mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-08-05 16:33:50 +00:00

Libvirt provides a portable, long term stable C API for managing the virtualization technologies provided by many operating systems. It includes support for QEMU, KVM, Xen, LXC, bhyve, Virtuozzo, VMware vCenter and ESX, VMware Desktop, Hyper-V, VirtualBox and the POWER Hypervisor.

Go to file

Jim Fehlig c44b29aacb apparmor: add dnsmasq ptrace rule to libvirtd profile Commit `b482925c` added ptrace rule for the apparmor profiles, but one was missed in the libvirtd profile for dnsmasq. It was overlooked since the test machine did not have an active libvirt network requiring dnsmasq that was also set to autostart. With one active and set to autostart, the following denial is observed in audit.log when restarting libvirtd type=AVC msg=audit(1507320136.306:298): apparmor="DENIED" \ operation="ptrace" profile="/usr/sbin/libvirtd" pid=5472 \ comm="libvirtd" requested_mask="trace" denied_mask="trace" \ peer="/usr/sbin/dnsmasq" With an active network, I suspect a libvirtd restart causes access to /proc/<dnsmasq-pid>/*, hence the resulting denial. As a nasty side affect of the denial, libvirtd thinks it needs to spawn a dnsmasq process even though one is already running for the network. E.g. after two libvirtd restarts dnsmasq 1683 0.0 0.0 51188 2612 ? S 12:03 0:00 \ /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf \ --leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper root 1684 0.0 0.0 51160 576 ? S 12:03 0:00 \ /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf \ --leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper dnsmasq 4706 0.0 0.0 51188 2572 ? S 13:54 0:00 \ /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf \ --leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper root 4707 0.0 0.0 51160 572 ? S 13:54 0:00 \ /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf \ --leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper dnsmasq 4791 0.0 0.0 51188 2580 ? S 13:56 0:00 \ /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf \ --leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper root 4792 0.0 0.0 51160 572 ? S 13:56 0:00 \ /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf \ --leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper A simple fix is to add a ptrace rule for dnsmasq. Signed-off-by: Jim Fehlig <jfehlig@suse.com> Reviewed-By: Guido Günther <agx@sigxcpu.org>		2017-10-06 16:39:15 -06:00
.gnulib@8d116e3f65	maint: Update to latest gnulib	2017-08-28 12:12:51 +02:00
build-aux	perl: Don't hardcode interpreter path	2017-09-19 16:04:53 +02:00
daemon	docs: Update --timeout description in libvirtd's man page	2017-09-08 11:07:45 +02:00
docs	news: Document watchdog hot-(un)plug change	2017-10-06 07:36:25 +02:00
examples	apparmor: add dnsmasq ptrace rule to libvirtd profile	2017-10-06 16:39:15 -06:00
gnulib	build: drop hack for old mingw ssize_t	2016-07-12 08:57:13 -06:00
include/libvirt	storage: Add new events for PoolBuild() and PoolDelete().	2017-09-20 11:52:56 +02:00
m4	m4: Disable -Wdisabled-optimization	2017-09-06 09:06:26 +02:00
po	Release of libvirt-3.8.0	2017-10-04 10:20:23 +02:00
src	numa: rename function virDomainNumaDefCPUFormat	2017-10-06 11:09:49 -06:00
tests	tests: Fix possible NULL deref	2017-10-06 06:53:05 -04:00
tools	virsh: Add/allow secret-uuid for pool-{define\|create}-as	2017-09-27 08:07:04 -04:00
.color_coded.in	Add color_coded support	2017-05-09 09:51:11 +02:00
.ctags	maint: Make ctags work out of the box	2013-07-18 08:47:21 +02:00
.dir-locals.el	build: avoid tabs that failed syntax-check	2012-09-06 09:43:46 -06:00
.gitignore	Add YouCompleteMe support	2017-05-09 09:51:11 +02:00
.gitmodules	util: switch over to use keycodemapdb GIT submodule	2017-04-25 21:14:18 +01:00
.mailmap	maint: update .mailmap for recent contributions	2015-03-20 06:17:55 -06:00
.travis.yml	Revert "travis: Limit git depth to 5 commits"	2017-09-19 17:08:15 +02:00
.ycm_extra_conf.py.in	Add YouCompleteMe support	2017-05-09 09:51:11 +02:00
AUTHORS.in	Change maintainers list	2016-02-12 13:10:05 +03:00
autogen.sh	autogen.sh: Improve and generalize	2017-04-25 09:52:37 +02:00
bootstrap	maint: update to latest gnulib	2017-01-10 12:54:54 -06:00
bootstrap.conf	hvsupport: use a regex instead of XML::XPath	2016-07-19 18:42:44 +02:00
cfg.mk	Print hex values with '0x' prefix and octal with '0' in debug messages	2017-09-25 13:34:53 +01:00
ChangeLog-old	Fix typos in src/*	2014-04-21 16:49:08 -06:00
config-post.h	Require use of GCC 4.4 or CLang compilers	2017-07-11 13:57:11 +01:00
configure.ac	Post-release version bump to 3.9.0	2017-10-04 10:38:30 +02:00
COPYING	maint: follow recommended practice for using LGPL	2013-05-20 14:15:21 -06:00
COPYING.LESSER	maint: Remove control characters from LGPL license file	2015-09-25 09:16:24 +02:00
libvirt-admin.pc.in	Add libvirt-admin library	2015-06-16 13:46:20 +02:00
libvirt-lxc.pc.in	Add pkg-config files for libvirt-qemu & libvirt-lxc	2014-06-23 16:17:27 +01:00
libvirt-qemu.pc.in	Add pkg-config files for libvirt-qemu & libvirt-lxc	2014-06-23 16:17:27 +01:00
libvirt.pc.in	Add pkg-config files for libvirt-qemu & libvirt-lxc	2014-06-23 16:17:27 +01:00
libvirt.spec.in	spec: Enable qemu driver on s390x on RHEL/CentOS	2017-10-05 09:58:14 +02:00
Makefile.am	HACKING: Drop from the git repository	2017-06-26 14:25:54 +02:00
Makefile.nonreentrant	Makefile.nonreentrant: Rebuild against Fedora 26	2017-09-04 16:12:10 +02:00
mingw-libvirt.spec.in	Add libxslt as build requires for mingw RPMs	2017-09-04 13:05:24 +01:00
README	Provide a useful README file	2017-05-22 17:01:37 +01:00
README-hacking	HACKING: Drop from the git repository	2017-06-26 14:25:54 +02:00
README.md	HACKING: Drop from the git repository	2017-06-26 14:25:54 +02:00
run.in	Add PKG_CONFIG_PATH to run.in script.	2014-06-26 14:32:35 +01:00
TODO	Update todo list file to point at bugzilla/website	2010-10-13 16:45:26 +01:00

README.md

Libvirt API for virtualization

For some of these hypervisors, it provides a stateful management daemon which runs on the virtualization host allowing access to the API both by non-privileged local users and remote users.

Layered packages provide bindings of the libvirt C API into other languages including Python, Perl, PHP, Go, Java, OCaml, as well as mappings into object systems such as GObject, CIM and SNMP.

Further information about the libvirt project can be found on the website:

https://libvirt.org

License

The libvirt C API is distributed under the terms of GNU Lesser General Public License, version 2.1 (or later). Some parts of the code that are not part of the C library may have the more restrictive GNU General Public License, version 2.1 (or later). See the files COPYING.LESSER and COPYING for full license terms & conditions.

Installation

Libvirt uses the GNU Autotools build system, so in general can be built and installed with the usual commands. For example, to build in a manner that is suitable for installing as root, use:

$ ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
$ make
$ sudo make install

While to build & install as an unprivileged user

$ ./configure --prefix=$HOME/usr
$ make
$ make install

The libvirt code relies on a large number of 3rd party libraries. These will be detected during execution of the configure script and a summary printed which lists any missing (optional) dependencies.

Contributing

The libvirt project welcomes contributions in many ways. For most components the best way to contribute is to send patches to the primary development mailing list. Further guidance on this can be found on the website:

https://libvirt.org/contribute.html

Contact

The libvirt project has two primary mailing lists:

libvirt-users@redhat.com (for user discussions)
libvir-list@redhat.com (for development only)

Further details on contacting the project are available on the website:

https://libvirt.org/contact.html