Commit Graph

42410 Commits

Author SHA1 Message Date
zhangjl02
7c07b48942 virDomain: interface: add virNetDevOpenvswitchInterfaceSetQos and virNetDevOpenvswitchInterfaceClearQos
Introduce qos setting and cleaning method. Use ovs command to set qos
parameters on specific interface of qemu virtual machine.

When an ovs port is created, we add 'ifname' to external-ids. When setting
qos on an ovs port, query its qos and queue. If found, change qos on queried
queue and qos, otherwise create new queue and qos. When cleaning qos, query
and clean queues and qos in ovs table record by 'ifname' and 'vmid'.

Signed-off-by: Jinsheng Zhang <zhangjl02@inspur.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2021-07-12 09:40:13 +02:00
zhangjl02
b9cbf5587e virDomain: interface: add virDomainNetDefIsOvsport
Tell whether a port definition is an ovs managed virtual port

Signed-off-by: Jinsheng Zhang <zhangjl02@inspur.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2021-07-12 09:40:13 +02:00
Daniel P. Berrangé
11fcf054e6 qemu: remove default audio backend for migratable XML
When seeing a guest with a sound device, and no audio backend, we
automatically add an audio backend XML element based on the historical
QEMU driver behaviour. Unfortunately when we live migrate back to an
old libvirt, it may not understand the audio driver type we configured.
We thus need to strip the default audio backend when migrating.

Fixes https://gitlab.com/libvirt/libvirt/-/issues/179
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2021-07-09 13:15:13 +01:00
Roman Bolshakov
91f696a6a4 lib: Specify domain redefinition requirements
There might be misunderstanding [1] when libvirt permits domain
redefinition and if it's a valid case at all.

1. b973d7c4b4/plugins/modules/virt.py (L533)

Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2021-07-09 12:11:29 +02:00
Michal Privoznik
c159db4cc0 vircgroup: Improve virCgroupControllerAvailable wrt to CGroupsV2
It all started as a simple bug: trying to move domain memory
between NUMA nodes (e.g. via virsh numatune) did not work. I've
traced the problem to qemuProcessHook() because that's where we
decide whether to rely on CGroups or use numactl APIs to satisfy
<numatune/>. The problem was that virCgroupControllerAvailable()
was telling us that cpuset controller is unavailable. This is
CGroupsV2, and pretty weird because CGroupsV2 definitely do
support cpuset controller and I had them mounted in a standard
way. What I found out (with Pavel's help) was that
virCgroupNewSelf() was looking into the following path to detect
supported controllers:

  /sys/fs/cgroup/system.slice/cgroup.controllers

However, if there's no other VM running then the system.slice
only has 'memory' and 'pids' controllers. Therefore, we saw
'cpuset' as not available. The fix is to look at the top most
path, which has the full set of controllers:

  /sys/fs/cgroup/cgroup.controllers

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1976690
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2021-07-09 09:05:08 +02:00
Michal Privoznik
12f96b0611 schemas: Allow cache attribute for bandwidth element for HMAT
Turns out, when introducing HMAT support in v6.6.0-rc1~249
I've forgot to allow "cache" attribute for <bandwidth/> element
in RNG. It's parsed and formatted, but schema does not allow it.

Fixes: a89bbbac86
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1980162
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2021-07-08 16:28:30 +02:00
Jim Fehlig
de1e0ae0e3 virtlockd: Don't report error if lockspace exists
When the qemu or libxl driver is configured to use lockd and
file_lockspace_dir is set, virtlockd emits an error when libvirtd
is retarted

May 25 15:44:31 virt81 virtlockd[7723]: Requested operation is not
valid: Lockspace for path /data/libvirtd/lockspace already exists

There is really no need to fail when the lockspace already exists,
paricularly since the user is expected to create the lockspace
specified in file_lockspace_dir. Failure to do so will prevent
starting any domains

virsh start test
error: Failed to start domain 'test'
error: Unable to open/create resource /data/libvirtd/lockspace/de22c4bf931e7c48b49e8ca64b477d44e78a51543e534df488b05ccd08ec5caa: No such file or directory

Also, virLockManagerLockDaemonSetupLockspace already has logic to ignore
the error. Since callers are not interested in the error, change
virtlockd to not report or return an error when the specified lockspace
already exists.

Signed-off-by: Jim Fehlig <jfehlig@suse.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2021-07-07 09:40:38 -06:00
Michal Privoznik
c6d7b9a261 qemu: Don't use memory-backend-memfd for NVDIMMs
If guest is configured to use memfd then the function that build
memory-backend-* part of command line will put
memory-backend-memfd, always. Even for NVDIMMs. This is not
correct, because NVDIMMs need a backing path (usually to a real
host NVDIMM device). Therefore, regardless of memfd being
requested, we have to stick with memory-backend-file.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2021-07-07 16:25:03 +02:00
Michal Privoznik
cda47bac25 virDomainMachineNameAppendValid: Handle special characters better
When constructing guest name for machined we have to be very
cautious as machined expects a name that's basically a valid URI.
Therefore, if there's a dot it has to be followed by a letter or
a number. And if there's a sequence of two or more dashes they
should be joined into a single dash. These rules are implemented
in virDomainMachineNameAppendValid(). There's the @skip variable
which is supposed to track whether it is safe to append a dot or
a dash into name. However, the variable is set to false (meaning
it is safe to append a dot or a dash) even if the current
character we are processing is not in the set of allowed
characters (and thus skipped over).

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1948433
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2021-07-07 16:23:37 +02:00
Vinayak Kale
a9c7da6126 virresctrl: Fix updating the mask for a cache resource
In 'virResctrlAllocUpdateMask', mask is updated only if 'previous mask' is NULL.

By default, the bitmask for a cache resource for a VM is initialized with
'default-resctrl-group' bitmask. So the 'previous mask' would not be NULL and
mask won't get updated if cachetune is configured for a VM. This causes libvirt
to use same bitmask as 'default-resctrl-group' bitmask for a cache resource for
a VM. This patch fixes the issue.

Fixes: d8a354954a

Signed-off-by: Vinayak Kale <vkale@nvidia.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2021-07-07 16:19:40 +02:00
Tim Wiederhake
6bda1eb157 virDomainSEVDefParseXML: Remove superfluous variable initialization
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2021-07-07 15:34:12 +02:00
Tim Wiederhake
3994a36ec7 virDomainSEVDefParseXML: Remove superfluous gotos
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2021-07-07 15:34:12 +02:00
Tim Wiederhake
6cc25a6bc6 virDomainSEVDefParseXML: Use automatic memory management
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2021-07-07 15:34:12 +02:00
Tim Wiederhake
42c0c7275d virDomainSEVDefParseXML: Use virXMLPropEnum
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2021-07-07 15:34:11 +02:00
Tim Wiederhake
d09a191f62 conf: virDomainSEVDef: Change type of "sectype" to virDomainLaunchSecurity
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2021-07-07 15:34:11 +02:00
Tim Wiederhake
b765bc05a0 conf: Add AUTOPTR_CLEANUP_FUNC for virDomainSEVDef
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2021-07-07 15:34:11 +02:00
Pavel Hrdina
988beaf1d0 meson: check for XDR and driver_remote early
We have several other options that depend on result of `driver_remote`
option check so we need to do it early to have the result available.

Fixes: https://gitlab.com/libvirt/libvirt/-/issues/185
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2021-07-07 15:25:11 +02:00
Didik Supriadi
094671b1e7 Translated using Weblate (Indonesian)
Currently translated at 3.1% (326 of 10342 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/id/

Co-authored-by: Didik Supriadi <didiksupriadi41@gmail.com>
Signed-off-by: Didik Supriadi <didiksupriadi41@gmail.com>
2021-07-06 18:04:27 +02:00
simmon
450761d7e3 Translated using Weblate (Korean)
Currently translated at 45.0% (4655 of 10342 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/ko/

Co-authored-by: simmon <simmon@nplob.com>
Signed-off-by: simmon <simmon@nplob.com>
2021-07-06 18:04:26 +02:00
Ricky Tigg
9bc8ac2beb Translated using Weblate (Finnish)
Currently translated at 22.2% (2302 of 10342 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/fi/

Co-authored-by: Ricky Tigg <ricky.tigg@gmail.com>
Signed-off-by: Ricky Tigg <ricky.tigg@gmail.com>
2021-07-06 18:04:25 +02:00
Daniel P. Berrangé
45f94690d2 docs: add go-import meta tags for new go modules
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2021-07-02 15:05:15 +01:00
Daniel P. Berrangé
b8e1521afb docs: point go imports to gitlab.com repos
The gitlab.com repos are the primary source, with libvirt.org just a
read-only mirror.

Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2021-07-02 15:05:15 +01:00
Michal Privoznik
e3c05984f2 virSetUIDGIDWithCaps: Assume PR_CAPBSET_DROP is always defined
Bounding set capabilities were introduced in kernel commit of
v2.6.25-rc1~912. I guess it is safe to assume that all Linux
hosts we ran on have at least that version or newer.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
2021-07-01 16:41:50 +02:00
Jonathon Jongsma
dfa1e9b3eb nodedev: improve error message when destroying an inactive device
When trying to destroy a node device that is not active, we end up with
a confusing error message:

  # nodedev-destroy mdev_88a6b868_46bd_4015_8e5b_26107f82da38
  error: Failed to destroy node device 'mdev_88a6b868_46bd_4015_8e5b_26107f82da38'
  error: failed to access '/sys/bus/mdev/devices/88a6b868-46bd-4015-8e5b-26107f82da38/iommu_group': No such file or directory

With this patch, the error is more clear:

  # nodedev-destroy mdev_88a6b868_46bd_4015_8e5b_26107f82da38
  error: Failed to destroy node device 'mdev_88a6b868_46bd_4015_8e5b_26107f82da38'
  error: Requested operation is not valid: Device 'mdev_88a6b868_46bd_4015_8e5b_26107f82da38' is not active

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
2021-07-01 16:34:03 +02:00
Jonathon Jongsma
bcdcaa2d08 nodedev: handle mdevctl errors consistently
Currently, we have three different types of mdevctl errors:
 1. the command cannot be constructed ecause of unsatisfied
    preconditions
 2. the command cannot be executed due to some error
 3. the command is executed, but returns an error status

These different failures are handled differently. Some cases set an
error and return and error status, and some return a error message but
do not set an error.

This means that the caller has to check both whether the return value is
negative and whether the errmsg parameter is non-NULL before deciding
whether to report the error or not. The situation is further complicated
by the fact that there are occasional instances where mdevctl exits with
an error status but does not print an error message.  This results in
errmsg being an empty string "" (i.e. non-NULL).

Simplify the situation by ensuring that virReportError() is called for
all error conditions rather than returning an error message back to the
calling function.

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
2021-07-01 16:34:03 +02:00
Jonathon Jongsma
5cf6f18d5d nodedev: add macro to handle command errors
This macro will be utilized in the following patch. Since mdevctl
commands can fail with or without an error message, this macro makes it
easy to print a fallback error in the case that the error message is not
set.

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
2021-07-01 16:34:03 +02:00
Jonathon Jongsma
2a615af38f nodedev: Handle NULL command variable
In commit 68580a51, I removed the checks for NULL cmd variables because
virCommandRun() already handles the case where it is called with a NULL
cmd. Unfortunately, it handles this case by raising a generic error
which is both unhelpful and overwrites our existing error message. So
for example, when I attempt to create a mediated device with an invalid
parent, I get the following output:

    virsh # nodedev-create mdev-test.xml
    error: Failed to create node device from mdev-test.xml
    error: internal error: invalid use of command API

With this patch, I now get a useful error message again:

    virsh # nodedev-create mdev-test.xml
    error: Failed to create node device from mdev-test.xml
    error: internal error: unable to find parent device 'pci_0000_00_03_0'

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
2021-07-01 16:34:03 +02:00
Jonathon Jongsma
a96df6424f nodedev: Remove useless device name from error message
At the point where the error message is emitted, the field def->name is
still set to "new device", so the error message becomes:

  Unable to start mediated device 'new device': ...

Since the name doesn't contain anything useful, just omit it from the
error message altogether.

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
2021-07-01 16:34:03 +02:00
Jonathon Jongsma
e9b534905f nodedev: handle mdevs from multiple parents
Due to a rather unfortunate misunderstanding, we were parsing the list
of defined devices from mdevctl incorrectly. Since my primary
development machine only has a single device capable of mdevs, I
apparently neglected to test multiple parent devices and made some
assumptions based on reading the mdevctl code. These assumptions turned
out to be incorrect, so the parsing failed when devices from more than
one parent device were returned.

The details: mdevctl returns an array of objects representing the
defined devices. But instead of an array of multiple objects (with each
object representing a parent device), the array always contains only a
single object. That object has a separate property for each parent
device.

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2021-07-01 16:34:03 +02:00
Shalini Chellathurai Saroja
9c3b6b7a82 conf: verify for duplicate hostdevs
It is possible to define/edit(in shut off state) a domain XML with
same hostdev device repeated more than once, as shown below. This
behavior is not expected. So, this patch fixes it.

vser1:
<domain type='kvm'>
[...]
  <devices>
 [...]
    <hostdev mode='subsystem' type='mdev' managed='no' model='vfio-ccw'>
      <source>
        <address uuid='8e782fea-e5f4-45fa-a0f9-024cf66e5009'/>
      </source>
      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0005'/>
    </hostdev>
    <hostdev mode='subsystem' type='mdev' managed='no' model='vfio-ccw'>
      <source>
        <address uuid='8e782fea-e5f4-45fa-a0f9-024cf66e5009'/>
      </source>
      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0006'/>
    </hostdev>
[...]
  </devices>
</domain>

$ virsh define vser1
Domain 'vser1' defined from vser1

Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Reviewed-by: Bjoern Walk <bwalk@linux.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2021-07-01 16:34:03 +02:00
Andrea Bolognani
d8a1c059e0 qemu: Reject TPM 1.2 for ARM virt guests
We already reject TPM 1.2 in a number of scenarios; let's add
ARM virt guests to the list.

https://bugzilla.redhat.com/show_bug.cgi?id=1970310

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Tested-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2021-07-01 16:15:05 +02:00
Andrea Bolognani
bf84313bbc tests: Test the defaults for TPM on ARM virt guests
Instead of providing the configuration explicitly, let libvirt
fill in the blanks. After the recent changes, this results in a
working configuration without the need for user input.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Tested-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2021-07-01 16:15:05 +02:00
Andrea Bolognani
7ace0fd221 qemu: Default to TPM 2.0 for ARM virt guests
The TPM 2.0 specification predates ARM virtualization, and so
implementing TPM 1.2 support on ARM was not considered a useful
endeavor.

This is technically a breaking change, but TPM support on ARM was
only introduced fairly recently (libvirt 7.1.0) and the previous
default resulted in non working TPM devices; anyone who has a
working configuration is not going to be affected.

https://bugzilla.redhat.com/show_bug.cgi?id=1970310

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Tested-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2021-07-01 16:15:05 +02:00
Andrea Bolognani
7ad6f8dde0 tests: Add aarch64-tpm test to qemuxml2xml
We're going to change the input file later, and having this
additional coverage will demonstrate that such a change does not
alter the behavior.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Tested-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2021-07-01 16:15:05 +02:00
Andrea Bolognani
499c38b22f docs: Fix information for default TPM version
The current information is not accurate, because the default
is 2.0 instead of 1.2 for the tpm-crb and tpm-spapr models.

Any detailed list will surely become obsolete and out of sync
with reality over time, so let's just document that the default
model depends on a number of factors and avoid getting any more
specific than that.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Tested-by: Liu Yiding <liuyd.fnst@fujitsu.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2021-07-01 16:15:05 +02:00
Andrea Bolognani
0e8e50e444 NEWS: Fix spacing between releases
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2021-07-01 16:15:05 +02:00
Jiri Denemark
2f8ee6a69d Post-release version bump to 7.6.0
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2021-07-01 15:44:22 +02:00
Jiri Denemark
03eadc86fc Release of libvirt-7.5.0
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2021-07-01 15:40:26 +02:00
Daniel P. Berrangé
96f1bd13a0 Add news item for sVirt CVE fix
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2021-07-01 13:59:42 +01:00
Daniel P. Berrangé
15073504db security: fix SELinux label generation logic
A process can access a file if the set of MCS categories
for the file is equal-to *or* a subset-of, the set of
MCS categories for the process.

If there are two VMs:

  a) svirt_t:s0:c117
  b) svirt_t:s0:c117,c720

Then VM (b) is able to access files labelled for VM (a).

IOW, we must discard case where the categories are equal
because that is a subset of many other valid category pairs.

Fixes: https://gitlab.com/libvirt/libvirt/-/issues/153
CVE-2021-3631
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2021-06-30 14:51:42 +01:00
Peter Krempa
f63397de61 NEWS: Update for 7.5.0
Mention fixing of disk iothread validation and the disk serial
truncation state.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
2021-06-29 14:39:01 +02:00
Yuri Chornoivan
846a275c85 Translated using Weblate (Ukrainian)
Currently translated at 100.0% (10342 of 10342 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/uk/

Co-authored-by: Yuri Chornoivan <yurchor@ukr.net>
Signed-off-by: Yuri Chornoivan <yurchor@ukr.net>
2021-06-29 08:54:00 +02:00
simmon
4e3288d5a2 Translated using Weblate (Korean)
Currently translated at 44.9% (4644 of 10342 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/ko/

Co-authored-by: simmon <simmon@nplob.com>
Signed-off-by: simmon <simmon@nplob.com>
2021-06-29 08:54:00 +02:00
Nathan
4c5a7a365d Translated using Weblate (Italian)
Currently translated at 23.3% (2411 of 10342 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/it/

Co-authored-by: Nathan <nathan95@live.it>
Signed-off-by: Nathan <nathan95@live.it>
2021-06-29 08:54:00 +02:00
Weblate
9fe64b9766 Update translation files
Updated by "Update PO files to match POT (msgmerge)" hook in Weblate.

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/

Co-authored-by: Weblate <noreply@weblate.org>
Signed-off-by: Fedora Weblate Translation <i18n@lists.fedoraproject.org>
2021-06-29 08:54:00 +02:00
Jan Kuparinen
9e5e82d9b7 Translated using Weblate (Finnish)
Currently translated at 21.8% (2255 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/fi/

Translated using Weblate (Finnish)

Currently translated at 21.8% (2249 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/fi/

Translated using Weblate (Finnish)

Currently translated at 21.0% (2176 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/fi/

Translated using Weblate (Finnish)

Currently translated at 21.0% (2170 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/fi/

Co-authored-by: Jan Kuparinen <copper_fin@hotmail.com>
Signed-off-by: Jan Kuparinen <copper_fin@hotmail.com>
2021-06-29 08:53:58 +02:00
simmon
82cba3771d Translated using Weblate (Korean)
Currently translated at 44.8% (4624 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/ko/

Translated using Weblate (Korean)

Currently translated at 44.7% (4618 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/ko/

Translated using Weblate (Korean)

Currently translated at 44.7% (4614 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/ko/

Translated using Weblate (Korean)

Currently translated at 44.7% (4613 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/ko/

Translated using Weblate (Korean)

Currently translated at 44.7% (4613 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/ko/

Translated using Weblate (Korean)

Currently translated at 44.7% (4611 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/ko/

Translated using Weblate (Korean)

Currently translated at 44.5% (4593 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/ko/

Translated using Weblate (Korean)

Currently translated at 44.5% (4590 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/ko/

Translated using Weblate (Korean)

Currently translated at 44.4% (4582 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/ko/

Translated using Weblate (Korean)

Currently translated at 44.3% (4577 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/ko/

Translated using Weblate (Korean)

Currently translated at 44.3% (4570 of 10314 strings)

Translation: libvirt/libvirt
Translate-URL: https://translate.fedoraproject.org/projects/libvirt/libvirt/ko/

Co-authored-by: simmon <simmon@nplob.com>
Signed-off-by: simmon <simmon@nplob.com>
2021-06-29 08:53:58 +02:00
Michal Privoznik
438b50dda8 virSetUIDGIDWithCaps: Don't drop CAP_SETPCAP right away
There are few cases where we execute a virCommand with all caps
cleared (virCommandClearCaps()). For instance
dnsmasqCapsRefreshInternal() does just that. This means, that
after fork() and before exec() the virSetUIDGIDWithCaps() is
called. But since the caller did not want to change anything,
just drop capabilities, these are the values of arguments:

  virSetUIDGIDWithCaps (uid=-1, gid=-1, groups=0x0, ngroups=0,
                        capBits=0, clearExistingCaps=true)

This means that indeed all capabilities will be dropped,
including CAP_SETPCAP. But this capability controls whether
capabilities can be set, IOW whether capng_apply() succeeds.

There are two calls of capng_apply() in the function. The
CAP_SETPCAP is dropped after the first call and thus the other
call (capng_apply(CAPNG_SELECT_BOUNDS);) fails.

The solution is to keep the capability for as long as needed
(just like CAP_SETGID and CAP_SETUID) and drop it only at the
very end (just like CAP_SETGID and CAP_SETUID).

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1949388
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
2021-06-29 08:52:12 +02:00
Zbigniew Jędrzejewski-Szmek
7c08141f90 spec: avoid rpm warning about macro in comment
Signed-off-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
2021-06-25 17:56:26 +00:00
Zbigniew Jędrzejewski-Szmek
da0f94c2a9 spec: avoid repeated calls to systemd macros and binaries
The macro can take multiple arguments, and the calls are more efficient
if done in one go.

Signed-off-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
2021-06-25 17:56:26 +00:00