Skip to content

L
libvirt

openeuler / libvirt

通知 3
Star 0
Fork 0
L
libvirt
切换分支/标签
  1. 22 4月, 2020 8 次提交
  3. 21 4月, 2020 11 次提交
  5. 20 4月, 2020 16 次提交
  7. 18 4月, 2020 1 次提交
  9. 17 4月, 2020 4 次提交
    • M
      qemu: Label restore path outside of secdriver transactions · 28fdfd20
      由 Michal Privoznik 提交于 
      As explained in the previous commit, we need to relabel the file
we are restoring the domain from. That is the FD that is passed
to QEMU. If the file is not under /dev then the file inside the
namespace is the very same as the one in the host. And regardless
of using transactions, the file will be relabeled. But, if the
file is under /dev then when using transactions only the copy
inside the namespace is relabeled and the one in the host is not.
But QEMU is reading from the one in the host, actually.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1772838Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
Reviewed-by: NErik Skultety <eskultet@redhat.com>
      28fdfd20
    • M
      security: Introduce virSecurityManagerDomainSetPathLabelRO · 55cbb94e
      由 Michal Privoznik 提交于 
      This API allows drivers to separate out handling of @stdin_path
of virSecurityManagerSetAllLabel(). The thing is, the QEMU driver
uses transactions for virSecurityManagerSetAllLabel() which
relabels devices from inside of domain's namespace. This is what
we usually want. Except when resuming domain from a file. The
file is opened before any namespace is set up and the FD is
passed to QEMU to read the migration stream from. Because of
this, the file lives outside of the namespace and if it so
happens that the file is a block device (i.e. it lives under
/dev) its copy will be created in the namespace. But the FD that
is passed to QEMU points to the original living in the host and
not in the namespace. So relabeling the file inside the namespace
helps nothing.

But if we have a separate API for relabeling the restore file
then the QEMU driver can continue calling
virSecurityManagerSetAllLabel() with transactions enabled and
call this new API without transactions.

We already have an API for relabeling a single file
(virSecurityManagerDomainSetPathLabel()) but in case of SELinux
it uses @imagelabel (which allows RW access) and we want to use
@content_context (which allows RO access).
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
Reviewed-by: NErik Skultety <eskultet@redhat.com>
      55cbb94e
    • J
      util: Fix virDaemonForkIntoBackground · 36e12529
      由 Jiri Denemark 提交于 
      This commit partially reverts

    commit c360ea28
    Refs: v6.2.0-rc1-1-gc360ea28
    Author:     Rafael Fonseca <r4f4rfs@gmail.com>
    AuthorDate: Fri Mar 27 18:40:47 2020 +0100
    Commit:     Michal Prívozník <mprivozn@redhat.com>
    CommitDate: Mon Mar 30 09:48:22 2020 +0200

    util: virdaemon: fix compilation on mingw

    The daemons are not supported on Win32 and therefore were not compiled
    in that platform. However, with the daemon code sharing, all the code in
    utils *is* compiled and it failed because `waitpid`, `fork`, and
    `setsid` are not available. So, as before, let's not build them on
    Win32 and make the code more portable by using existing vir* wrappers.

Not compiling virDaemonForkIntoBackground on Win32 is good, but the
second part of the original patch incorrectly replaced waitpid and fork
with our virProcessWait and virFork APIs. These APIs are more than just
simple wrappers and we don't want any of the extra functionality.
Especially virFork would reset any setup made before
virDaemonForkIntoBackground is called, such as logging, signal handling,
etc.

As a result of the change the additional fix in v6.2.0-67-ga87e4788
(util: virdaemon: fix waiting for child processes) is no longer
needed and it is effectively reverted by this commit.
Signed-off-by: NJiri Denemark <jdenemar@redhat.com>
Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>
      36e12529
    • B
      docs: Improve zPCI section in pci-addresses.rst · e94ddeac
      由 Boris Fiuczynski 提交于 
      Improving the zPCI example by choosing more distinct values and
adding explanation for fid.
Signed-off-by: NBoris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: NCornelia Huck <cohuck@redhat.com>
Reviewed-by: NAndrea Bolognani <abologna@redhat.com>
      e94ddeac