Add a new security driver method for labelling an FD with
the process label, rather than the image label

* src/libvirt_private.syms, src/security/security_apparmor.c,
  src/security/security_dac.c, src/security/security_driver.h,
  src/security/security_manager.c, src/security/security_manager.h,
  src/security/security_selinux.c, src/security/security_stack.c:
  Add virSecurityManagerSetProcessFDLabel & impl

The virSecurityManagerSetFDLabel method is used to label
file descriptors associated with disk images. There will
shortly be a need to label other file descriptors in a
different way. So the current name is ambiguous. Rename
the method to virSecurityManagerSetImageFDLabel to clarify
its purpose

* src/libvirt_private.syms,
  src/qemu/qemu_migration.c, src/qemu/qemu_process.c,
  src/security/security_apparmor.c, src/security/security_dac.c,
  src/security/security_driver.h, src/security/security_manager.c,
  src/security/security_manager.h, src/security/security_selinux.c,
  src/security/security_stack.c: s/FDLabel/ImageFDLabel/

When CURRENT and FORCE flags were used together, UpdateDeviceFlags did
nothing because it failed to transform CURRENT into either LIVE or
CONFIG.

This is in response to bugzilla 664629

https://bugzilla.redhat.com/show_bug.cgi?id=664629

The patch below returns an appropriate error message if the chain of
nwfilters is found to contain unresolvable variables and therefore
cannot be instantiated.

Example: The following XMl added to a domain:

    <interface type='bridge'>
      <mac address='52:54:00:9f:80:45'/>
      <source bridge='virbr0'/>
      <model type='virtio'/>
      <filterref filter='test'/>
    </interface>

that references the following filter

<filter name='test' chain='root'>
  <filterref filter='clean-traffic'/>
  <filterref filter='allow-dhcp-server'/>
</filter>

now displays upon 'virsh start mydomain'

error: Failed to start domain mydomain
error: internal error Cannot instantiate filter due to unresolvable variable: DHCPSERVER

'DHPCSERVER' is contained in allow-dhcp-server.

We already have a public virDomainPinVcpu, which implies that
Pin and Vcpu are treated as separate words.  Unreleased commit
e261987c introduced virDomainGetVcpupinInfo as the first public
API that used Vcpupin, although we had prior internal uses of
that spelling.  For consistency, change the spelling to be two
words everywhere, regardless of whether pin comes first or last.

* daemon/remote.c: Treat vcpu and pin as separate words.
* include/libvirt/libvirt.h.in: Likewise.
* src/conf/domain_conf.c: Likewise.
* src/conf/domain_conf.h: Likewise.
* src/driver.h: Likewise.
* src/libvirt.c: Likewise.
* src/libvirt_private.syms: Likewise.
* src/libvirt_public.syms: Likewise.
* src/libxl/libxl_driver.c: Likewise.
* src/qemu/qemu_driver.c: Likewise.
* src/remote/remote_driver.c: Likewise.
* src/xen/xend_internal.c: Likewise.
* tools/virsh.c: Likewise.
* src/remote/remote_protocol.x: Likewise.
* src/remote_protocol-structs: Likewise.
Suggested by Matthias Bolte.

Fix lack of 'virSysinfo' prefix of functions/structs in src/util/sysinfo.[ch]

Fix lack of error check in virSysinfoFormat().
Signed-off-by: NMinoru Usui <usui@mxm.nes.nec.co.jp>

Convert networkDnsmasqLeaseFileName to a replaceable function pointer
that allow the testsuite to use a version of that function that is not
depending on configure --localstatedir.

This fixes 5 of 6 test failures, when configure --localstatedir isn't
set to /var.

This is no code between virSaveLastError and virGetLastError will
set an error, remove the bogus codes.

This block was inadvertently added with the wrong indentation.

Parthelper is only compiled if both --with-libvirtd
and --with-storage-disk are set.
Signed-off-by: NRuben Kerkhof <ruben@rubenkerkhof.com>

Caught by gcc -O2, during autobuild.sh.

* src/qemu/qemu_driver.c (qemudDomainGetVcpupinInfo): Initialize vm.

The build currently fails when trying to create virnetprotocol.c
into $(builddir)/rpc, which doesn't exist.  But since the file
is part of the tarball, it should be generated into $(srcdir).
Caught by autobuild.sh.

* src/Makefile.am (VIR_NET_RPC_GENERATED): Generate into srcdir.

This patch teaches "virsh vcpupin" command to query if no list
is given. Its feature is to show CPU affinity information in more
reader-friendly way.

 # virsh vcpupin VM --config
 VCPU: CPU Affinity
 ----------------------------------
    0: 1-6,9-20
    1: 10
    2: 5,9-11,15-20
    3: 1,3,5,7,9,11,13,15

When cpulist is omitted, vcpu number is optional. When vcpu number is
provided, information of only specified vcpu is displayed.
Signed-off-by: NTaku Izumi <izumi.taku@jp.fujitsu.com>
Signed-off-by: NEric Blake <eblake@redhat.com>

The "virsh vcpuinfo" command results in failure when the target domain
is inactive on KVM. This patch improves this behavior by adding the
fallback to invoke virDomainGetVcpupinInfo API in case of
virDomainGetVcpus API returns error and the target domain is inactive.
Signed-off-by: NTaku Izumi <izumi.taku@jp.fujitsu.com>

This patch implements the remote protocol to address the new API
(virDomainGetVcpupinInfo).
Signed-off-by: NTaku Izumi <izumi.taku@jp.fujitsu.com>

This patch implements the code to address the new API (virDomainGetVcpupinInfo)
in the qemu driver.
Signed-off-by: NTaku Izumi <izumi.taku@jp.fujitsu.com>

This patch introduces a new libvirt API (virDomainGetVcpupinInfo),
as a counterpart to virDomainPinVcpuFlags.

We can use virDomainGetVcpus API to retrieve CPU affinity information,
but can't use this API against inactive domains (at least in case of KVM),
as it lacks a flags parameter.
The usual thing is to add a new virDomainGetVcpusFlags, but that API name
is already occupied by the counterpart to virDomainGetMaxVcpus, which
has a completely different signature.

The virDomainGetVcpupinInfo is the new API to retrieve CPU affinity
information of active and inactive domains.  While the usual convention
is to list an array before its length, this API violates that rule
in order to be more like virDomainGetVcpus (where maxinfo was doing
double-duty as the length of two different arrays).
Signed-off-by: NTaku Izumi <izumi.taku@jp.fujitsu.com>

The sub-elements of <ip> had been placed at the same level of
indentation as ip itself, implying that they were really elements of
<network>. Within that, sub-elements of ip/dhcp were also at that same
level. These have been double-indented.

At the same time, I realized that the documentation for the new <dns>
element had been placed right in the middle of the description of the
sub-elements of <ip>. I moved it up out of the way.

It's unlikely that we'll ever want to escape a string as long as
INT_MAX/6, but adding this check can't hurt.

* src/util/buf.c (virBufferEscapeSexpr, virBufferEscapeString):
Check for (unlikely) overflow.

Integer overflow and remote code are never a nice mix.

This has existed since commit 56cd4140.

* src/libvirt.c (virDomainGetVcpus): Reject overflow up front.
* src/remote/remote_driver.c (remoteDomainGetVcpus): Avoid overflow
on sending rpc.
* daemon/remote.c (remoteDispatchDomainGetVcpus): Avoid overflow on
receiving rpc.

Done as a separate commit to make backporting the next patch easier.
We are already using "intprops.h", but this makes it explicit.

* .gnulib: Update, for syntax-check fix.
* bootstrap.conf (gnulib_modules): Make intprops use explicit.
* src/locking/domain_lock.c (includes): Drop unused header.
* src/nwfilter/nwfilter_learnipaddr.c (includes): Use "", not <>,
for gnulib.

'make syntax-check' regression introduced in commit 60b9c693.

* tests/networkxml2argvdata/*.argv: Break long lines.

Triggered a linker error on MinGW.

This commit introduces names definition for the DNS hosts file using
the following syntax:

  <dns>
    <host ip="192.168.1.1">
      <name>alias1</name>
      <name>alias2</name>
    </host>
  </dns>

Some of the improvements and fixes were done by Laine Stump so
I'm putting him into the SOB clause again ;-)
Signed-off-by: NMichal Novotny <minovotn@redhat.com>
Signed-off-by: NLaine Stump <laine@laine.org>

Signed-off-by: NMichal Novotny <minovotn@redhat.com>

The regression testing done by comparison of command-line
generated from the network XML file and the expected
command-line arguments (read from file).
Signed-off-by: NMichal Novotny <minovotn@redhat.com>

The dnsmasq commandline was being built as a part of running
dnsmasq. This patch puts the commandline build into a separate
function (and exports it as a private API) making it possible to build
a dnsmasq commandline without executing it, so that we can write a
test program to verify that the proper commandlines are being created.
Signed-off-by: NMichal Novotny <minovotn@redhat.com>

This commit introduces the <dns> element and <txt> record for the
virtual DNS network. The DNS TXT record can be defined using following
syntax in the network XML file:

  <dns>
    <txt name="example" value="example value" />
  </dns>

Also, the Relax-NG scheme has been altered to allow the texts without
spaces only for the name element and some nitpicks about memory
free'ing have been fixed by Laine so therefore I'm adding Laine to the
SOB clause ;-)
Signed-off-by: NMichal Novotny <minovotn@redhat.com>
Signed-off-by: NLaine Stump <laine@laine.org>

Commit cd48c3f4 added a Py_ssize_t typedef for Python < 2.7.
But Py_ssize_t was added in Python 2.5. This makes the build fail
for Python 2.6.

Adjust the check to match Python < 2.5 to fix this.

getifaddrs can return an IPv6 address, but getaddrinfo can fail
for an IPv6 address. Cover this combination.

Commit 12317957 introduced an incompatible
architectural change for the AppArmor security driver. Specifically,
virSecurityManagerSetAllLabel() is now called much later in
src/qemu/qemu_process.c:qemuProcessStart(). Previously, SetAllLabel() was
called immediately after GenLabel() such that after the dynamic label (profile
name) was generated, SetAllLabel() would be called to create and load the
AppArmor profile into the kernel before qemuProcessHook() was executed. With
12317957, qemuProcessHook() is now called
before SetAllLabel(), such that aa_change_profile() ends up being called
before the AppArmor profile is loaded into the kernel (via ProcessLabel() in
qemuProcessHook()).

This patch addresses the change by making GenLabel() load the AppArmor
profile into the kernel after the label (profile name) is generated.
SetAllLabel() is then adjusted to only reload_profile() and append stdin_fn to
the profile when it is specified. This also makes the AppArmor driver work
like its SELinux counterpart with regard to SetAllLabel() and stdin_fn.
Bug-Ubuntu: https://launchpad.net/bugs/801569

When adding virDomainGetVcpusFlags in commit ea3f5c68, I did
enough rebasing that the doc comments in libvirt.c no longer
matched the final chosen enum names in libvirt.h.

And now we've gone ahead and deprecated the names
VIR_DOMAIN_VCPU_{LIVE,CONFIG}.

* src/libvirt.c (virDomainGetVcpusFlags): Fix comment.

This reverts commit 7d56a16d.

Conflicts:

	python/generator.py
	src/libvirt_public.syms

This reverts commit 6419f596.

This reverts commit d1693bb1.

Conflicts:

	daemon/remote.c
	src/remote/remote_driver.c
	src/remote/remote_protocol.x

This reverts commit 784ee08d.

This reverts commit 3e2493ce.