Compare commits
112 Commits
F-8-split
...
libvirt-0_
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
e1b7b518ac | ||
|
|
581b5f5022 | ||
|
|
c476c8b683 | ||
|
|
b93eafc59f | ||
|
|
2105d62ca8 | ||
|
|
743adffffe | ||
|
|
11e3b51c0d | ||
|
|
66df925739 | ||
|
|
b20a5c6d3b | ||
|
|
7f58f3aa54 | ||
|
|
6577b14441 | ||
|
|
2e7812764f | ||
|
|
854b878580 | ||
|
|
89c28e4013 | ||
|
|
db269c2d21 | ||
|
|
98e4f7ee9f | ||
|
|
0c4afc5ee9 | ||
|
|
593255292e | ||
|
|
ccafc8ecb4 | ||
|
|
a38fb9cbc1 | ||
|
|
6359121866 | ||
|
|
b20d669e88 | ||
|
|
a3e1cc37ed | ||
|
|
a6eca3382d | ||
|
|
c6c5072e90 | ||
|
|
705fd20a0e | ||
|
|
e0e9927d93 | ||
|
|
bae7a0fb84 | ||
|
|
36aee593bc | ||
|
|
dc0cb0e91a | ||
|
|
84d66312fe | ||
|
|
4f644ce267 | ||
|
|
cdd5b3d62d | ||
|
|
53f63aa62d | ||
|
|
748df35c5f | ||
|
|
a6e23d00fa | ||
|
|
c6d11b43c9 | ||
|
|
83091ff0dd | ||
|
|
4465a63872 | ||
|
|
3f397d9786 | ||
|
|
750aec5507 | ||
|
|
d7c1d3bbc0 | ||
|
|
fa0f21c263 | ||
|
|
afdaf5d354 | ||
|
|
26bba5aea9 | ||
|
|
1a4185bdcc | ||
|
|
6a73119e65 | ||
|
|
1e2f9fce0a | ||
|
|
f5edf79c95 | ||
|
|
b59e64bf44 | ||
|
|
a09fc2658a | ||
|
|
a008fcf27e | ||
|
|
511f6cd625 | ||
|
|
48b90fefc1 | ||
|
|
bc4bbabdf6 | ||
|
|
905627c8fd | ||
|
|
a16d752c10 | ||
|
|
29b1292019 | ||
|
|
f3546be64b | ||
|
|
fb9044931e | ||
|
|
03c5fec4d2 | ||
|
|
ce373a25b6 | ||
|
|
996d0e4709 | ||
|
|
8c01426c44 | ||
|
|
e859f7e59e | ||
|
|
25ea2f59bd | ||
|
|
c80b7f0d5a | ||
|
|
958f1c3dff | ||
|
|
4a8ca1017f | ||
|
|
1e122ee5dc | ||
|
|
6a6307bcdc | ||
|
|
6e8332946a | ||
|
|
982683e56f | ||
|
|
7244d1a339 | ||
|
|
2a3935580c | ||
|
|
28f7f11450 | ||
|
|
ca07bc4597 | ||
|
|
8e23194a2b | ||
|
|
fe09090e2d | ||
|
|
b5868cf8cf | ||
|
|
f294b40ba5 | ||
|
|
c0c1a7bb79 | ||
|
|
1b864048bd | ||
|
|
072c9c45ab | ||
|
|
af111679c3 | ||
|
|
dd9f21eaa2 | ||
|
|
f0e356df98 | ||
|
|
140bcf9ffc | ||
|
|
af69660412 | ||
|
|
6dc94c6252 | ||
|
|
eb34165670 | ||
|
|
7ce08f2148 | ||
|
|
049a8c79d9 | ||
|
|
f7a6d90012 | ||
|
|
67a2f29a89 | ||
|
|
82422fa1ff | ||
|
|
a73cf1d010 | ||
|
|
481419ebb6 | ||
|
|
1e65165c3a | ||
|
|
bca27d9111 | ||
|
|
08b9144b41 | ||
|
|
2063007248 | ||
|
|
81e46cb6da | ||
|
|
263e2f2021 | ||
|
|
2b9efc3de2 | ||
|
|
69f6239766 | ||
|
|
bf744f9872 | ||
|
|
45b0b2bfa6 | ||
|
|
f29ea218b7 | ||
|
|
7d193b7810 | ||
|
|
3182a4df5a | ||
|
|
4f667910e9 |
38
.cvsignore
38
.cvsignore
@@ -1,24 +1,14 @@
|
||||
libvirt-0.0.3.tar.gz
|
||||
libvirt-0.0.4.tar.gz
|
||||
libvirt-0.0.5.tar.gz
|
||||
libvirt-0.0.6.tar.gz
|
||||
libvirt-0.1.0.tar.gz
|
||||
libvirt-0.1.2.tar.gz
|
||||
libvirt-0.1.1.tar.gz
|
||||
libvirt-0.1.3.tar.gz
|
||||
libvirt-0.1.4.tar.gz
|
||||
libvirt-0.1.5.tar.gz
|
||||
libvirt-0.1.6.tar.gz
|
||||
libvirt-0.1.7.tar.gz
|
||||
libvirt-0.1.8.tar.gz
|
||||
libvirt-0.1.9.tar.gz
|
||||
libvirt-0.1.10.tar.gz
|
||||
libvirt-0.1.11.tar.gz
|
||||
libvirt-0.2.0.tar.gz
|
||||
libvirt-0.2.1.tar.gz
|
||||
libvirt-0.2.2.tar.gz
|
||||
libvirt-0.2.3.tar.gz
|
||||
libvirt-0.3.0.tar.gz
|
||||
libvirt-0.3.1.tar.gz
|
||||
libvirt-0.3.2.tar.gz
|
||||
libvirt-0.3.3.tar.gz
|
||||
.build*.log
|
||||
*.rpm
|
||||
i686
|
||||
x86_64
|
||||
libvirt-*.tar.gz
|
||||
libvirt-0.6.0.tar.gz
|
||||
libvirt-0.6.1.tar.gz
|
||||
libvirt-0.6.2.tar.gz
|
||||
libvirt-0.6.3.tar.gz
|
||||
libvirt-0.6.4.tar.gz
|
||||
libvirt-0.6.5.tar.gz
|
||||
libvirt-0.7.0-0.1.gitf055724.tar.gz
|
||||
libvirt-0.7.0-0.6.gite195b43.tar.gz
|
||||
libvirt-0.7.0.tar.gz
|
||||
|
||||
@@ -1,207 +0,0 @@
|
||||
changeset: 1147:7481eafdde8d
|
||||
user: berrange
|
||||
date: Fri Oct 12 18:54:15 2007 +0000
|
||||
files: libvirt.spec.in qemud/Makefile.am qemud/libvirtd.conf src/Makefile.am src/qemu.conf
|
||||
description:
|
||||
Added default example configs for libvirtd/qemu driver
|
||||
|
||||
|
||||
diff -r c48e81e685a3 -r 7481eafdde8d qemud/libvirtd.conf
|
||||
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
|
||||
+++ b/qemud/libvirtd.conf Fri Oct 12 18:54:15 2007 +0000
|
||||
@@ -0,0 +1,141 @@
|
||||
+# Master libvirt daemon configuration file
|
||||
+#
|
||||
+# For further information consult http://libvirt.org/format.html
|
||||
+
|
||||
+
|
||||
+# Flag listening for secure TLS connections on the public TCP/IP port.
|
||||
+# NB, must pass the --listen flag to the libvirtd process for this to
|
||||
+# have any effect.
|
||||
+#
|
||||
+# It is neccessary to setup a CA and issue server certificates before
|
||||
+# using this capability.
|
||||
+#
|
||||
+# This is enabled by default, uncomment this to disable it
|
||||
+# listen_tls = 0
|
||||
+
|
||||
+# Listen for unencrypted TCP connections on the public TCP/IP port.
|
||||
+# NB, must pass the --listen flag to the libvirtd process for this to
|
||||
+# have any effect.
|
||||
+#
|
||||
+# NB, this is insecure. Do not use except for development.
|
||||
+#
|
||||
+# This is disabled by default, uncomment this to enable it.
|
||||
+# listen_tcp = 1
|
||||
+
|
||||
+
|
||||
+
|
||||
+# Override the port for accepting secure TLS connections
|
||||
+# This can be a port number, or service name
|
||||
+#
|
||||
+# tls_port = "16514"
|
||||
+
|
||||
+# Override the port for accepting insecure TCP connections
|
||||
+# This can be a port number, or service name
|
||||
+#
|
||||
+# tcp_port = "16509"
|
||||
+
|
||||
+
|
||||
+
|
||||
+# Flag toggling mDNS advertizement of the libvirt service.
|
||||
+#
|
||||
+# Alternatively can disable for all services on a host by
|
||||
+# stopping the Avahi daemon
|
||||
+#
|
||||
+# This is enabled by default, uncomment this to disable it
|
||||
+# mdns_adv = 0
|
||||
+
|
||||
+# Override the default mDNS advertizement name. This must be
|
||||
+# unique on the immediate broadcast network.
|
||||
+#
|
||||
+# The default is "Virtualization Host HOSTNAME", where HOSTNAME
|
||||
+# is subsituted for the short hostname of the machine (without domain)
|
||||
+#
|
||||
+# mdns_name "Virtualization Host Joe Demo"
|
||||
+
|
||||
+
|
||||
+
|
||||
+# Set the UNIX domain socket group ownership. This can be used to
|
||||
+# allow a 'trusted' set of users access to management capabilities
|
||||
+# without becoming root.
|
||||
+#
|
||||
+# This is restricted to 'root' by default.
|
||||
+# unix_sock_group "libvirt"
|
||||
+
|
||||
+# Set the UNIX socket permissions for the R/O socket. This is used
|
||||
+# for monitoring VM status only
|
||||
+#
|
||||
+# Default allows any user. If setting group ownership may want to
|
||||
+# restrict this to:
|
||||
+# unix_sock_ro_perms "0777"
|
||||
+
|
||||
+# Set the UNIX socket permissions for the R/W socket. This is used
|
||||
+# for full management of VMs
|
||||
+#
|
||||
+# Default allows only root. If setting group ownership may want to
|
||||
+# relax this to:
|
||||
+# unix_sock_rw_perms "octal-perms" "0770"
|
||||
+
|
||||
+
|
||||
+
|
||||
+# Flag to disable verification of client certificates
|
||||
+#
|
||||
+# Client certificate verification is the primary authentication mechanism.
|
||||
+# Any client which does not present a certificate signed by the CA
|
||||
+# will be rejected.
|
||||
+#
|
||||
+# Default is to always verify. Uncommenting this will disable
|
||||
+# verification - make sure an IP whitelist is set
|
||||
+# tls_no_verify_certificate 1
|
||||
+
|
||||
+# Flag to disable verification of client IP address
|
||||
+#
|
||||
+# Client IP address will be verified against the CommonName field
|
||||
+# of the x509 certificate. This has minimal security benefit since
|
||||
+# it is easy to spoof source IP.
|
||||
+#
|
||||
+# Uncommenting this will disable verification
|
||||
+# tls_no_verify_address 1
|
||||
+
|
||||
+# Override the default server key file path
|
||||
+#
|
||||
+# key_file "/etc/pki/libvirt/private/serverkey.pem"
|
||||
+
|
||||
+# Override the default server certificate file path
|
||||
+#
|
||||
+# cert_file "/etc/pki/libvirt/servercert.pem"
|
||||
+
|
||||
+# Override the default CA certificate path
|
||||
+#
|
||||
+# ca_file "/etc/pki/CA/cacert.pem"
|
||||
+
|
||||
+# Specify a certificate revocation list.
|
||||
+#
|
||||
+# Defaults to not using a CRL, uncomment to enable it
|
||||
+# crl_file "/etc/pki/CA/crl.pem"
|
||||
+
|
||||
+# A whitelist of allowed x509 Distinguished Names
|
||||
+# This list may contain wildcards such as
|
||||
+#
|
||||
+# "C=GB,ST=London,L=London,O=Red Hat,CN=*"
|
||||
+#
|
||||
+# See the POSIX fnmatch function for the format of the wildcards.
|
||||
+#
|
||||
+# NB If this is an empty list, no client can connect, so comment out
|
||||
+# entirely rather than using empty list to disable these checks
|
||||
+#
|
||||
+# By default, no DN's are checked
|
||||
+# tls_allowed_dn_list ["DN1", "DN2"]
|
||||
+
|
||||
+
|
||||
+# A whitelist of allowed client IP addresses
|
||||
+#
|
||||
+# This list may contain wildcards such as 192.168.* See the POSIX fnmatch
|
||||
+# function for the format of the wildcards.
|
||||
+#
|
||||
+# NB If this is an empty list, no client can connect, so comment out
|
||||
+# entirely rather than using empty list to disable these checks
|
||||
+#
|
||||
+# By default, no IP's are checked. This can be IPv4 or IPv6 addresses
|
||||
+# tls_allowed_ip_list ["ip1", "ip2", "ip3"]
|
||||
+
|
||||
+
|
||||
diff -r c48e81e685a3 -r 7481eafdde8d src/qemu.conf
|
||||
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
|
||||
+++ b/src/qemu.conf Fri Oct 12 18:54:15 2007 +0000
|
||||
@@ -0,0 +1,49 @@
|
||||
+# Master configuration file for the QEMU driver.
|
||||
+# All settings described here are optional - if omitted, sensible
|
||||
+# defaults are used.
|
||||
+
|
||||
+# VNC is configured to listen on 127.0.0.1 by default.
|
||||
+# To make it listen on all public interfaces, uncomment
|
||||
+# this next option.
|
||||
+#
|
||||
+# NB, strong recommendation to enable TLS + x509 certificate
|
||||
+# verification when allowing public access
|
||||
+#
|
||||
+# vnc_listen = "0.0.0.0"
|
||||
+
|
||||
+
|
||||
+# Enable use of TLS encryption on the VNC server. This requires
|
||||
+# a VNC client which supports the VeNCrypt protocol extension.
|
||||
+# Examples include vinagre, virt-viewer, virt-manager and vencrypt
|
||||
+# itself. UltraVNC, RealVNC, TightVNC do not support this
|
||||
+#
|
||||
+# It is neccessary to setup CA and issue a server certificate
|
||||
+# before enabling this.
|
||||
+#
|
||||
+# vnc_tls = 1
|
||||
+
|
||||
+
|
||||
+# Use of TLS requires that x509 certificates be issued. The
|
||||
+# default it to keep them in /etc/pki/libvirt-vnc. This directory
|
||||
+# must contain
|
||||
+#
|
||||
+# ca-cert.pem - the CA master certificate
|
||||
+# server-cert.pem - the server certificate signed with ca-cert.pem
|
||||
+# server-key.pem - the server private key
|
||||
+#
|
||||
+# This option allows the certificate directory to be changed
|
||||
+#
|
||||
+# vnc_tls_x509_cert_dir = "/etc/pki/libvirt-vnc"
|
||||
+
|
||||
+
|
||||
+# The default TLS configuration only uses certificates for the server
|
||||
+# allowing the client to verify the server's identity and establish
|
||||
+# and encrypted channel.
|
||||
+#
|
||||
+# It is possible to use x509 certificates for authentication too, by
|
||||
+# issuing a x509 certificate to every client who needs to connect.
|
||||
+#
|
||||
+# Enabling this option will reject any client who does not have a
|
||||
+# certificate signed by the CA in /etc/pki/libvirt-vnc/ca-cert.pem
|
||||
+#
|
||||
+# vnc_tls_x509_verify = 1
|
||||
|
||||
@@ -1,230 +0,0 @@
|
||||
changeset: 1146:c48e81e685a3
|
||||
user: berrange
|
||||
date: Fri Oct 12 15:05:44 2007 +0000
|
||||
files: ChangeLog src/qemu_conf.c src/qemu_conf.h src/qemu_driver.c
|
||||
description:
|
||||
Added QEMU driver config file
|
||||
|
||||
|
||||
diff -r 522efe7f7e8f -r c48e81e685a3 src/qemu_conf.c
|
||||
--- a/src/qemu_conf.c Wed Oct 10 18:46:17 2007 +0000
|
||||
+++ b/src/qemu_conf.c Fri Oct 12 15:05:44 2007 +0000
|
||||
@@ -45,6 +45,7 @@
|
||||
#include "qemu_conf.h"
|
||||
#include "uuid.h"
|
||||
#include "buf.h"
|
||||
+#include "conf.h"
|
||||
|
||||
#define qemudLog(level, msg...) fprintf(stderr, msg)
|
||||
|
||||
@@ -65,6 +66,68 @@ void qemudReportError(virConnectPtr conn
|
||||
__virRaiseError(conn, dom, net, VIR_FROM_QEMU, code, VIR_ERR_ERROR,
|
||||
NULL, NULL, NULL, -1, -1, errorMessage);
|
||||
}
|
||||
+
|
||||
+int qemudLoadDriverConfig(struct qemud_driver *driver,
|
||||
+ const char *filename) {
|
||||
+ virConfPtr conf;
|
||||
+ virConfValuePtr p;
|
||||
+
|
||||
+ /* Setup 2 critical defaults */
|
||||
+ strcpy(driver->vncListen, "127.0.0.1");
|
||||
+ if (!(driver->vncTLSx509certdir = strdup(SYSCONF_DIR "/pki/libvirt-vnc"))) {
|
||||
+ qemudReportError(NULL, NULL, NULL, VIR_ERR_NO_MEMORY,
|
||||
+ "vncTLSx509certdir");
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
+ /* Just check the file is readable before opening it, otherwise
|
||||
+ * libvirt emits an error.
|
||||
+ */
|
||||
+ if (access (filename, R_OK) == -1) return 0;
|
||||
+
|
||||
+ conf = virConfReadFile (filename);
|
||||
+ if (!conf) return 0;
|
||||
+
|
||||
+
|
||||
+#define CHECK_TYPE(name,typ) if (p && p->type != (typ)) { \
|
||||
+ qemudReportError(NULL, NULL, NULL, VIR_ERR_INTERNAL_ERROR, \
|
||||
+ "remoteReadConfigFile: %s: %s: expected type " #typ "\n", \
|
||||
+ filename, (name)); \
|
||||
+ virConfFree(conf); \
|
||||
+ return -1; \
|
||||
+ }
|
||||
+
|
||||
+ p = virConfGetValue (conf, "vnc_tls");
|
||||
+ CHECK_TYPE ("vnc_tls", VIR_CONF_LONG);
|
||||
+ if (p) driver->vncTLS = p->l;
|
||||
+
|
||||
+ p = virConfGetValue (conf, "vnc_tls_x509_verify");
|
||||
+ CHECK_TYPE ("vnc_tls_x509_verify", VIR_CONF_LONG);
|
||||
+ if (p) driver->vncTLSx509verify = p->l;
|
||||
+
|
||||
+ p = virConfGetValue (conf, "vnc_tls_x509_cert_dir");
|
||||
+ CHECK_TYPE ("vnc_tls_x509_cert_dir", VIR_CONF_STRING);
|
||||
+ if (p && p->str) {
|
||||
+ free(driver->vncTLSx509certdir);
|
||||
+ if (!(driver->vncTLSx509certdir = strdup(p->str))) {
|
||||
+ qemudReportError(NULL, NULL, NULL, VIR_ERR_NO_MEMORY,
|
||||
+ "vncTLSx509certdir");
|
||||
+ virConfFree(conf);
|
||||
+ return -1;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ p = virConfGetValue (conf, "vnc_listen");
|
||||
+ CHECK_TYPE ("vnc_listen", VIR_CONF_STRING);
|
||||
+ if (p && p->str) {
|
||||
+ strncpy(driver->vncListen, p->str, sizeof(driver->vncListen));
|
||||
+ driver->vncListen[sizeof(driver->vncListen)-1] = '\0';
|
||||
+ }
|
||||
+
|
||||
+ virConfFree (conf);
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
|
||||
struct qemud_vm *qemudFindVMByID(const struct qemud_driver *driver, int id) {
|
||||
struct qemud_vm *vm = driver->vms;
|
||||
@@ -1234,7 +1297,7 @@ static struct qemud_vm_def *qemudParseXM
|
||||
if (vnclisten && *vnclisten)
|
||||
strncpy(def->vncListen, (char *)vnclisten, BR_INET_ADDR_MAXLEN-1);
|
||||
else
|
||||
- strcpy(def->vncListen, "127.0.0.1");
|
||||
+ strcpy(def->vncListen, driver->vncListen);
|
||||
def->vncListen[BR_INET_ADDR_MAXLEN-1] = '\0';
|
||||
xmlFree(vncport);
|
||||
xmlFree(vnclisten);
|
||||
@@ -1750,15 +1813,30 @@ int qemudBuildCommandLine(virConnectPtr
|
||||
}
|
||||
|
||||
if (vm->def->graphicsType == QEMUD_GRAPHICS_VNC) {
|
||||
- char vncdisplay[BR_INET_ADDR_MAXLEN+20];
|
||||
+ char vncdisplay[PATH_MAX];
|
||||
int ret;
|
||||
- if (vm->qemuCmdFlags & QEMUD_CMD_FLAG_VNC_COLON)
|
||||
- ret = snprintf(vncdisplay, sizeof(vncdisplay), "%s:%d",
|
||||
+
|
||||
+ if (vm->qemuCmdFlags & QEMUD_CMD_FLAG_VNC_COLON) {
|
||||
+ char options[PATH_MAX] = "";
|
||||
+ if (driver->vncTLS) {
|
||||
+ strcat(options, ",tls");
|
||||
+ if (driver->vncTLSx509verify) {
|
||||
+ strcat(options, ",x509verify=");
|
||||
+ } else {
|
||||
+ strcat(options, ",x509=");
|
||||
+ }
|
||||
+ strncat(options, driver->vncTLSx509certdir,
|
||||
+ sizeof(options) - (strlen(driver->vncTLSx509certdir)-1));
|
||||
+ options[sizeof(options)-1] = '\0';
|
||||
+ }
|
||||
+ ret = snprintf(vncdisplay, sizeof(vncdisplay), "%s:%d%s",
|
||||
vm->def->vncListen,
|
||||
- vm->def->vncActivePort - 5900);
|
||||
- else
|
||||
+ vm->def->vncActivePort - 5900,
|
||||
+ options);
|
||||
+ } else {
|
||||
ret = snprintf(vncdisplay, sizeof(vncdisplay), "%d",
|
||||
vm->def->vncActivePort - 5900);
|
||||
+ }
|
||||
if (ret < 0 || ret >= (int)sizeof(vncdisplay))
|
||||
goto error;
|
||||
|
||||
diff -r 522efe7f7e8f -r c48e81e685a3 src/qemu_conf.h
|
||||
--- a/src/qemu_conf.h Wed Oct 10 18:46:17 2007 +0000
|
||||
+++ b/src/qemu_conf.h Fri Oct 12 15:05:44 2007 +0000
|
||||
@@ -289,6 +289,10 @@ struct qemud_driver {
|
||||
char *networkConfigDir;
|
||||
char *networkAutostartDir;
|
||||
char logDir[PATH_MAX];
|
||||
+ int vncTLS : 1;
|
||||
+ int vncTLSx509verify : 1;
|
||||
+ char *vncTLSx509certdir;
|
||||
+ char vncListen[BR_INET_ADDR_MAXLEN];
|
||||
};
|
||||
|
||||
|
||||
@@ -311,6 +315,8 @@ void qemudReportError(virConnectPtr conn
|
||||
ATTRIBUTE_FORMAT(printf,5,6);
|
||||
|
||||
|
||||
+int qemudLoadDriverConfig(struct qemud_driver *driver,
|
||||
+ const char *filename);
|
||||
|
||||
struct qemud_vm *qemudFindVMByID(const struct qemud_driver *driver,
|
||||
int id);
|
||||
diff -r 522efe7f7e8f -r c48e81e685a3 src/qemu_driver.c
|
||||
--- a/src/qemu_driver.c Wed Oct 10 18:46:17 2007 +0000
|
||||
+++ b/src/qemu_driver.c Fri Oct 12 15:05:44 2007 +0000
|
||||
@@ -155,6 +155,7 @@ qemudStartup(void) {
|
||||
uid_t uid = geteuid();
|
||||
struct passwd *pw;
|
||||
char *base = NULL;
|
||||
+ char driverConf[PATH_MAX];
|
||||
|
||||
if (!(qemu_driver = calloc(1, sizeof(struct qemud_driver)))) {
|
||||
return -1;
|
||||
@@ -167,7 +168,7 @@ qemudStartup(void) {
|
||||
if (snprintf(qemu_driver->logDir, PATH_MAX, "%s/log/libvirt/qemu", LOCAL_STATE_DIR) >= PATH_MAX)
|
||||
goto snprintf_error;
|
||||
|
||||
- if ((base = strdup (SYSCONF_DIR "/libvirt/qemu")) == NULL)
|
||||
+ if ((base = strdup (SYSCONF_DIR "/libvirt")) == NULL)
|
||||
goto out_of_memory;
|
||||
} else {
|
||||
if (!(pw = getpwuid(uid))) {
|
||||
@@ -179,7 +180,7 @@ qemudStartup(void) {
|
||||
if (snprintf(qemu_driver->logDir, PATH_MAX, "%s/.libvirt/qemu/log", pw->pw_dir) >= PATH_MAX)
|
||||
goto snprintf_error;
|
||||
|
||||
- if (asprintf (&base, "%s/.libvirt/qemu", pw->pw_dir) == -1) {
|
||||
+ if (asprintf (&base, "%s/.libvirt", pw->pw_dir) == -1) {
|
||||
qemudLog (QEMUD_ERR, "out of memory in asprintf");
|
||||
goto out_of_memory;
|
||||
}
|
||||
@@ -188,24 +189,36 @@ qemudStartup(void) {
|
||||
/* Configuration paths are either ~/.libvirt/qemu/... (session) or
|
||||
* /etc/libvirt/qemu/... (system).
|
||||
*/
|
||||
- if (asprintf (&qemu_driver->configDir, "%s", base) == -1)
|
||||
+ if (snprintf (driverConf, sizeof(driverConf), "%s/qemu.conf", base) == -1)
|
||||
goto out_of_memory;
|
||||
-
|
||||
- if (asprintf (&qemu_driver->autostartDir, "%s/autostart", base) == -1)
|
||||
+ driverConf[sizeof(driverConf)-1] = '\0';
|
||||
+
|
||||
+ if (asprintf (&qemu_driver->configDir, "%s/qemu", base) == -1)
|
||||
goto out_of_memory;
|
||||
|
||||
- if (asprintf (&qemu_driver->networkConfigDir, "%s/networks", base) == -1)
|
||||
+ if (asprintf (&qemu_driver->autostartDir, "%s/qemu/autostart", base) == -1)
|
||||
goto out_of_memory;
|
||||
|
||||
- if (asprintf (&qemu_driver->networkAutostartDir, "%s/networks/autostart",
|
||||
+ if (asprintf (&qemu_driver->networkConfigDir, "%s/qemu/networks", base) == -1)
|
||||
+ goto out_of_memory;
|
||||
+
|
||||
+ if (asprintf (&qemu_driver->networkAutostartDir, "%s/qemu/networks/autostart",
|
||||
base) == -1)
|
||||
goto out_of_memory;
|
||||
|
||||
- if (qemudScanConfigs(qemu_driver) < 0)
|
||||
+ free(base);
|
||||
+
|
||||
+ if (qemudLoadDriverConfig(qemu_driver, driverConf) < 0) {
|
||||
qemudShutdown();
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
+ if (qemudScanConfigs(qemu_driver) < 0) {
|
||||
+ qemudShutdown();
|
||||
+ return -1;
|
||||
+ }
|
||||
qemudAutostartConfigs(qemu_driver);
|
||||
|
||||
- free(base);
|
||||
return 0;
|
||||
|
||||
snprintf_error:
|
||||
|
||||
33
libvirt-0.6.4-svirt-sound.patch
Normal file
33
libvirt-0.6.4-svirt-sound.patch
Normal file
@@ -0,0 +1,33 @@
|
||||
--- src/qemu_conf.c.orig 2009-05-29 19:24:59.000000000 +0200
|
||||
+++ src/qemu_conf.c 2009-05-29 19:19:39.000000000 +0200
|
||||
@@ -792,6 +792,20 @@ int qemudBuildCommandLine(virConnectPtr
|
||||
char uuid[VIR_UUID_STRING_BUFLEN];
|
||||
char domid[50];
|
||||
const char *cpu = NULL;
|
||||
+ int skipSound = 0;
|
||||
+
|
||||
+ if (driver->securityDriver &&
|
||||
+ driver->securityDriver->name &&
|
||||
+ STREQ(driver->securityDriver->name, "selinux") &&
|
||||
+ getuid() == 0) {
|
||||
+ static int soundWarned = 0;
|
||||
+ skipSound = 1;
|
||||
+ if (def->nsounds &&
|
||||
+ !soundWarned) {
|
||||
+ soundWarned = 1;
|
||||
+ VIR_WARN0("Sound cards for VMs are disabled while SELinux security model is active");
|
||||
+ }
|
||||
+ }
|
||||
|
||||
uname_normalize(&ut);
|
||||
|
||||
@@ -1429,7 +1443,8 @@ int qemudBuildCommandLine(virConnectPtr
|
||||
}
|
||||
|
||||
/* Add sound hardware */
|
||||
- if (def->nsounds) {
|
||||
+ if (def->nsounds &&
|
||||
+ !skipSound) {
|
||||
int size = 100;
|
||||
char *modstr;
|
||||
if (VIR_ALLOC_N(modstr, size+1) < 0)
|
||||
73
libvirt-0.7.0-chown-kernel-initrd-before-spawning-qemu.patch
Normal file
73
libvirt-0.7.0-chown-kernel-initrd-before-spawning-qemu.patch
Normal file
@@ -0,0 +1,73 @@
|
||||
From: Mark McLoughlin <markmc@redhat.com>
|
||||
Subject: [PATCH] chown kernel/initrd before spawning qemu
|
||||
|
||||
If we're running qemu unprivileged, we need to chown any supplied kernel
|
||||
or initrd before spawning it.
|
||||
|
||||
* src/qemu_driver.c: rename qemuDomainSetDiskOwnership() to
|
||||
qemuDomainSetFileOwnership(), pass it a path string instead of a disk
|
||||
definition and use it for chowning the kernel/initrd in
|
||||
qemuDomainSetAllDeviceOwnership()
|
||||
---
|
||||
src/qemu_driver.c | 20 ++++++++++++--------
|
||||
1 files changed, 12 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/src/qemu_driver.c b/src/qemu_driver.c
|
||||
index 412b68d..bd58435 100644
|
||||
--- a/src/qemu_driver.c
|
||||
+++ b/src/qemu_driver.c
|
||||
@@ -1684,18 +1684,18 @@ static int qemuDomainSetHostdevOwnership(virConnectPtr conn,
|
||||
|
||||
}
|
||||
|
||||
-static int qemuDomainSetDiskOwnership(virConnectPtr conn,
|
||||
- virDomainDiskDefPtr def,
|
||||
+static int qemuDomainSetFileOwnership(virConnectPtr conn,
|
||||
+ const char *path,
|
||||
uid_t uid, gid_t gid)
|
||||
{
|
||||
|
||||
- if (!def->src)
|
||||
+ if (!path)
|
||||
return 0;
|
||||
|
||||
- VIR_DEBUG("Setting ownership on %s to %d:%d", def->src, uid, gid);
|
||||
- if (chown(def->src, uid, gid) < 0) {
|
||||
+ VIR_DEBUG("Setting ownership on %s to %d:%d", path, uid, gid);
|
||||
+ if (chown(path, uid, gid) < 0) {
|
||||
virReportSystemError(conn, errno, _("cannot set ownership on %s"),
|
||||
- def->src);
|
||||
+ path);
|
||||
return -1;
|
||||
}
|
||||
return 0;
|
||||
@@ -1725,7 +1725,7 @@ static int qemuDomainSetDeviceOwnership(virConnectPtr conn,
|
||||
(def->data.disk->readonly || def->data.disk->shared))
|
||||
return 0;
|
||||
|
||||
- return qemuDomainSetDiskOwnership(conn, def->data.disk, uid, gid);
|
||||
+ return qemuDomainSetFileOwnership(conn, def->data.disk->src, uid, gid);
|
||||
|
||||
case VIR_DOMAIN_DEVICE_HOSTDEV:
|
||||
return qemuDomainSetHostdevOwnership(conn, def->data.hostdev, uid, gid);
|
||||
@@ -1753,12 +1753,16 @@ static int qemuDomainSetAllDeviceOwnership(virConnectPtr conn,
|
||||
uid = restore ? 0 : driver->user;
|
||||
gid = restore ? 0 : driver->group;
|
||||
|
||||
+ if (qemuDomainSetFileOwnership(conn, def->os.kernel, uid, gid) < 0 ||
|
||||
+ qemuDomainSetFileOwnership(conn, def->os.initrd, uid, gid) < 0)
|
||||
+ return -1;
|
||||
+
|
||||
for (i = 0 ; i < def->ndisks ; i++) {
|
||||
if (restore &&
|
||||
(def->disks[i]->readonly || def->disks[i]->shared))
|
||||
continue;
|
||||
|
||||
- if (qemuDomainSetDiskOwnership(conn, def->disks[i], uid, gid) < 0)
|
||||
+ if (qemuDomainSetFileOwnership(conn, def->disks[i]->src, uid, gid) < 0)
|
||||
return -1;
|
||||
}
|
||||
|
||||
--
|
||||
1.6.2.5
|
||||
|
||||
39
libvirt-0.7.0-handle-kernels-with-no-ipv6-support.patch
Normal file
39
libvirt-0.7.0-handle-kernels-with-no-ipv6-support.patch
Normal file
@@ -0,0 +1,39 @@
|
||||
From: Mark McLoughlin <markmc@redhat.com>
|
||||
Subject: [PATCH] Handle kernels with no ipv6 support
|
||||
|
||||
If the ipv6 kernel module is not loaded, then we get this when starting
|
||||
a virtual network:
|
||||
|
||||
libvir: Network Config error :
|
||||
cannot enable /proc/sys/net/ipv6/conf/virbr0/disable_ipv6:
|
||||
No such file or directory
|
||||
|
||||
If disable_ipv6 is not present, we should just merrily continue on our
|
||||
way.
|
||||
|
||||
* src/network_driver.c: make networkDisableIPV6() not fail if the kernel
|
||||
has no ipv6 support
|
||||
---
|
||||
src/network_driver.c | 6 ++++++
|
||||
1 files changed, 6 insertions(+), 0 deletions(-)
|
||||
|
||||
diff --git a/src/network_driver.c b/src/network_driver.c
|
||||
index eaea454..84910ab 100644
|
||||
--- a/src/network_driver.c
|
||||
+++ b/src/network_driver.c
|
||||
@@ -801,6 +801,12 @@ static int networkDisableIPV6(virConnectPtr conn,
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
+ if (access(field, W_OK) < 0 && errno == ENOENT) {
|
||||
+ VIR_DEBUG("ipv6 appears to already be disabled on %s", network->def->bridge);
|
||||
+ ret = 0;
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
+
|
||||
if (virFileWriteStr(field, "1") < 0) {
|
||||
virReportSystemError(conn, errno,
|
||||
_("cannot enable %s"), field);
|
||||
--
|
||||
1.6.2.5
|
||||
|
||||
85
libvirt-0.7.0-numa-ignore-fail.patch
Normal file
85
libvirt-0.7.0-numa-ignore-fail.patch
Normal file
@@ -0,0 +1,85 @@
|
||||
commit 19bac57b26c2d46ac8a7601158f210f34acdceac
|
||||
Author: Daniel P. Berrange <berrange@redhat.com>
|
||||
Date: Thu Aug 13 11:56:31 2009 +0100
|
||||
|
||||
Make LXC / UML drivers robust against NUMA topology brokenness
|
||||
|
||||
Some kernel versions expose broken NUMA topology for some machines.
|
||||
This causes the LXC/UML drivers to fail to start. QEMU driver was
|
||||
already fixed for this problem
|
||||
|
||||
* src/lxc_conf.c: Log and ignore failure to populate NUMA info
|
||||
* src/uml_conf.c: Log and ignore failure to populate NUMA info
|
||||
* src/capabilities.c: Reset nnumaCell to 0 after freeing
|
||||
|
||||
diff --git a/src/capabilities.c b/src/capabilities.c
|
||||
index c6766b6..193a9fe 100644
|
||||
--- a/src/capabilities.c
|
||||
+++ b/src/capabilities.c
|
||||
@@ -139,6 +139,7 @@ virCapabilitiesFreeNUMAInfo(virCapsPtr caps)
|
||||
for (i = 0 ; i < caps->host.nnumaCell ; i++)
|
||||
virCapabilitiesFreeHostNUMACell(caps->host.numaCell[i]);
|
||||
VIR_FREE(caps->host.numaCell);
|
||||
+ caps->host.nnumaCell = 0;
|
||||
}
|
||||
|
||||
/**
|
||||
diff --git a/src/lxc_conf.c b/src/lxc_conf.c
|
||||
index d06a024..fef60ba 100644
|
||||
--- a/src/lxc_conf.c
|
||||
+++ b/src/lxc_conf.c
|
||||
@@ -30,6 +30,8 @@
|
||||
#include "lxc_conf.h"
|
||||
#include "nodeinfo.h"
|
||||
#include "virterror_internal.h"
|
||||
+#include "logging.h"
|
||||
+
|
||||
|
||||
#define VIR_FROM_THIS VIR_FROM_LXC
|
||||
|
||||
@@ -46,8 +48,14 @@ virCapsPtr lxcCapsInit(void)
|
||||
0, 0)) == NULL)
|
||||
goto no_memory;
|
||||
|
||||
- if (nodeCapsInitNUMA(caps) < 0)
|
||||
- goto no_memory;
|
||||
+ /* Some machines have problematic NUMA toplogy causing
|
||||
+ * unexpected failures. We don't want to break the QEMU
|
||||
+ * driver in this scenario, so log errors & carry on
|
||||
+ */
|
||||
+ if (nodeCapsInitNUMA(caps) < 0) {
|
||||
+ virCapabilitiesFreeNUMAInfo(caps);
|
||||
+ VIR_WARN0("Failed to query host NUMA topology, disabling NUMA capabilities");
|
||||
+ }
|
||||
|
||||
/* XXX shouldn't 'borrow' KVM's prefix */
|
||||
virCapabilitiesSetMacPrefix(caps, (unsigned char []){ 0x52, 0x54, 0x00 });
|
||||
diff --git a/src/uml_conf.c b/src/uml_conf.c
|
||||
index 48e05a8..4f756d4 100644
|
||||
--- a/src/uml_conf.c
|
||||
+++ b/src/uml_conf.c
|
||||
@@ -45,6 +45,7 @@
|
||||
#include "nodeinfo.h"
|
||||
#include "verify.h"
|
||||
#include "bridge.h"
|
||||
+#include "logging.h"
|
||||
|
||||
#define VIR_FROM_THIS VIR_FROM_UML
|
||||
|
||||
@@ -63,8 +64,14 @@ virCapsPtr umlCapsInit(void) {
|
||||
0, 0)) == NULL)
|
||||
goto no_memory;
|
||||
|
||||
- if (nodeCapsInitNUMA(caps) < 0)
|
||||
- goto no_memory;
|
||||
+ /* Some machines have problematic NUMA toplogy causing
|
||||
+ * unexpected failures. We don't want to break the QEMU
|
||||
+ * driver in this scenario, so log errors & carry on
|
||||
+ */
|
||||
+ if (nodeCapsInitNUMA(caps) < 0) {
|
||||
+ virCapabilitiesFreeNUMAInfo(caps);
|
||||
+ VIR_WARN0("Failed to query host NUMA topology, disabling NUMA capabilities");
|
||||
+ }
|
||||
|
||||
if ((guest = virCapabilitiesAddGuest(caps,
|
||||
"uml",
|
||||
469
libvirt-0.7.0-policy-kit-rewrite.patch
Normal file
469
libvirt-0.7.0-policy-kit-rewrite.patch
Normal file
@@ -0,0 +1,469 @@
|
||||
diff -rupN libvirt-0.7.0/configure.in libvirt-0.7.0.new/configure.in
|
||||
--- libvirt-0.7.0/configure.in 2009-08-05 08:53:49.000000000 -0400
|
||||
+++ libvirt-0.7.0.new/configure.in 2009-08-13 08:37:22.393897620 -0400
|
||||
@@ -641,40 +641,61 @@ AC_SUBST([SASL_LIBS])
|
||||
dnl PolicyKit library
|
||||
POLKIT_CFLAGS=
|
||||
POLKIT_LIBS=
|
||||
+PKCHECK_PATH=
|
||||
AC_ARG_WITH([polkit],
|
||||
[ --with-polkit use PolicyKit for UNIX socket access checks],
|
||||
[],
|
||||
[with_polkit=check])
|
||||
|
||||
+with_polkit0=no
|
||||
+with_polkit1=no
|
||||
if test "x$with_polkit" = "xyes" -o "x$with_polkit" = "xcheck"; then
|
||||
- PKG_CHECK_MODULES(POLKIT, polkit-dbus >= $POLKIT_REQUIRED,
|
||||
- [with_polkit=yes], [
|
||||
- if test "x$with_polkit" = "xcheck" ; then
|
||||
- with_polkit=no
|
||||
- else
|
||||
- AC_MSG_ERROR(
|
||||
- [You must install PolicyKit >= $POLKIT_REQUIRED to compile libvirt])
|
||||
- fi
|
||||
- ])
|
||||
- if test "x$with_polkit" = "xyes" ; then
|
||||
+ dnl Check for new polkit first - just a binary
|
||||
+ AC_PATH_PROG([PKCHECK_PATH],[pkcheck], [], [/usr/sbin:$PATH])
|
||||
+ if test "x$PKCHECK_PATH" != "x" ; then
|
||||
+ AC_DEFINE_UNQUOTED([PKCHECK_PATH],["$PKCHECK_PATH"],[Location of pkcheck program])
|
||||
AC_DEFINE_UNQUOTED([HAVE_POLKIT], 1,
|
||||
- [use PolicyKit for UNIX socket access checks])
|
||||
-
|
||||
- old_CFLAGS=$CFLAGS
|
||||
- old_LDFLAGS=$LDFLAGS
|
||||
- CFLAGS="$CFLAGS $POLKIT_CFLAGS"
|
||||
- LDFLAGS="$LDFLAGS $POLKIT_LIBS"
|
||||
- AC_CHECK_FUNCS([polkit_context_is_caller_authorized])
|
||||
- CFLAGS="$old_CFLAGS"
|
||||
- LDFLAGS="$old_LDFLAGS"
|
||||
-
|
||||
- AC_PATH_PROG([POLKIT_AUTH], [polkit-auth])
|
||||
- if test "x$POLKIT_AUTH" != "x"; then
|
||||
- AC_DEFINE_UNQUOTED([POLKIT_AUTH],["$POLKIT_AUTH"],[Location of polkit-auth program])
|
||||
+ [use PolicyKit for UNIX socket access checks])
|
||||
+ AC_DEFINE_UNQUOTED([HAVE_POLKIT1], 1,
|
||||
+ [use PolicyKit for UNIX socket access checks])
|
||||
+ with_polkit="yes"
|
||||
+ with_polkit1="yes"
|
||||
+ else
|
||||
+ dnl Check for old polkit second - library + binary
|
||||
+ PKG_CHECK_MODULES(POLKIT, polkit-dbus >= $POLKIT_REQUIRED,
|
||||
+ [with_polkit=yes], [
|
||||
+ if test "x$with_polkit" = "xcheck" ; then
|
||||
+ with_polkit=no
|
||||
+ else
|
||||
+ AC_MSG_ERROR(
|
||||
+ [You must install PolicyKit >= $POLKIT_REQUIRED to compile libvirt])
|
||||
+ fi
|
||||
+ ])
|
||||
+ if test "x$with_polkit" = "xyes" ; then
|
||||
+ AC_DEFINE_UNQUOTED([HAVE_POLKIT], 1,
|
||||
+ [use PolicyKit for UNIX socket access checks])
|
||||
+ AC_DEFINE_UNQUOTED([HAVE_POLKIT0], 1,
|
||||
+ [use PolicyKit for UNIX socket access checks])
|
||||
+
|
||||
+ old_CFLAGS=$CFLAGS
|
||||
+ old_LDFLAGS=$LDFLAGS
|
||||
+ CFLAGS="$CFLAGS $POLKIT_CFLAGS"
|
||||
+ LDFLAGS="$LDFLAGS $POLKIT_LIBS"
|
||||
+ AC_CHECK_FUNCS([polkit_context_is_caller_authorized])
|
||||
+ CFLAGS="$old_CFLAGS"
|
||||
+ LDFLAGS="$old_LDFLAGS"
|
||||
+
|
||||
+ AC_PATH_PROG([POLKIT_AUTH], [polkit-auth])
|
||||
+ if test "x$POLKIT_AUTH" != "x"; then
|
||||
+ AC_DEFINE_UNQUOTED([POLKIT_AUTH],["$POLKIT_AUTH"],[Location of polkit-auth program])
|
||||
+ fi
|
||||
+ with_polkit0="yes"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
AM_CONDITIONAL([HAVE_POLKIT], [test "x$with_polkit" = "xyes"])
|
||||
+AM_CONDITIONAL([HAVE_POLKIT0], [test "x$with_polkit0" = "xyes"])
|
||||
+AM_CONDITIONAL([HAVE_POLKIT1], [test "x$with_polkit1" = "xyes"])
|
||||
AC_SUBST([POLKIT_CFLAGS])
|
||||
AC_SUBST([POLKIT_LIBS])
|
||||
|
||||
@@ -1695,7 +1716,11 @@ else
|
||||
AC_MSG_NOTICE([ avahi: no])
|
||||
fi
|
||||
if test "$with_polkit" = "yes" ; then
|
||||
-AC_MSG_NOTICE([ polkit: $POLKIT_CFLAGS $POLKIT_LIBS])
|
||||
+if test "$with_polkit0" = "yes" ; then
|
||||
+AC_MSG_NOTICE([ polkit: $POLKIT_CFLAGS $POLKIT_LIBS (version 0)])
|
||||
+else
|
||||
+AC_MSG_NOTICE([ polkit: $PKCHECK_PATH (version 1)])
|
||||
+fi
|
||||
else
|
||||
AC_MSG_NOTICE([ polkit: no])
|
||||
fi
|
||||
diff -rupN libvirt-0.7.0/qemud/libvirtd.policy libvirt-0.7.0.new/qemud/libvirtd.policy
|
||||
--- libvirt-0.7.0/qemud/libvirtd.policy 2009-07-22 09:37:32.000000000 -0400
|
||||
+++ libvirt-0.7.0.new/qemud/libvirtd.policy 1969-12-31 19:00:00.000000000 -0500
|
||||
@@ -1,42 +0,0 @@
|
||||
-<!DOCTYPE policyconfig PUBLIC
|
||||
- "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
|
||||
- "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
|
||||
-
|
||||
-<!--
|
||||
-Policy definitions for libvirt daemon
|
||||
-
|
||||
-Copyright (c) 2007 Daniel P. Berrange <berrange redhat com>
|
||||
-
|
||||
-libvirt is licensed to you under the GNU Lesser General Public License
|
||||
-version 2. See COPYING for details.
|
||||
-
|
||||
-NOTE: If you make changes to this file, make sure to validate the file
|
||||
-using the polkit-policy-file-validate(1) tool. Changes made to this
|
||||
-file are instantly applied.
|
||||
--->
|
||||
-
|
||||
-<policyconfig>
|
||||
- <action id="org.libvirt.unix.monitor">
|
||||
- <description>Monitor local virtualized systems</description>
|
||||
- <message>System policy prevents monitoring of local virtualized systems</message>
|
||||
- <defaults>
|
||||
- <!-- Any program can use libvirt in read-only mode for monitoring,
|
||||
- even if not part of a session -->
|
||||
- <allow_any>yes</allow_any>
|
||||
- <allow_inactive>yes</allow_inactive>
|
||||
- <allow_active>yes</allow_active>
|
||||
- </defaults>
|
||||
- </action>
|
||||
-
|
||||
- <action id="org.libvirt.unix.manage">
|
||||
- <description>Manage local virtualized systems</description>
|
||||
- <message>System policy prevents management of local virtualized systems</message>
|
||||
- <defaults>
|
||||
- <!-- Only a program in the active host session can use libvirt in
|
||||
- read-write mode for management, and we require user password -->
|
||||
- <allow_any>no</allow_any>
|
||||
- <allow_inactive>no</allow_inactive>
|
||||
- <allow_active>auth_admin_keep_session</allow_active>
|
||||
- </defaults>
|
||||
- </action>
|
||||
-</policyconfig>
|
||||
diff -rupN libvirt-0.7.0/qemud/libvirtd.policy-0 libvirt-0.7.0.new/qemud/libvirtd.policy-0
|
||||
--- libvirt-0.7.0/qemud/libvirtd.policy-0 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ libvirt-0.7.0.new/qemud/libvirtd.policy-0 2009-08-13 08:37:22.408883879 -0400
|
||||
@@ -0,0 +1,42 @@
|
||||
+<!DOCTYPE policyconfig PUBLIC
|
||||
+ "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
|
||||
+ "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
|
||||
+
|
||||
+<!--
|
||||
+Policy definitions for libvirt daemon
|
||||
+
|
||||
+Copyright (c) 2007 Daniel P. Berrange <berrange redhat com>
|
||||
+
|
||||
+libvirt is licensed to you under the GNU Lesser General Public License
|
||||
+version 2. See COPYING for details.
|
||||
+
|
||||
+NOTE: If you make changes to this file, make sure to validate the file
|
||||
+using the polkit-policy-file-validate(1) tool. Changes made to this
|
||||
+file are instantly applied.
|
||||
+-->
|
||||
+
|
||||
+<policyconfig>
|
||||
+ <action id="org.libvirt.unix.monitor">
|
||||
+ <description>Monitor local virtualized systems</description>
|
||||
+ <message>System policy prevents monitoring of local virtualized systems</message>
|
||||
+ <defaults>
|
||||
+ <!-- Any program can use libvirt in read-only mode for monitoring,
|
||||
+ even if not part of a session -->
|
||||
+ <allow_any>yes</allow_any>
|
||||
+ <allow_inactive>yes</allow_inactive>
|
||||
+ <allow_active>yes</allow_active>
|
||||
+ </defaults>
|
||||
+ </action>
|
||||
+
|
||||
+ <action id="org.libvirt.unix.manage">
|
||||
+ <description>Manage local virtualized systems</description>
|
||||
+ <message>System policy prevents management of local virtualized systems</message>
|
||||
+ <defaults>
|
||||
+ <!-- Only a program in the active host session can use libvirt in
|
||||
+ read-write mode for management, and we require user password -->
|
||||
+ <allow_any>no</allow_any>
|
||||
+ <allow_inactive>no</allow_inactive>
|
||||
+ <allow_active>auth_admin_keep_session</allow_active>
|
||||
+ </defaults>
|
||||
+ </action>
|
||||
+</policyconfig>
|
||||
diff -rupN libvirt-0.7.0/qemud/libvirtd.policy-1 libvirt-0.7.0.new/qemud/libvirtd.policy-1
|
||||
--- libvirt-0.7.0/qemud/libvirtd.policy-1 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ libvirt-0.7.0.new/qemud/libvirtd.policy-1 2009-08-13 08:37:22.412905763 -0400
|
||||
@@ -0,0 +1,42 @@
|
||||
+<!DOCTYPE policyconfig PUBLIC
|
||||
+ "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
|
||||
+ "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
|
||||
+
|
||||
+<!--
|
||||
+Policy definitions for libvirt daemon
|
||||
+
|
||||
+Copyright (c) 2007 Daniel P. Berrange <berrange redhat com>
|
||||
+
|
||||
+libvirt is licensed to you under the GNU Lesser General Public License
|
||||
+version 2. See COPYING for details.
|
||||
+
|
||||
+NOTE: If you make changes to this file, make sure to validate the file
|
||||
+using the polkit-policy-file-validate(1) tool. Changes made to this
|
||||
+file are instantly applied.
|
||||
+-->
|
||||
+
|
||||
+<policyconfig>
|
||||
+ <action id="org.libvirt.unix.monitor">
|
||||
+ <description>Monitor local virtualized systems</description>
|
||||
+ <message>System policy prevents monitoring of local virtualized systems</message>
|
||||
+ <defaults>
|
||||
+ <!-- Any program can use libvirt in read-only mode for monitoring,
|
||||
+ even if not part of a session -->
|
||||
+ <allow_any>yes</allow_any>
|
||||
+ <allow_inactive>yes</allow_inactive>
|
||||
+ <allow_active>yes</allow_active>
|
||||
+ </defaults>
|
||||
+ </action>
|
||||
+
|
||||
+ <action id="org.libvirt.unix.manage">
|
||||
+ <description>Manage local virtualized systems</description>
|
||||
+ <message>System policy prevents management of local virtualized systems</message>
|
||||
+ <defaults>
|
||||
+ <!-- Only a program in the active host session can use libvirt in
|
||||
+ read-write mode for management, and we require user password -->
|
||||
+ <allow_any>no</allow_any>
|
||||
+ <allow_inactive>no</allow_inactive>
|
||||
+ <allow_active>auth_admin_keep</allow_active>
|
||||
+ </defaults>
|
||||
+ </action>
|
||||
+</policyconfig>
|
||||
diff -rupN libvirt-0.7.0/qemud/Makefile.am libvirt-0.7.0.new/qemud/Makefile.am
|
||||
--- libvirt-0.7.0/qemud/Makefile.am 2009-07-22 09:37:32.000000000 -0400
|
||||
+++ libvirt-0.7.0.new/qemud/Makefile.am 2009-08-13 08:37:22.398915449 -0400
|
||||
@@ -21,7 +21,8 @@ EXTRA_DIST = \
|
||||
remote_protocol.x \
|
||||
libvirtd.conf \
|
||||
libvirtd.init.in \
|
||||
- libvirtd.policy \
|
||||
+ libvirtd.policy-0 \
|
||||
+ libvirtd.policy-1 \
|
||||
libvirtd.sasl \
|
||||
libvirtd.sysconf \
|
||||
libvirtd.aug \
|
||||
@@ -147,7 +148,13 @@ endif
|
||||
libvirtd_LDADD += ../src/libvirt.la
|
||||
|
||||
if HAVE_POLKIT
|
||||
+if HAVE_POLKIT0
|
||||
policydir = $(datadir)/PolicyKit/policy
|
||||
+policyfile = libvirtd.policy-0
|
||||
+else
|
||||
+policydir = $(datadir)/polkit-1/actions
|
||||
+policyfile = libvirtd.policy-1
|
||||
+endif
|
||||
endif
|
||||
|
||||
if HAVE_AVAHI
|
||||
@@ -197,7 +204,7 @@ endif
|
||||
if HAVE_POLKIT
|
||||
install-data-polkit:: install-init
|
||||
mkdir -p $(DESTDIR)$(policydir)
|
||||
- $(INSTALL_DATA) $(srcdir)/libvirtd.policy $(DESTDIR)$(policydir)/org.libvirt.unix.policy
|
||||
+ $(INSTALL_DATA) $(srcdir)/$(policyfile) $(DESTDIR)$(policydir)/org.libvirt.unix.policy
|
||||
uninstall-data-polkit:: install-init
|
||||
rm -f $(DESTDIR)$(policydir)/org.libvirt.unix.policy
|
||||
else
|
||||
diff -rupN libvirt-0.7.0/qemud/qemud.c libvirt-0.7.0.new/qemud/qemud.c
|
||||
--- libvirt-0.7.0/qemud/qemud.c 2009-07-22 09:37:32.000000000 -0400
|
||||
+++ libvirt-0.7.0.new/qemud/qemud.c 2009-08-13 08:37:22.419878018 -0400
|
||||
@@ -895,7 +895,7 @@ static struct qemud_server *qemudNetwork
|
||||
}
|
||||
#endif
|
||||
|
||||
-#ifdef HAVE_POLKIT
|
||||
+#if HAVE_POLKIT0
|
||||
if (auth_unix_rw == REMOTE_AUTH_POLKIT ||
|
||||
auth_unix_ro == REMOTE_AUTH_POLKIT) {
|
||||
DBusError derr;
|
||||
@@ -982,7 +982,7 @@ static struct qemud_server *qemudNetwork
|
||||
sock = sock->next;
|
||||
}
|
||||
|
||||
-#ifdef HAVE_POLKIT
|
||||
+#if HAVE_POLKIT0
|
||||
if (server->sysbus)
|
||||
dbus_connection_unref(server->sysbus);
|
||||
#endif
|
||||
diff -rupN libvirt-0.7.0/qemud/qemud.h libvirt-0.7.0.new/qemud/qemud.h
|
||||
--- libvirt-0.7.0/qemud/qemud.h 2009-07-23 12:33:02.000000000 -0400
|
||||
+++ libvirt-0.7.0.new/qemud/qemud.h 2009-08-13 08:37:22.425909852 -0400
|
||||
@@ -34,7 +34,7 @@
|
||||
#include <sasl/sasl.h>
|
||||
#endif
|
||||
|
||||
-#ifdef HAVE_POLKIT
|
||||
+#if HAVE_POLKIT0
|
||||
#include <dbus/dbus.h>
|
||||
#endif
|
||||
|
||||
@@ -253,7 +253,7 @@ struct qemud_server {
|
||||
#if HAVE_SASL
|
||||
char **saslUsernameWhitelist;
|
||||
#endif
|
||||
-#if HAVE_POLKIT
|
||||
+#if HAVE_POLKIT0
|
||||
DBusConnection *sysbus;
|
||||
#endif
|
||||
};
|
||||
diff -rupN libvirt-0.7.0/qemud/remote.c libvirt-0.7.0.new/qemud/remote.c
|
||||
--- libvirt-0.7.0/qemud/remote.c 2009-07-23 12:33:02.000000000 -0400
|
||||
+++ libvirt-0.7.0.new/qemud/remote.c 2009-08-13 08:37:22.431865087 -0400
|
||||
@@ -43,7 +43,7 @@
|
||||
#include <fnmatch.h>
|
||||
#include "virterror_internal.h"
|
||||
|
||||
-#ifdef HAVE_POLKIT
|
||||
+#if HAVE_POLKIT0
|
||||
#include <polkit/polkit.h>
|
||||
#include <polkit-dbus/polkit-dbus.h>
|
||||
#endif
|
||||
@@ -3106,7 +3106,80 @@ remoteDispatchAuthSaslStep (struct qemud
|
||||
#endif /* HAVE_SASL */
|
||||
|
||||
|
||||
-#if HAVE_POLKIT
|
||||
+#if HAVE_POLKIT1
|
||||
+static int
|
||||
+remoteDispatchAuthPolkit (struct qemud_server *server,
|
||||
+ struct qemud_client *client,
|
||||
+ virConnectPtr conn ATTRIBUTE_UNUSED,
|
||||
+ remote_error *rerr,
|
||||
+ void *args ATTRIBUTE_UNUSED,
|
||||
+ remote_auth_polkit_ret *ret)
|
||||
+{
|
||||
+ pid_t callerPid;
|
||||
+ uid_t callerUid;
|
||||
+ const char *action;
|
||||
+ int status = -1;
|
||||
+ char pidbuf[50];
|
||||
+ int rv;
|
||||
+
|
||||
+ virMutexLock(&server->lock);
|
||||
+ virMutexLock(&client->lock);
|
||||
+ virMutexUnlock(&server->lock);
|
||||
+
|
||||
+ action = client->readonly ?
|
||||
+ "org.libvirt.unix.monitor" :
|
||||
+ "org.libvirt.unix.manage";
|
||||
+
|
||||
+ const char * const pkcheck [] = {
|
||||
+ PKCHECK_PATH,
|
||||
+ "--action-id", action,
|
||||
+ "--process", pidbuf,
|
||||
+ "--allow-user-interaction",
|
||||
+ NULL
|
||||
+ };
|
||||
+
|
||||
+ REMOTE_DEBUG("Start PolicyKit auth %d", client->fd);
|
||||
+ if (client->auth != REMOTE_AUTH_POLKIT) {
|
||||
+ VIR_ERROR0(_("client tried invalid PolicyKit init request"));
|
||||
+ goto authfail;
|
||||
+ }
|
||||
+
|
||||
+ if (qemudGetSocketIdentity(client->fd, &callerUid, &callerPid) < 0) {
|
||||
+ VIR_ERROR0(_("cannot get peer socket identity"));
|
||||
+ goto authfail;
|
||||
+ }
|
||||
+
|
||||
+ VIR_INFO(_("Checking PID %d running as %d"), callerPid, callerUid);
|
||||
+
|
||||
+ rv = snprintf(pidbuf, sizeof pidbuf, "%d", callerPid);
|
||||
+ if (rv < 0 || rv >= sizeof pidbuf) {
|
||||
+ VIR_ERROR(_("Caller PID was too large %d"), callerPid);
|
||||
+ goto authfail;
|
||||
+ }
|
||||
+
|
||||
+ if (virRun(NULL, pkcheck, &status) < 0) {
|
||||
+ VIR_ERROR(_("Cannot invoke %s"), PKCHECK_PATH);
|
||||
+ goto authfail;
|
||||
+ }
|
||||
+ if (status != 0) {
|
||||
+ VIR_ERROR(_("Policy kit denied action %s from pid %d, uid %d, result: %d\n"),
|
||||
+ action, callerPid, callerUid, status);
|
||||
+ goto authfail;
|
||||
+ }
|
||||
+ VIR_INFO(_("Policy allowed action %s from pid %d, uid %d"),
|
||||
+ action, callerPid, callerUid);
|
||||
+ ret->complete = 1;
|
||||
+ client->auth = REMOTE_AUTH_NONE;
|
||||
+
|
||||
+ virMutexUnlock(&client->lock);
|
||||
+ return 0;
|
||||
+
|
||||
+authfail:
|
||||
+ remoteDispatchAuthError(rerr);
|
||||
+ virMutexUnlock(&client->lock);
|
||||
+ return -1;
|
||||
+}
|
||||
+#elif HAVE_POLKIT0
|
||||
static int
|
||||
remoteDispatchAuthPolkit (struct qemud_server *server,
|
||||
struct qemud_client *client,
|
||||
@@ -3217,7 +3290,7 @@ authfail:
|
||||
return -1;
|
||||
}
|
||||
|
||||
-#else /* HAVE_POLKIT */
|
||||
+#else /* !HAVE_POLKIT0 & !HAVE_POLKIT1*/
|
||||
|
||||
static int
|
||||
remoteDispatchAuthPolkit (struct qemud_server *server ATTRIBUTE_UNUSED,
|
||||
@@ -3231,7 +3304,7 @@ remoteDispatchAuthPolkit (struct qemud_s
|
||||
remoteDispatchAuthError(rerr);
|
||||
return -1;
|
||||
}
|
||||
-#endif /* HAVE_POLKIT */
|
||||
+#endif /* HAVE_POLKIT1 */
|
||||
|
||||
|
||||
/***************************************************************
|
||||
diff -rupN libvirt-0.7.0/src/remote_internal.c libvirt-0.7.0.new/src/remote_internal.c
|
||||
--- libvirt-0.7.0/src/remote_internal.c 2009-07-29 10:42:15.000000000 -0400
|
||||
+++ libvirt-0.7.0.new/src/remote_internal.c 2009-08-13 10:55:57.607899170 -0400
|
||||
@@ -6201,6 +6201,7 @@ remoteAuthPolkit (virConnectPtr conn, st
|
||||
virConnectAuthPtr auth)
|
||||
{
|
||||
remote_auth_polkit_ret ret;
|
||||
+#if HAVE_POLKIT0
|
||||
int i, allowcb = 0;
|
||||
virConnectCredential cred = {
|
||||
VIR_CRED_EXTERNAL,
|
||||
@@ -6210,8 +6211,10 @@ remoteAuthPolkit (virConnectPtr conn, st
|
||||
NULL,
|
||||
0,
|
||||
};
|
||||
+#endif
|
||||
DEBUG0("Client initialize PolicyKit authentication");
|
||||
|
||||
+#if HAVE_POLKIT0
|
||||
if (auth && auth->cb) {
|
||||
/* Check if the necessary credential type for PolicyKit is supported */
|
||||
for (i = 0 ; i < auth->ncredtype ; i++) {
|
||||
@@ -6220,6 +6223,7 @@ remoteAuthPolkit (virConnectPtr conn, st
|
||||
}
|
||||
|
||||
if (allowcb) {
|
||||
+ DEBUG0("Client run callback for PolicyKit authentication");
|
||||
/* Run the authentication callback */
|
||||
if ((*(auth->cb))(&cred, 1, auth->cbdata) < 0) {
|
||||
virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE,
|
||||
@@ -6233,6 +6237,9 @@ remoteAuthPolkit (virConnectPtr conn, st
|
||||
} else {
|
||||
DEBUG0("No auth callback provided");
|
||||
}
|
||||
+#else
|
||||
+ DEBUG0("No auth callback required for PolicyKit-1");
|
||||
+#endif
|
||||
|
||||
memset (&ret, 0, sizeof ret);
|
||||
if (call (conn, priv, in_open, REMOTE_PROC_AUTH_POLKIT,
|
||||
876
libvirt.spec
876
libvirt.spec
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user