers responsible for checking dynamic vs static labelling
The QEMU driver is doing 90% of the calls to check for static vs
dynamic labelling. Except it is forgetting todo so in many places,
in particular hotplug is mistakenly assigning disk labels. Move
all this logic into the security drivers themselves, so the HV
drivers don't have to think about it.

* src/security/security_driver.h: Add virDomainObjPtr parameter
  to virSecurityDomainRestoreHostdevLabel and to
  virSecurityDomainRestoreSavedStateLabel
* src/security/security_selinux.c, src/security/security_apparmor.c:
  Add explicit checks for VIR_DOMAIN_SECLABEL_STATIC and skip all
  chcon() code in those cases
* src/qemu/qemu_driver.c: Remove all checks for VIR_DOMAIN_SECLABEL_STATIC
  or VIR_DOMAIN_SECLABEL_DYNAMIC. Add missing checks for possibly NULL
  driver entry points.
2010-01-21 14:00:16 +00:00
David Allan
6aabcb5bd8 Implement support for multi IQN
Allows the initiator to use a variety of IQNs rather than just the
system IQN when creating iSCSI pools.
* docs/schemas/storagepool.rng: extends the syntax with <iqn name="..."/>
* src/conf/storage_conf.[ch]: read and stores the iqn name
* src/storage/storage_backend_iscsi.[ch]: implement the IQN selection
  when detected
2010-01-21 12:50:52 +01:00
Jiri Denemark
39d883bb3d Let make fail when XHTML validation fails
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2010-01-21 09:45:59 +01:00
Laine Stump
623bc48ad8 Fix uses of virFileMakePath
* src/lxc/lxc_container.c src/lxc/lxc_controller.c src/lxc/lxc_driver.c
  src/network/bridge_driver.c src/qemu/qemu_driver.c
  src/uml/uml_driver.c: virFileMakePath returns 0 for success, or the
  value of errno on failure, so error checking should be to test
  if non-zero, not if lower than 0
2010-01-21 00:52:13 +01:00
Laine Stump
62927dd8f0 Create storage pool directories with proper uid/gid/mode
Previously the uid/gid/mode in the xml was ignored when creating new
storage pool directories. This commit attempts to honor the requested
permissions, and spits out an error if it can't.

Note that when creating the directory, the rest of the path leading up
to the final element is created using current uid/gid/mode, and the
final element gets the settings from xml. It is NOT an error for the
directory to already exist; in this case, the perms for the existing
directory are just set (if necessary).

* src/storage/storage_backend_fs.c: update the virStorageBackendFileSystemBuild
  function to check the directory hierarchy separately then create the
  leaf directory with the right attributes
2010-01-21 00:46:32 +01:00
Laine Stump
e1f2778434 Create storage volumes directly with desired uid/gid
In order to avoid problems trying to chown files that were created by
root on a root-squashing nfs server, fork a new process that setuid's
to the desired uid before creating the file. (It's only done this way
if the pool containing the new volume is of type 'netfs', otherwise
the old method of creating the file followed by chown() is used.)

This changes the semantics of the "create_func" slightly - previously
it was assumed that this function just created the file, then the
caller would chown it to the desired uid. Now, create_func does both
operations.

There are multiple functions that can take on the role of create_func:

createFileDir - previously called mkdir(), now calls virDirCreate().
virStorageBackendCreateRaw - previously called open(),
                             now calls virFileCreate().
virStorageBackendCreateQemuImg - use virRunWithHook() to setuid/gid.
virStorageBackendCreateQcowCreate - same.
virStorageBackendCreateBlockFrom - preserve old behavior (but attempt
                                   chown when necessary even if not root)

* src/storage/storage_backend.[ch] src/storage/storage_backend_disk.c
  src/storage/storage_backend_fs.c src/storage/storage_backend_logical.c
  src/storage/storage_driver.c: change the create_func implementations,
  also propagate the pool information to be able to detect NETFS ones.
2010-01-21 00:41:52 +01:00
Laine Stump
98f6f381c8 New utility functions virFileCreate and virDirCreate
These functions create a new file or directory with the given
uid/gid. If the flag VIR_FILE_CREATE_AS_UID is given, they do this by
forking a new process, calling setuid/setgid in the new process, and
then creating the file. This is better than simply calling open then
fchown, because in the latter case, a root-squashing nfs server would
create the new file as user nobody, then refuse to allow fchown.

If VIR_FILE_CREATE_AS_UID is not specified, the simpler tactic of
creating the file/dir, then chowning is is used. This gives better
results in cases where the parent directory isn't on a root-squashing
NFS server, but doesn't give permission for the specified uid/gid to
create files. (Note that if the fork/setuid method fails to create the
file due to access privileges, the parent process will make a second
attempt using this simpler method.)

If the bit VIR_FILE_CREATE_ALLOW_EXIST is set in the flags, an
existing file/directory will not cause an error; in this case, the
function will simply set the permissions of the file/directory to
those requested. If VIR_FILE_CREATE_ALLOW_EXIST is not specified, an
existing file/directory is considered (and reported as) an error.

Return from both of these functions is 0 on success, or the value of
errno if there was a failure.

* src/util/util.[ch]: add the 2 new util functions
2010-01-21 00:33:43 +01:00
Laine Stump
d2259ada49 Add virRunWithHook util function
* src/util/util.[ch]: similar to virExecWithHook, but waits for child to
  exit. Useful for doing things like setuid after the fork but before the
  exec.
2010-01-21 00:30:36 +01:00
Matthias Bolte
1671b64702 Unset copied environment variables in qemuxml2argvtest
The test expected all environment variables copied in qemudBuildCommandLine
to have known values. So all of them have to be either set to a known value
or be unset. SDL_VIDEODRIVER and QEMU_AUDIO_DRV are not handled at all but
should be handled. Unset both, otherwise the test will fail if they are set
in the testing environment.

* src/qemu/qemu_conf.c: add a comment about copied environment variables
  and qemuxml2argvtest
* tests/qemuxml2argvtest.c: unset SDL_VIDEODRIVER and QEMU_AUDIO_DRV
2010-01-20 23:22:15 +01:00
Matthias Bolte
aef969499f qemu: Don't allocate zero bytes 2010-01-20 22:50:35 +01:00
Jim Meyering
21c84e00d3 clean-up: remove unnecessary closedir call
* src/node_device/node_device_linux_sysfs.c (get_virtual_functions_linux):
Remove unnecessary closedir.  Spotted by Dave Allan.
2010-01-20 21:57:34 +01:00
Jim Meyering
2355fce3ae node_device_linux_sysfs.c: avoid opendir/fd leak on error path
* src/node_device/node_device_linux_sysfs.c(get_virtual_functions_linux):
Don't leak a DIR buffer and file descriptor on error path.
2010-01-20 21:52:51 +01:00
Jim Meyering
1825c6555a domain_conf.c: avoid a leak and the need for "cleanup:" block
* src/conf/domain_conf.c (virDomainChrDefFormat): Plug a leak on
an error path, and at the same time, eliminate the need for a
"cleanup:" block.  Before, the "return -1" after the switch
would leak an "addr" string.  Now, by reversing the port,addr-
getting blocks we can free "addr" immediately and skip the goto.
2010-01-20 21:46:30 +01:00
Daniel P. Berrange
50b6c95d62 Make all bitfields unsigned ints to avoid unexpected values in casts
The 'int virInterfaceIsActive()' method was directly returning the
value of the 'int active:1' bitfield in virIntefaceDefPtr. A bitfield
with a signed integer, will hold the values 0 and -1, not 0 and +1
as might be expected. This meant that virInterfaceIsActive() was
always returning -1 when the interface was active, not +1 & thus all
callers thought an error had occurred. To protect against this kind
of mistake again, change all bitfields to be unsigned ints

* daemon/libvirtd.h, src/conf/domain_conf.h, src/conf/interface_conf.h,
  src/conf/network_conf.h: Change bitfields to unsigned int.
2010-01-20 16:33:02 +00:00
Daniel P. Berrange
ed00e45dba Fix QEMU driver custom domain status XML extensions
Invoking the virConnectGetCapabilities() method causes the QEMU
driver to rebuild its internal capabilities object. Unfortunately
it was forgetting to register the custom domain status XML hooks
again.

To avoid this kind of error in the future, the code which builds
capabilities is refactored into one single method, which can be
called from all locations, ensuring reliable rebuilds.

* src/qemu/qemu_driver.c: Fix rebuilding of capabilities XML and
  guarentee it is always consistent
2010-01-20 16:33:02 +00:00
Jiri Denemark
704bd732b5 Document cpu-compare command in virsh man page
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2010-01-20 16:23:05 +01:00
Jiri Denemark
f0088c1bfa Document <cpu> elements in capabilities and domain XML
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2010-01-20 11:04:01 +01:00
Matthias Bolte
d392f4db9d docs: Remove outdated information about remote limitations 2010-01-20 10:03:17 +01:00
Jim Meyering
eb895e7407 logging: confirm that we want to ignore a write error
* src/util/logging.c (virLogMessage): Include "ignore-value.h".
Use it to ignore the return value of safewrite.
Use STDERR_FILENO, rather than "2".
* bootstrap (modules): Add ignore-value.
* gnulib: Update to latest, for ignore-value that is now LGPLv2+.
2010-01-19 21:28:41 +01:00
Jim Meyering
8cfc4c9a03 xen_driver: don't leak a parsed-config buffer
* src/xen/xen_driver.c (xenUnifiedDomainXMLFromNative): Also
free "conf" before returning.
2010-01-19 21:28:41 +01:00
Laine Stump
77dd67087b Update interface.rng and xml test files to match netcf 0.1.5
The RNG now supports IPv6 and bonds attached to bridges, along with
some other minor tweaks. All test files from netcf have been copied to
the test directory and added to the xml2xml and schema tests (and they
all pass, of course ;-)
2010-01-19 21:13:03 +01:00
Laine Stump
0022995555 Support bond interfaces attached to bridges in interface xml.
This was accomplished in xml parsing by doing away with the
stripped-down virInterfaceBareDef object, and just always using
virInterfaceDef, but with restrictions in certain places (eg, the type
of subordinate interface allowed in parsing depends on the parent
interface).

xml formatting was similarly adjusted. In addition, the formatting
functions keep track of the level of interface nesting, and insert
extra leading spaces on each line accordingly (using %*s).

The only change in formatted xml from previous (aside frmo supporting
new combinations of interface types) is that the subordinate ethernet
interfaces take up 2 lines rather than one, eg:

   <interface type='ethernet' name='eth0'>
   </interface>

instead of:

   <interface type='ethernet' name='eth0'/>
2010-01-19 21:13:03 +01:00
Laine Stump
86304e35a3 Allow empty bridges in interface xml. 2010-01-19 21:13:03 +01:00
Laine Stump
d22591efb9 Support delay property in interface bridge xml. 2010-01-19 21:13:03 +01:00
Jim Meyering
3aa13a471a storage_conf: plug a leak on OOM error path
* src/conf/storage_conf.c (virStoragePoolSourceListNewSource):
Free just-allocated "source" upon VIR_REALLOC_N failure.
2010-01-19 18:19:13 +01:00
Jiri Denemark
4bc3bd7b18 Remove superfluous new lines from messages
I noticed some debug messages are printed with an empty lines after
them. This patch removes these empty lines from all invocations of the
following macros:
    VIR_DEBUG
    VIR_DEBUG0
    VIR_ERROR
    VIR_ERROR0
    VIR_INFO
    VIR_WARN
    VIR_WARN0

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2010-01-19 17:30:41 +01:00
Jiri Denemark
a3e1f04b76 Use pciDeviceIsAssignable in qemu driver
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2010-01-19 17:30:41 +01:00
Jiri Denemark
379eb3956c Tests for ACS in PCIe switches
New pciDeviceIsAssignable() function for checking whether a given PCI
device can be assigned to a guest was added. Currently it only checks
for ACS being enabled on all PCIe switches between root and the PCI
device. In the future, it could be the right place to check whether a
device is unbound or bound to a stub driver.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2010-01-19 17:30:41 +01:00
Daniel Veillard
2c2672bc9a Add Jiri Denemark <jdenemar@redhat.com> to commiters 2010-01-19 14:41:19 +01:00
Jiri Denemark
ce4896fb65 Allow for CPU topology specification without model
Currently CPU topology may only be specified together with CPU model:
    <cpu match='exact'>
        <model>name</model>
        <topology sockets='1' cores='2' threads='3'/>
    </cpu>

This patch allows for CPU topology specification without the need for
also specifying CPU model:
    <cpu>
        <topology sockets='1' cores='2' threads='3'/>
    </cpu>

'match' attribute and 'model' element are made optional with the
restriction that 'match' attribute has to be set when 'model' is
present.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2010-01-19 12:35:22 +01:00
Jiri Denemark
16a4d22b4b Add debug messages for CPU incompatibility
When comparing incompatible CPUs, the reason for this incompatibility is
logged as a debug message.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2010-01-19 12:33:14 +01:00
Jiri Denemark
5e13b7ab5e Take disabled/forced CPU features into account
When comparing x86 CPUs, features with 'disabled' policy were mistakenly
required to be supported by the host CPU.

Likewise, features with 'force' policy which were supported by host CPU
would make CPUs incompatible if 'strict' match was used by guest CPU.

This patch fixes both issues.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2010-01-19 12:29:29 +01:00
Jiri Denemark
5d462bd0b3 Implement CPU topology support for QEMU driver
QEMU's command line equivalent for the following domain XML fragment
    <vcpus>2</vcpus>
    <cpu ...>
        ...
        <topology sockets='1' cores='2', threads='1'/>
    </cpu>

is

    -smp 2,sockets=1,cores=2,threads=1

This syntax was introduced in QEMU-0.12.

Version 2 changes:
- -smp argument build split into a separate function
- always add ",sockets=S,cores=C,threads=T" to -smp if qemu supports it
- use qemuParseCommandLineKeywords for command line parsing

Version 3 changes:
- ADD_ARG_LIT => ADD_ARG and line reordering in qemudBuildCommandLine
- rebased

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2010-01-19 11:40:09 +01:00
Jiri Denemark
014c9f3196 Enhance qemuParseCommandLineKeywords
Current version expects name=value,... list and when an incorrect string
such as "a,b,c=d" would be parsed as "a,b,c" keyword with "d" value
without reporting any error, which is probably not the expected
behavior.

This patch adds an extra argument called allowEmptyValue, which if
non-zero will permit keywords with no value; "a,b=c,,d=" will be parsed
as follows:
    keyword value
    "a"     NULL
    "b"     "c"
    ""      NULL
    "d"     ""

In case allowEmptyValue is zero, the string is required to contain
name=value pairs only; retvalues is guaranteed to contain non-NULL
pointers. Now, "a,b,c=d" will result in an error.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2010-01-19 11:23:03 +01:00