- 16 5月, 2012 1 次提交
-
-
由 Daniel Walsh 提交于
To allow the security drivers to apply different configuration information per hypervisor, pass the virtualization driver name into the security manager constructor. Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
- 01 5月, 2012 2 次提交
-
-
由 Daniel P. Berrange 提交于
The virLogSetFromEnv call was done too late in startup to catch many log messages (eg from security driver initialization). To assist debugging also explicitly log the security details at startup
-
由 Daniel P. Berrange 提交于
Currently the libvirt_lxc process uses VIR_DOMAIN_XML_INACTIVE when loading the XML for the container. This means it loses any dynamic data such as the, just allocated, SELinux label. Further there is an inconsistency in the libvirt LXC driver whereby it saves the live config XML and then later overwrites the file with the live status XML instead. Add a comment about this for future reference. * src/lxc/lxc_controller.c: Remove VIR_DOMAIN_XML_INACTIVE when loading XML * src/lxc/lxc_driver.c: Add comment about inconsistent config file formats Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
- 28 4月, 2012 1 次提交
-
-
由 Stefan Berger 提交于
Error: UNINIT: /libvirt/src/lxc/lxc_driver.c:1412: var_decl: Declaring variable "fd" without initializer. /libvirt/src/lxc/lxc_driver.c:1460: uninit_use_in_call: Using uninitialized value "fd" when calling "virFileClose". /libvirt/src/util/virfile.c:50: read_parm: Reading a parameter value. Error: DEADCODE: /libvirt/src/lxc/lxc_controller.c:960: dead_error_condition: On this path, the condition "ret == 4" cannot be true. /libvirt/src/lxc/lxc_controller.c:959: at_most: After this line, the value of "ret" is at most -1. /libvirt/src/lxc/lxc_controller.c:959: new_values: Noticing condition "ret < 0". /libvirt/src/lxc/lxc_controller.c:961: dead_error_line: Execution cannot reach this statement "continue;". Error: UNINIT: /libvirt/src/lxc/lxc_controller.c:1104: var_decl: Declaring variable "consoles" without initializer. /libvirt/src/lxc/lxc_controller.c:1237: uninit_use: Using uninitialized value "consoles".
-
- 12 3月, 2012 1 次提交
-
-
由 Daniel Veillard 提交于
this was raised by our hindi localization team chandan kumar <chandankumar.093047@gmail.com>
-
- 03 2月, 2012 3 次提交
-
-
由 Martin Kletzander 提交于
This patch fixes the access of variable "con" in two files where the variable was declared only on SELinux builds and thus the build failed without SELinux. It's a rather nasty fix but helps fix the build quickly and without any major changes to the code.
-
由 Daniel P. Berrange 提交于
To allow the container to access /dev and /dev/pts when under sVirt, set an explicit mount option. Also set a max size on the /dev mount to prevent DOS on memory usage * src/lxc/lxc_container.c: Set /dev mount context * src/lxc/lxc_controller.c: Set /dev/pts mount context
-
由 Daniel P. Berrange 提交于
For the sake of backwards compat, LXC guests are *not* confined by default. This is because it is not practical to dynamically relabel containers using large filesystem trees. Applications can create confined containers though, by giving suitable XML configs * src/Makefile.am: Link libvirt_lxc to security drivers * src/lxc/libvirtd_lxc.aug, src/lxc/lxc_conf.h, src/lxc/lxc_conf.c, src/lxc/lxc.conf, src/lxc/test_libvirtd_lxc.aug: Config file handling for security driver * src/lxc/lxc_driver.c: Wire up security driver functions * src/lxc/lxc_controller.c: Add a '--security' flag to specify which security driver to activate * src/lxc/lxc_container.c, src/lxc/lxc_container.h: Set the process label just before exec'ing init.
-
- 13 1月, 2012 1 次提交
-
-
由 Daniel P. Berrange 提交于
Currently the LXC controller attempts to deal with EOF on a tty by spawning a thread to do an edge triggered epoll_wait(). This avoids the normal event loop spinning on POLLHUP. There is a subtle mistake though - even after seeing POLLHUP on a master PTY, it is still perfectly possible & valid to write data to the PTY. There is a buffer that can be filled with data, even when no client is present. The second mistake is that the epoll_wait() thread was not looking for the EPOLLOUT condition, so when a new client connects to the LXC console, it had to explicitly send a character before any queued output would appear. Finally, there was in fact no need to spawn a new thread to deal with epoll_wait(). The epoll file descriptor itself can be poll()'d on normally. This patch attempts to deal with all these problems. - The blocking epoll_wait() thread is replaced by a poll on the epoll file descriptor which then does a non-blocking epoll_wait() to handle events - Even if POLLHUP is seen, we continue trying to write any pending output until getting EAGAIN from write. - Once write returns EAGAIN, we modify the epoll event mask to also look for EPOLLOUT * src/lxc/lxc_controller.c: Avoid stalled I/O upon connected to an LXC console
-
- 08 12月, 2011 1 次提交
-
-
由 Daniel P. Berrange 提交于
* src/lxc/lxc_controller.c: Fix check for tty count
-
- 28 11月, 2011 5 次提交
-
-
由 Daniel P. Berrange 提交于
To make lxcSetContainerResources smaller, pull the mem tune and device ACL setup code out into separate methods * src/lxc/lxc_controller.c: Introduce lxcSetContainerMemTune and lxcSetContainerDeviceACL
-
由 Daniel P. Berrange 提交于
* src/lxc/lxc_controller.c: Refactor setting of initial blkio tuning parameters * src/lxc/lxc_driver.c: Enable live change of blkio tuning
-
由 Daniel P. Berrange 提交于
* src/lxc/lxc_driver.c: Support changing quota/period for LXC containers * src/lxc/lxc_controller.c: Set initial quota/period at startup
-
由 Daniel P. Berrange 提交于
While LXC does not have the concept of VCPUS, so we can't do per-VCPU pCPU placement, we can support the VM level CPU placement. Todo this simply set the CPU affinity of the LXC controller at startup. All child processes will inherit this affinity. * src/lxc/lxc_controller.c: Set process affinity
-
由 Daniel P. Berrange 提交于
Use numactl to set NUMA memory placement for LXC containers * src/lxc/lxc_controller.c: Support NUMA memory placement
-
- 15 11月, 2011 2 次提交
-
-
由 Daniel P. Berrange 提交于
Move the virNetDevSetName and virNetDevSetNamespace APIs out of LXC's veth.c and into virnetdev.c. Move the remaining content of the file to src/util/virnetdevveth.c * src/lxc/veth.c: Rename to src/util/virnetdevveth.c * src/lxc/veth.h: Rename to src/util/virnetdevveth.h * src/util/virnetdev.c, src/util/virnetdev.h: Add virNetDevSetName and virNetDevSetNamespace * src/lxc/lxc_container.c, src/lxc/lxc_controller.c, src/lxc/lxc_driver.c: Update include paths
-
由 Daniel P. Berrange 提交于
The src/lxc/veth.c file contains APIs for managing veth devices, but some of the APIs duplicate stuff from src/util/virnetdev.h. Delete thed duplicate APIs and rename the remaining ones to follow virNetDevVethXXXX * src/lxc/veth.c, src/lxc/veth.h: Rename APIs & delete duplicates * src/lxc/lxc_container.c, src/lxc/lxc_controller.c, src/lxc/lxc_driver.c: Update for API renaming
-
- 03 11月, 2011 3 次提交
-
-
由 Eric Blake 提交于
Based on a Coverity report - the return value of waitpid() should always be checked, to avoid problems with leaking resources. * src/lxc/lxc_controller.c (lxcControllerRun): Use simpler virPidAbort.
-
由 Daniel P. Berrange 提交于
Currently the LXC controller only supports setup of a single text console. This is wired up to the container init's stdio, as well as /dev/console and /dev/tty1. Extending support for multiple consoles, means wiring up additional PTYs to /dev/tty2, /dev/tty3, etc, etc. The LXC controller is passed multiple open file handles, one for each console requested. * src/lxc/lxc_container.c, src/lxc/lxc_container.h: Wire up all the /dev/ttyN links required to symlink to /dev/pts/NN * src/lxc/lxc_container.h: Open more container side /dev/pts/NN devices, and adapt event loop to handle I/O from all consoles * src/lxc/lxc_driver.c: Setup multiple host side PTYs
-
由 Daniel P. Berrange 提交于
The current I/O code for LXC uses a hand crafted event loop to forward I/O between the container & host app, based on epoll to handle EOF on PTYs. This event loop is not easily extensible to add more consoles, or monitor other types of file descriptors. Remove the custom event loop and replace it with a normal libvirt event loop. When detecting EOF on a PTY, disable the event watch on that FD, and fork off a background thread that does a edge-triggered epoll() on the FD. When the FD finally shows new incoming data, the thread re-enables the watch on the FD and exits. When getting EOF from a read() on the PTY, the existing code would do waitpid(WNOHANG) to see if the container had exited. Unfortunately there is a race condition, because even though the process has closed its stdio handles, it might still exist. To deal with this the new event loop uses a SIG_CHILD handler to perform the waitpid only when the container is known to have actually exited. * src/lxc/lxc_controller.c: Rewrite the event loop to use the standard APIs.
-
- 27 10月, 2011 2 次提交
-
-
由 Peter Krempa 提交于
Previous commit clears number of items alocated in lxcSetupLoopDevices if VIR_REALLOC_N fails. In that case, the pointer is not NULL, and causes leaking FDs that have been allocated. * src/lxc/lxc_controller.c: revert zeroing array size
-
由 Alex Jia 提交于
If the function lxcSetupLoopDevices(def, &nloopDevs, &loopDevs) failed, the variable loopDevs will keep a initial NULL value, however, the function VIR_FORCE_CLOSE(loopDevs[i]) will directly deref it. This patch also fixes returning a bogous number of devices from lxcSetupLoopDevices on an error path. * rc/lxc/lxc_controller.c: fixed a null pointer dereference. Signed-off-by: NAlex Jia <ajia@redhat.com>
-
- 20 10月, 2011 1 次提交
-
-
由 Serge E. Hallyn 提交于
The glibc ones (intentionally) cannot handle ptys opened in a devpts not mounted at /dev/pts. Drop the (un-exported, unused) virFileOpenTtyAt. Signed-off-by: NSerge Hallyn <serge.hallyn@canonical.com> Signed-off-by: NEric Blake <eblake@redhat.com>
-
- 13 10月, 2011 1 次提交
-
-
由 Serge E. Hallyn 提交于
s/Mouting/Mounting. Signed-off-by: NSerge Hallyn <serge.hallyn@canonical.com>
-
- 08 10月, 2011 1 次提交
-
-
由 Eric Blake 提交于
Detected by Coverity. We want to increment the size_t counter, not the pointer to the counter. Bug present since 5f5c6fde (0.9.5). * src/lxc/lxc_controller.c (lxcSetupLoopDevices): Use correct precedence.
-
- 16 9月, 2011 1 次提交
-
-
由 Peter Krempa 提交于
/usr/lib/stdlib.h in Mac OS X and probably also in BSD's exports this symbol :(
-
- 13 8月, 2011 1 次提交
-
-
由 Daniel P. Berrange 提交于
The functions for manipulating pidfiles are in util/util.{c,h}. We will shortly be adding some further pidfile related functions. To avoid further growing util.c, this moves the pidfile related functions into a dedicated virpidfile.{c,h}. The functions are also all renamed to have 'virPidFile' as their name prefix * util/util.h, util/util.c: Remove all pidfile code * util/virpidfile.c, util/virpidfile.h: Add new APIs for pidfile handling. * lxc/lxc_controller.c, lxc/lxc_driver.c, network/bridge_driver.c, qemu/qemu_process.c: Add virpidfile.h include and adapt for API renames
-
- 08 8月, 2011 3 次提交
-
-
由 Daniel P. Berrange 提交于
A previous commit gave the LXC driver the ability to mount block devices for the container filesystem. Through use of the loopback device functionality, we can build on this to support use of plain file images for LXC filesytems. By setting the LO_FLAGS_AUTOCLEAR flag we can ensure that the loop device automatically disappears when the container dies / shuts down * src/lxc/lxc_container.c: Raise error if we see a file based filesystem, since it should have been turned into a loopback device already * src/lxc/lxc_controller.c: Rewrite any filesystems of type=file, into type=block, by binding the file image to a free loop device
-
由 Daniel P. Berrange 提交于
* src/lxc/lxc_controller.c: s/PYT/PTY/
-
由 Daniel P. Berrange 提交于
Currently the LXC driver can only populate filesystems from host filesystems, using bind mounts. This patch allows host block devices to be mounted. It autodetects the filesystem format at mount time, and adds the block device to the cgroups ACL. Example usage is <filesystem type='block' accessmode='passthrough'> <source dev='/dev/sda1'/> <target dir='/home'/> </filesystem> * src/lxc/lxc_container.c: Mount block device filesystems * src/lxc/lxc_controller.c: Add block device filesystems to cgroups ACL
-
- 26 7月, 2011 1 次提交
-
-
由 Laine Stump 提交于
Although most functions in libvirt return 0 on success and < 0 on failure, there are a few functions lingering around that return errno (a positive value) on failure, and sometimes code calling those functions incorrectly assumes the <0 standard. I noticed one of these the other day when auditing networkStartDhcpDaemon after Guido Gunther found a place where success was improperly returned on failure (that patch has been acked and is pending a push). The problem was that it expected the return value from virFileReadPid to be < 0 on failure, but it was actually positive (it was also neglected to set the return code in this case, similar to the bug found by Guido). This all led to the fact that *all* of the virFile*Pid functions in util.c are returning errno on failure. This patch remedies that problem by changing them all to return -errno on failure, and makes any necessary changes to callers of the functions. (In the meantime, I also properly set the return code on failure of virFileReadPid in networkStartDhcpDaemon).
-
- 22 7月, 2011 1 次提交
-
-
由 Eric Blake 提交于
In preparation for a future patch adding new virFile APIs. * src/util/files.h, src/util/files.c: Move... * src/util/virfile.h, src/util/virfile.c: ...here, and rename functions to virFile prefix. Macro names are intentionally left alone. * *.c: All '#include "files.h"' uses changed. * src/Makefile.am (UTIL_SOURCES): Reflect rename. * cfg.mk (exclude_file_name_regexp--sc_prohibit_close): Likewise. * src/libvirt_private.syms: Likewise. * docs/hacking.html.in: Likewise. * HACKING: Regenerate.
-
- 12 7月, 2011 1 次提交
-
-
由 Matthias Bolte 提交于
The drivers were accepting domain configs without checking if those were actually meant for them. For example the LXC driver happily accepts configs with type QEMU. Add a check for the expected domain types to the virDomainDefParse* functions.
-
- 06 7月, 2011 1 次提交
-
-
由 Matthias Bolte 提交于
Some callers expected virFileMakePath to set errno, some expected it to return an errno value. Unify this to return 0 on success and -1 on error. Set errno to report detailed error information. Also optimize virFileMakePath if stat fails with an errno different from ENOENT.
-
- 08 6月, 2011 4 次提交
-
-
由 Cole Robinson 提交于
Otherwise the following virFileMakePath will create the directory for us and fail further ahead, which probably isn't intended.
-
由 Cole Robinson 提交于
Add a handshake with the cloned container process to try and detect if it fails to start.
-
由 Cole Robinson 提交于
Add a simple handshake with the lxc_controller process so we can detect process startup failures. We do this by adding a new --handshake cli arg to lxc_controller for passing a file descriptor. If the process fails to launch, we scrape all output from the logfile and report it to the user.
-
由 Cole Robinson 提交于
We will reuse these shortly, and each use should have a different error message.
-
- 12 5月, 2011 1 次提交
-
-
由 Lai Jiangshan 提交于
These VIR_XXXX0 APIs make us confused, use the non-0-suffix APIs instead. How do these coversions works? The magic is using the gcc extension of ##. When __VA_ARGS__ is empty, "##" will swallow the "," in "fmt," to avoid compile error. example: origin after CPP high_level_api("%d", a_int) low_level_api("%d", a_int) high_level_api("a string") low_level_api("a string") About 400 conversions. 8 special conversions: VIR_XXXX0("") -> VIR_XXXX("msg") (avoid empty format) 2 conversions VIR_XXXX0(string_literal_with_%) -> VIR_XXXX(%->%%) 0 conversions VIR_XXXX0(non_string_literal) -> VIR_XXXX("%s", non_string_literal) (for security) 6 conversions Signed-off-by: NLai Jiangshan <laijs@cn.fujitsu.com>
-
- 29 3月, 2011 1 次提交
-
-
由 Osier Yang 提交于
LXC driver doesn't support vcpu affinity yet, so just need to modify it to support cpu shares.
-