Commit Graph

222 Commits

Author SHA1 Message Date
Eric Blake
973ada0e0b build: skip vmware driver when building for RHEL
* libvirt.spec.in: Provide vmware conditionals.
2010-12-21 10:13:50 -07:00
Dan Kenigsberg
91b3e1038f spec: do not start libvirt-guests if that service is off
starting a service during rpm installation is impolite. It is even worse if done
during upgrade, for a service that was explicitly turned off.
2010-12-09 16:55:48 -07:00
Daniel Veillard
a33db6cbfb Release of libvirt 0.8.6
- configure.ac libvirt.spec.in: bump version, add a missing systemtap
  build requirement
- docs/news.html.in: add informations about the release
- po/*: updated Polish and Dutch localizations, and regenerated
- tests/qemuxml2argvtest.c: Fix build problem
2010-11-30 20:42:46 +01:00
Cole Robinson
34d8ca2b7e rpm: Fix summary wording 2010-11-12 10:07:33 -05:00
Eric Blake
f970d802ab rpm: fix /var/lib/libvirt permissions
https://bugzilla.redhat.com/show_bug.cgi?id=649511

Regression of forcing 0700 permissions (which breaks guest startup
because the qemu user can't see /var/lib/libvirt/*.monitor) was
introduced in commit 66823690e, as part of libvirt 0.8.2.

* libvirt.spec.in (%files): Drop %{_localstatedir}/lib/libvirt,
since libvirt depends on libvirt-client.
(%files client): Guarantee 755 permissions on
%(_localstatedir}/lib/libvirt, since the qemu user must be able to
do pathname resolution to a subdirectory.
2010-11-10 09:00:47 -07:00
Matthias Bolte
e65812d479 xen-proxy: Remove it entirely and use libvirtd instead
Suggested by danpb, as it's not up-to-date anymore and
lacks many functions that were added to libvirtd.
2010-11-08 22:00:35 +01:00
Daniel Veillard
4c2b3e1d29 Release of libvirt-0.8.5
* configure.ac libvirt.spec.in: new version
* docs/news.html.in: update news page and improve format
* po/*.po*: Update po again
2010-10-29 16:54:07 +02:00
Daniel P. Berrange
968eb4e5cd Add dtrace static probes in libvirtd
Adds initial support for dtrace static probes in libvirtd
daemon, assuming use of systemtap dtrace compat shim on
Linux. The probes are inserted for network client connect,
disconnect, TLS handshake states and authentication protocol
states.

This can be tested by running the xample program and then
attempting to connect with any libvirt client (virsh,
virt-manager, etc).

 # stap examples/systemtap/client.stp
  Client fd=44 connected readonly=0
  Client fd=44 auth polkit deny pid:24997,uid:500
  Client fd=44 disconnected
  Client fd=46 connected readonly=1
  Client fd=46 auth sasl allow test
  Client fd=46 disconnected

The libvirtd.stp file should also really not be required,
since it is duplicated info that is already available in
the main probes.d definition file. A script to autogenerate
the .stp file is needed, either in libvirtd tree, or better
as part of systemtap itself.

* Makefile.am: Add examples/systemtap subdir
* autobuild.sh: Disable dtrace for mingw32
* configure.ac: Add check for dtrace
* daemon/.gitignore: Ignore generated dtrace probe file
* daemon/Makefile.am: Build dtrace probe header & object
  files
* daemon/libvirtd.stp: SystemTAP convenience probeset
* daemon/libvirtd.c: Add connect/disconnect & TLS probes
* daemon/remote.c: Add SASL and PolicyKit auth probes
* daemon/probes.d: Master probe definition
* daemon/libvirtd.h: Add convenience macro for probes
  so that compilation is a no-op when dtrace is not available
* examples/systemtap/Makefile.am, examples/systemtap/client.stp
  Example systemtap script using dtrace probe markers
* libvirt.spec.in: Enable dtrace on F13/RHEL6
* mingw32-libvirt.spec.in: Force disable dtrace
2010-10-22 12:00:39 +01:00
Daniel P. Berrange
8f680ad3b8 Basic framework for auditing integration
Integrate with libaudit.so for auditing of important operations.
libvirtd gains a couple of config entries for auditing. By
default it will enable auditing, if its enabled on the host.
It can be configured to force exit if auditing is disabled
on the host. It will can also send audit messages via libvirt
internal logging API

Places requiring audit reporting can use the VIR_AUDIT
macro to report data. This is a no-op unless auditing is
enabled

* autobuild.sh, mingw32-libvirt.spec.in: Disable audit
  on mingw
* configure.ac: Add check for libaudit
* daemon/libvirtd.aug, daemon/libvirtd.conf,
  daemon/test_libvirtd.aug, daemon/libvirtd.c: Add config
  options to enable auditing
* include/libvirt/virterror.h, src/util/virterror.c: Add
  VIR_FROM_AUDIT source
* libvirt.spec.in: Enable audit
* src/util/virtaudit.h, src/util/virtaudit.c: Simple internal
  API for auditing messages
2010-10-19 17:31:31 +01:00
Dan Kenigsberg
0df552cd37 qemu: let qemu group look below /var/lib/libvirt/qemu/
Vdsm needs to communicate with its guest agent via unix domain socket,
which qemu creates due to the following domain xml device:

    <channel type='unix'>
      <target type='virtio' name='com.redhat.rhevm.vdsm'/>
      <source mode='bind' path='/var/lib/libvirt/qemu/channels/fcp-xp-1.com.redhat.rhevm.vdsm'/>
    </channel>

The location of the socket below /var/lib/libvirt/qemu/channels makes
sense, to humans and selinux policy alike. However, that socket should
be accessible to vdsm, too.

Due to other (storage) reasons, vdsm is to join the "qemu" group. With
this patch, vdsm can look below /var/lib/libvirt/qemu and connect to the
socket.

The socket itself should be chmod'ed to allow qemu group read/write, but
that's for another project.

BZ#643407
2010-10-18 10:23:03 -06:00
Eric Blake
e3e31303d5 build: skip xenapi driver when building for RHEL
https://bugzilla.redhat.com/show_bug.cgi?id=643118

* libvirt.spec.in: Provide xenapi conditionals.
2010-10-15 07:31:36 -06:00
Daniel Veillard
9a8e152fef Libvirt release 0.8.4
update news, spec and french localizaton
2010-09-10 17:24:36 +02:00
Jiri Denemark
ad026e97bf build: Fix permissions of sysconfig files 2010-09-07 10:03:14 +02:00
Jiri Denemark
5cb7316372 spec: Fix undefined with_libnl
When building libvirt RPM without macvtap, with_libnl would be
undefined.
2010-08-25 12:28:02 +02:00
Jiri Denemark
e26672f786 bridge: Add --dhcp-no-override option to dnsmasq
--dhcp-no-override description from dnsmasq man page:

      Disable  re-use  of  the  DHCP servername and filename fields as
      extra option space. If it can, dnsmasq moves the boot server and
      filename  information  (from  dhcp-boot)  out of their dedicated
      fields into DHCP options. This make extra space available in the
      DHCP  packet  for options but can, rarely, confuse old or broken
      clients. This flag forces "simple and safe" behaviour  to  avoid
      problems in such a case.

It seems some virtual network card ROMs are this old/buggy so let's add
--dhcp-no-override as a workaround for them. We don't use extra DHCP
options so this should be safe. The option was added in dnsmasq-2.41,
which becomes the minimum required version.
2010-08-12 16:38:19 +02:00
Daniel Veillard
d3d33c8281 Release of libvirt-0.8.3
* configure.ac docs/news.html.in libvirt.spec.in: updates
* po/*.po*: update and regenerated
2010-08-04 15:03:25 +02:00
Justin Clift
de7d4c6ae7 man pages: update authors and copyright notice for libvirtd and virsh
This patch removes the individual author names from the libvirtd and virsh
man pages, instead referring to the main AUTHORS file distributed with
libvirt.  This approach is needed, as we can't guarantee unicode support
across all versions of pod2man used with libvirt.

Additionally, this patch includes the libvirtd man page in the spec file
used with "make rpm".  Without this patch "make rpm" is broken.
2010-07-17 04:51:01 +10:00
Matthias Bolte
9af989fabc Add openauth example to demonstrate a custom auth callback 2010-07-13 13:50:27 +02:00
Daniel Veillard
6f8e223780 Release of libvirt-0.8.2
- configure.ac docs/news.html.in libvirt.spec.in: updated
- po/*/o* : updated or.po and regenerated
2010-07-05 17:29:25 +02:00
Jiri Denemark
1a5c465ee5 Fix libvirt-guests init script
Firstly, the init script has to touch its file under /var/lock/subsys
when started, otherwise the system would think it's not running and
won't stop it during shutdown.

Secondly, for some reason there is a policy to automatically enable
init scripts when they are installed, so let the specfile do this. We
also need to start the init script to ensure it will be stopped during
the first shutdown after installing the package.

Also $LISTFILE should be enclosed by quotes everywhere as suggested by
Eric.
2010-05-28 18:00:53 +02:00
Matthias Bolte
fa0bb9f6b1 Use printf instead of echo -e in libvirt.spec.in
make rpm created dummy tests containing '-e #!/bin/sh' for me.
2010-05-27 01:11:15 +02:00
Matthias Bolte
5ac0272370 Install, distribute and package domainsnapshot.rng 2010-05-27 01:11:15 +02:00
Stefan Berger
a34871d9a5 vepa+vsi: Introduce dependency on libnl
This patch introduces a dependency on libnl, which subsequent patches
will then use.

Changes from V1 to V2:
- added diffstats
- following changes in tree
2010-05-25 15:31:38 -04:00
Jiri Denemark
66823690e4 Init script for handling guests on shutdown/boot
Example output during shutdown:

Running guests on default URI: console, rhel6-1, rhel5-64
Running guests on lxc:/// URI: lxc-shell
Running guests on xen:/// URI: error: no hypervisor driver available for xen:///
error: failed to connect to the hypervisor
Running guests on vbox+tcp://orkuz/system URI: no running guests.
Suspending guests on default URI...
Suspending console: done
Suspending rhel6-1: done
Suspending rhel5-64: done
Suspending guests on lxc:/// URI...
Suspending lxc-shell: error: Failed to save domain 9cba8bfb-56f4-6589-2d12-8a58c886dd3b state
error: this function is not supported by the hypervisor: virDomainManagedSave

Note, the "Suspending $guest: " shows progress during the suspend phase
if domjobinfo gives meaningful output.

Example output during boot:

Resuming guests on default URI...
Resuming guest rhel6-1: done
Resuming guest rhel5-64: done
Resuming guest console: done
Resuming guests on lxc:/// URI...
Resuming guest lxc-shell: already active

Configuration used for generating the examples above:
URIS='default lxc:/// xen:/// vbox+tcp://orkuz/system'

The script uses /var/lib/libvirt/libvirt-guests files to note all active
guest it should try to resume on next boot. It's content looks like:

default 7f8b9d93-30e1-f0b9-47a7-cb408482654b 085b4c95-5da2-e8e1-712f-6ea6a4156af2 fb4d8360-5305-df3a-2da1-07d682891b8c
lxc:/// 9cba8bfb-56f4-6589-2d12-8a58c886dd3b
2010-05-21 09:33:30 +02:00
Stefan Berger
beccb0deca rpmbuild: add ebtables & ip(6)tables dependency for rpm
Add ebtables,iptables & iptables-ipv6 dependency to rpm.

Changes from V1 to V2:
  -passing --without-libpcap to configure script, if libpcap is not to be used
2010-05-05 12:20:28 -04:00
Daniel Veillard
7efa3937f0 Various fixes for the spec file
This includes various things:
 - fix the Requires: libvirt-client to use %{name} to allow easy
   renaming
 - when building ESX support one need libcurl-devel
 - remove Makefile[.in] from xml/nwfilter in the docs, as this breaks
   parallel install ation of i686 and x86_64 packages
 - don't include nwfilter config files if not building with the daemon
all relatively trivial which is why I packed them together
* libvirt.spec.in: fix various small bugs
2010-05-04 16:13:55 +02:00
Daniel Veillard
5d65d32f2c Release of libvirt-0.8.1
* configure.ac docs/news.html.in libvirt.spec.in: updates for release
* po/*.po*: updated localizations and regenerated
2010-04-30 18:55:08 +02:00
Daniel Veillard
4e041189f8 Move dnsmasq host file to a separate directory
use /var/lib/libvirt/dnsmasq since /var/lib/libvirt/network is
unreadable by the dnsmasq binary

* src/network/bridge_driver.c: update DNSMASQ_STATE_DIR
* src/Makefile.am: create it on make install
* libvirt.spec.in: take the new directory into account
2010-04-28 15:53:09 +02:00
Daniel P. Berrange
f6770e8665 Run test suite as part of RPM build process
To ensure that patches in the RPM don't break any functionality
it is neccessary to run the test suites during build. It currently
has 3 tests disabled

 - daemon-conf: this is totally broken, since it relies on
   being able to resolve the 'libvirt' group & being able to
   resolve hostnames at daemon startup. This isn't possible
   in a mock build root
 - seclabeltest: fails to initialize selinux in the mock
   build root. Possibly fixable
 - nodeinfotest: broken on s390 + ppc - this is a real bug

* libvirt.spec.in: Add a %check section, with 3 tests
   temporarily disabled
2010-04-15 17:56:06 +01:00
Daniel Berteaud
505242f817 Fix spec file for builds without lxc
* libvirt.spec.in: fix a cut and paste error
2010-04-13 10:40:21 +02:00
Daniel Veillard
bfcca58787 Release of libvirt-0.8.0
* configure.ac docs/news.html.in libvirt.spec.in src/libvirt_public.syms:
  updates for release of 0.8.0
* po/*.po po/libvirt.pot: updated a lar set of localizations, and merge
  the messages
2010-04-12 19:39:20 +02:00
Stefan Berger
3bf24abc8c nwfilter: Support for learning a VM's IP address
This patch implements support for learning a VM's IP address. It uses
the pcap library to listen on the VM's backend network interface (tap)
or the physical ethernet device (macvtap) and tries to capture packets
with source or destination MAC address of the VM and learn from DHCP
Offers, ARP traffic, or first-sent IPv4 packet what the IP address of
the VM's interface is. This then allows to instantiate the network
traffic filtering rules without the user having to provide the IP
parameter somewhere in the filter description or in the interface
description as a parameter. This only supports to detect the parameter
IP, which is for the assumed single IPv4 address of a VM. There is not
support for interfaces that may have multiple  IP addresses (IP
aliasing) or IPv6 that may then require more than one valid IP address
to be detected. A VM can have multiple independent interfaces that each
uses a different IP address and in that case it will be attempted to
detect each one of the address independently.

So, when for example an interface description in the domain XML has
looked like this up to now:

    <interface type='bridge'>
      <source bridge='mybridge'/>
      <model type='virtio'/>
      <filterref filter='clean-traffic'>
        <parameter name='IP' value='10.2.3.4'/>
      </filterref>
    </interface>

you may omit the IP parameter:

    <interface type='bridge'>
      <source bridge='mybridge'/>
      <model type='virtio'/>
      <filterref filter='clean-traffic'/>
    </interface>

Internally I am walking the 'tree' of a VM's referenced network filters
and determine with the given variables which variables are missing. Now,
the above IP parameter may be missing and this causes a libvirt-internal
thread to be started that uses the pcap library's API to listen to the
backend interface  (in case of macvtap to the physical interface) in an
attempt to determine the missing IP parameter. If the backend interface
disappears the thread terminates assuming the VM was brought down. In
case of a macvtap device a timeout is being used to wait for packets
from the given VM (filtering by VM's interface MAC address). If the VM's
macvtap device disappeared the thread also terminates. In all other
cases it tries to determine the IP address of the VM and will then apply
the rules late on the given interface, which would have happened
immediately if the IP parameter had been explicitly given. In case an
error happens while the firewall rules are applied, the VM's backend
interface is 'down'ed preventing it to communicate. Reasons for failure
for applying the network firewall rules may that an ebtables/iptables
command failes or OOM errors. Essentially the same failure reasons may
occur as when the firewall rules are applied immediately on VM start,
except that due to the late application of the filtering rules the VM
now is already running and cannot be hindered anymore from starting.
Bringing down the whole VM would probably be considered too drastic.
While a VM's IP address is attempted to be determined only limited
updates to network filters are allowed. In particular it is prevented
that filters are modified in such a way that they would introduce new
variables.

A caveat: The algorithm does not know which one is the appropriate IP
address of a VM. If the VM spoofs an IP address in its first ARP traffic
or IPv4 packets its filtering rules will be instantiated for this IP
address, thus 'locking' it to the found IP address. So, it's still
'safer' to explicitly provide the IP address of a VM's interface in the
filter description if it is known beforehand.

* configure.ac: detect libpcap
* libvirt.spec.in: require libpcap[-devel] if qemu is built
* src/internal.h: add the new ATTRIBUTE_PACKED define
* src/Makefile.am src/libvirt_private.syms: add the new modules and symbols
* src/nwfilter/nwfilter_learnipaddr.[ch]: new module being added
* src/nwfilter/nwfilter_driver.c src/conf/nwfilter_conf.[ch]
  src/nwfilter/nwfilter_ebiptables_driver.[ch]
  src/nwfilter/nwfilter_gentech_driver.[ch]: plu the new functionality in
* tests/nwfilterxml2xmltest: extend testing
2010-04-07 23:12:21 +02:00
Stefan Berger
8cf0ed02be nwfilter: Add filter schema for nwfilter XML, extend domain XML schema
This patch adds a relaxng nwfilter schema along with a test that
verifies all the test output XML against the schema. The input XMLs
contain a lot of intentional out-of-range values that make them fail the
schema verification, so I am not verifying against those.
2010-04-06 11:09:46 -04:00
Eric Blake
a792bf240f build: more fallout from test -a
* cfg.mk (sc_prohibit_test_minus_ao): Also check for [.
* docs/Makefile.am (%.html, html/index.html): Avoid non-portable
test usage.
* libvirt.spec.in (%post): Likewise.
* tools/virt-pki-validate.in (servercert.pem): Likewise.
* configure.ac (LOGNAME): Use test, not [, in files processed by
autoconf.
Detected by Matthias Bolte.
2010-03-31 15:18:13 -06:00
Daniel Veillard
b4b0949dd7 Distribute nwfilter xml files and add them to rpm
* examples/xml/nwfilter/Makefile.am: add all xml to the distribution
* libvirt.spec.in: reference them from the rpm spec file to have them
  available in the main libvirt package
2010-03-31 10:20:22 +02:00
Daniel Veillard
e7d29e234c Fix logroate rpm build breakage
related to fix of bug https://bugzilla.redhat.com/show_bug.cgi?id=547514
2010-03-18 13:50:08 +01:00
Daniel Veillard
89bf843a6d Change logrotate to be per-hypervisor logs
Having a single logrotate configuration file for all hypervisors
did not work as logrotate would get confused if an hypervisor not
supported on that platform was still listed. Simplest is to split
the logrotate as separate per hypervisor files and change the
spec file to only install the ones compiled in.
* daemon/libvirtd.lxc.logrotate.in daemon/libvirtd.qemu.logrotate.in
  daemon/libvirtd.uml.logrotate.in: copy and split the original
  daemon/libvirtd.logrotate.in file
* daemon/Makefile.am: update to support the different files and
  cleanup in sed suggested by Eric Blake
* libvirt.spec.in: only install the relevant logrotate configs
* daemon/.gitignore: update logrotate generated list
2010-03-10 11:27:02 +01:00
Daniel Veillard
703c165188 Release of libvirt-0.7.7
* configure.ac libvirt.spec.in: update with new version
* docs/news.html.in: add list of changes in 0.7.7
* po/*po*: updated spanish and russian localisations, rebuilt
2010-03-05 17:10:21 +01:00
David Allan
b2111ba3cd Revert fs pool formatting
* We are reverting this patch pending a discussion of the right way to implement.
2010-02-26 03:33:27 -05:00
Dave Allan
b738016b78 Format FS pools on creation
Create the filesystem on the partition used by the pool
* configure.ac: check for mkfs availability
* libvirt.spec.in: add extra require on util-linux for mkfs
* src/storage/storage_backend_fs.c: run mkfs with the expected
  fs type when creating a filesystem pool
2010-02-24 09:51:34 +01:00
Daniel Veillard
31a5ee922a Release of libvirt-0.7.6
* configure.ac docs/news.html.in libvirt.spec.in: version bump and doc
  updates
* po/*.po*: updated and regenerated the localizations
2010-02-03 18:16:25 +01:00
Daniel Veillard
3f24ae2eb9 Release of libvirt-0.7.5 2009-12-23 17:00:22 +01:00
Jiri Denemark
79fa4a98d1 Move cpu_map.xml to -client RPM
All the cpu code is part of libvirt library and it might be used by
drivers which do not require libvirtd to be running.
2009-12-23 14:28:42 +01:00
Jiri Denemark
ab007c3da0 Add cpu_map.xml to libvirt.spec
* libvirt.spec.in: embbed it in the main libvirt binary rpm
2009-12-22 12:09:56 +01:00
Mark McLoughlin
3b3305d859 remove all traces of lokkit support
Long ago we tried to use Fedora's lokkit utility in order to register
our iptables rules so that 'service iptables restart' would
automatically load our rules.

There was one fatal flaw - if the user had configured iptables without
lokkit, then we would clobber that configuration by running lokkit.

We quickly disabled lokkit support, but never removed it. Let's do
that now.

The 'my virtual network stops working when I restart iptables' still
remains. For all the background on this saga, see:

  https://bugzilla.redhat.com/227011

* src/util/iptables.c: remove lokkit support

* configure.in: remove --enable-lokkit

* libvirt.spec.in: remove the dirs used only for saving rules for lokkit

* src/Makefile.am: ditto

* src/libvirt_private.syms, src/network/bridge_driver.c,
  src/util/iptables.h: remove references to iptablesSaveRules
2009-12-10 11:27:17 +00:00
Daniel P. Berrange
9428f2ced6 Introduce a simple API for handling JSON data
This introduces simple API for handling JSON data. There is
an internal data structure 'virJSONValuePtr' which stores a
arbitrary nested JSON value (number, string, array, object,
nul, etc).  There are APIs for constructing/querying objects
and APIs for parsing/formatting string formatted JSON data.

This uses the YAJL library for parsing/formatting from

 http://lloyd.github.com/yajl/

* src/util/json.h, src/util/json.c: Data structures and APIs
  for representing JSON data, and parsing/formatting it
* configure.in: Add check for yajl library
* libvirt.spec.in: Add build requires for yajl
* src/Makefile.am: Add json.c/h
* src/libvirt_private.syms: Export JSON symbols to drivers
2009-12-07 14:14:36 +00:00
Daniel Veillard
040e80f7e6 Release of libvirt-0.7.4
0.7.3 was broken

* configure.in docs/news.html.in: release of 0.7.4
* configure.in libvirt.spec.in: require netcf >= 0.1.4
* src/Makefile.am: node_device/node_device_udev.h was missing from
  NODE_DEVICE_DRIVER_UDEV_SOURCES breaking compilation on platforms with
  udev
2009-11-20 19:43:59 +01:00
Daniel Veillard
b8d4b6bec9 Release of libvirt-0.7.3
* configure.in docs/news.html.in libvirt.spec.in: describe new release
* po/*.po*: regenerate
2009-11-20 17:31:13 +01:00
Daniel P. Berrange
4811fab790 Enable udev instead of hal on F12 / RHEL-6 or later
HAL has been deprecated since F12 and RHEL-6, so if building on
these platforms, switch on the udev driver instead

* libvirt.spec.in: Activate udev on F12/RHEL6
2009-11-20 16:45:46 +01:00
Daniel P. Berrange
3c3dffc285 Exclude numactl on s390[x]
The numactl package is not applicable for s390[x] arches, so do
not enable it as a build dep.

* libvirt.spec.in: Exclude numactl on s390[x]
2009-11-12 11:17:29 +00:00