March 2014 - Kimchi-devel - oVirt List Archives

[PATCH V3 0/2] bug fix: add an icon distros list.
by shaohef＠linux.vnet.ibm.com 10 Mar '14

10 Mar '14

From: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com> V2 -> V3 rebase to master V1 -> V2 get this icon distros dinamically clean pep8 for osinfo.py ShaoHe Feng (2): bug fix: add an icon distros list. pep8 clean for osinfo.py Makefile.am | 1 + src/kimchi/osinfo.py | 43 +++++++++++++++++++++++++++++-------------- 2 files changed, 30 insertions(+), 14 deletions(-) -- 1.8.4.2

2 3

[PATCH V2 1/2] bug fix: add an icon distros list.
by shaohef＠linux.vnet.ibm.com 10 Mar '14

10 Mar '14

From: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com> Now I create template with rhel iso, but when I create a VM from this template, the template info displays differently with other templates. That's because icon-rhel is missing for it is RED HAT trademark. But this make us uncomfortable. If the icon is missing we should display the default icon Now there are only 7 icons, include the default icon icon-vm. $ ls ui/images/*.png ui/images/icon-centos.png ui/images/icon-gentoo.png ui/images/icon-debian.png ui/images/icon-opensuse.png ui/images/icon-fedora.png ui/images/icon-ubuntu.png ui/images/icon-vm.png Signed-off-by: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com> --- src/kimchi/osinfo.py | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/kimchi/osinfo.py b/src/kimchi/osinfo.py index 106cc0e..905c63a 100644 --- a/src/kimchi/osinfo.py +++ b/src/kimchi/osinfo.py @@ -18,12 +18,16 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA import copy +import glob import os from distutils.version import LooseVersion +from kimchi.config import paths + + SUPPORTED_ARCHS = {'x86': ('i386', 'x86_64'), 'power': ('ppc', 'ppc64')} @@ -55,6 +59,8 @@ modern_version_bases = {'x86': {'debian': '6.0', 'ubuntu': '7.10', 'rhel': '6.0', 'fedora': '16', 'gentoo': '0'}, 'power': {'rhel': '7.0', 'fedora': '19'}} +icon_available_distros = [icon[5:-4] for icon in glob.glob1('%s/images/' + % paths.ui_dir, 'icon-*.png')] isolinks = { 'debian': { @@ -100,15 +106,18 @@ def lookup(distro, version): arch = _get_arch() if distro in modern_version_bases[arch]: - params['icon'] = 'images/icon-%s.png' % distro if LooseVersion(version) >= LooseVersion( modern_version_bases[arch][distro]): params.update(template_specs[arch]['modern']) else: params.update(template_specs[arch]['old']) else: - params['icon'] = 'images/icon-vm.png' params['os_distro'] = params['os_version'] = "unknown" params.update(template_specs[arch]['old']) + if distro in icon_available_distros: + params['icon'] = 'images/icon-%s.png' % distro + else: + params['icon'] = 'images/icon-vm.png' + return params -- 1.8.4.2

3 6

[PATCHv2] Allocate enough space for logical volume
by lvroyce＠linux.vnet.ibm.com 10 Mar '14

10 Mar '14

From: Royce Lv <lvroyce(a)linux.vnet.ibm.com> When creating storage volume, allocation is specified with 0 because previous format is qcow2. As we use raw format in logcial pool now, we need to specify allocation in xml. Signed-off-by: Royce Lv <lvroyce(a)linux.vnet.ibm.com> --- src/kimchi/vmtemplate.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/kimchi/vmtemplate.py b/src/kimchi/vmtemplate.py index d3bd52e..f227ee6 100644 --- a/src/kimchi/vmtemplate.py +++ b/src/kimchi/vmtemplate.py @@ -211,10 +211,11 @@ class VMTemplate(object): 'format': fmt, 'path': '%s/%s' % (storage_path, volume)} + info['allocation'] = 0 if fmt == 'qcow2' else info['capacity'] info['xml'] = """ <volume> <name>%(name)s</name> - <allocation>0</allocation> + <allocation unit="G">%(allocation)s</allocation> <capacity unit="G">%(capacity)s</capacity> <target> <format type='%(format)s'/> -- 1.8.1.2

4 3

[PATCH 0/2] Fix help Makefile
by Crístian Viana 10 Mar '14

10 Mar '14

Tested on Fedora 20. Crístian Viana (2): fix: Build new DITA pages when running "make" Build help index page only once ui/pages/help/Makefile.am | 6 ++++-- ui/pages/help/gen-index.py | 20 ++++++++++++-------- 2 files changed, 16 insertions(+), 10 deletions(-) -- 1.8.5.3

2 4

[PATCH] bug fix: add an icon distros list.
by shaohef＠linux.vnet.ibm.com 10 Mar '14

10 Mar '14

From: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com> Now I create template with rhel iso, but when I create a VM from this template, the template info displays differently with other templates. That's because icon-rhel is missing for it is RED HAT trademark. But this make us uncomfortable. If the icon is missing we should display the default icon Now there are only 7 icons, include the default icon icon-vm. $ ls ui/images/*.png ui/images/icon-centos.png ui/images/icon-gentoo.png ui/images/icon-debian.png ui/images/icon-opensuse.png ui/images/icon-fedora.png ui/images/icon-ubuntu.png ui/images/icon-vm.png Signed-off-by: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com> --- src/kimchi/osinfo.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/kimchi/osinfo.py b/src/kimchi/osinfo.py index 106cc0e..2eac63e 100644 --- a/src/kimchi/osinfo.py +++ b/src/kimchi/osinfo.py @@ -55,6 +55,8 @@ modern_version_bases = {'x86': {'debian': '6.0', 'ubuntu': '7.10', 'rhel': '6.0', 'fedora': '16', 'gentoo': '0'}, 'power': {'rhel': '7.0', 'fedora': '19'}} +icon_available_distros = ['debian', 'centos', 'fedora', + 'gentoo', 'opensuse', 'ubuntu'] isolinks = { 'debian': { @@ -100,15 +102,18 @@ def lookup(distro, version): arch = _get_arch() if distro in modern_version_bases[arch]: - params['icon'] = 'images/icon-%s.png' % distro if LooseVersion(version) >= LooseVersion( modern_version_bases[arch][distro]): params.update(template_specs[arch]['modern']) else: params.update(template_specs[arch]['old']) else: - params['icon'] = 'images/icon-vm.png' params['os_distro'] = params['os_version'] = "unknown" params.update(template_specs[arch]['old']) + if distro in icon_available_distros: + params['icon'] = 'images/icon-%s.png' % distro + else + params['icon'] = 'images/icon-vm.png' + return params -- 1.8.4.2

3 2

[PATCHv7 0/7] Support storage volume ref_cnt
by lvroyce＠linux.vnet.ibm.com 10 Mar '14

10 Mar '14

From: Royce Lv <lvroyce(a)linux.vnet.ibm.com> tested: 1. sudo make check 2. from UI: list storage volumes and unrefered volume ref_cnt is 0, ref_cnt for refered ones are 1. Available volumes will be tracked by volume reference count. Add this field to storage volume, so that storage volume/pool action validation can rely on it. Royce Lv (7): Export list vms functionality Fix vm disk path when it does not have source element Add volume ref_cnt: update api.md Add volume ref_cnt: Update controller and json schema Add volume ref_cnt: Add model and mockmodel implementation Add volume ref_cnt: Update test Multiple pep8 fixes docs/API.md | 3 +++ src/kimchi/API.json | 25 +++++++++++++++++++++++++ src/kimchi/control/storagevolumes.py | 1 + src/kimchi/i18n.py | 4 ++++ src/kimchi/mockmodel.py | 10 +++++++--- src/kimchi/model/debugreports.py | 2 +- src/kimchi/model/storagevolumes.py | 30 ++++++++++++++++++++++++++++++ src/kimchi/model/templates.py | 2 +- src/kimchi/model/vms.py | 6 +++++- src/kimchi/model/vmstorages.py | 23 +++++++++++++---------- tests/test_model.py | 4 ++++ tests/test_rest.py | 2 ++ 12 files changed, 96 insertions(+), 16 deletions(-) -- 1.8.1.2

3 15

[RFC][PATCH V2 0/3] Issue #322
by shaohef＠linux.vnet.ibm.com 10 Mar '14

10 Mar '14

From: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com> V1 -> V2 use debug to log the open exception trace stack. It is complex to check the permission for qemu user. There are too many access controlling mechanisms in Linux, such as ACL, traditional ugo+-rwx, SELinux and AppArmor. It's not possible to enumerate and check every access mechanisms if it allows QEMU to access a file. So now I'm simply trying to access the file with qemu user and see if it's OK It is simple and avoid handling corner case. Also I can try to start a simple guest with the given iso. ShaoHe Feng (3): add a method to probe the permission as qemu user qemu user tests: probe the username of qemu process started by libvirt Don't allow templates to be created with ISOs that won't be usable. Makefile.am | 1 + src/kimchi/i18n.py | 5 ++++ src/kimchi/kvmusertests.py | 62 +++++++++++++++++++++++++++++++++++++++++++ src/kimchi/model/templates.py | 13 ++++++++- src/kimchi/utils.py | 26 ++++++++++++++++++ 5 files changed, 106 insertions(+), 1 deletion(-) create mode 100644 src/kimchi/kvmusertests.py -- 1.8.4.2

2 5

[PATCH] Do not show a success msg when creating a template
by Crístian Viana 10 Mar '14

10 Mar '14

Tested on Fedora 20. Crístian Viana (1): Do not show a success msg when creating a template ui/js/src/kimchi.template_add_main.js | 1 - 1 file changed, 1 deletion(-) -- 1.8.5.3

3 5

[PATCH] [UI] Window Widget Enhancement - Allow onClose Listener
by Hongliang Wang 10 Mar '14

10 Mar '14

Sometimes we want to trigger some action when window is being closed. For example, we register some listeners in one window, and we want to unregister them after this window is closed, in this case we can take advantage of this feature. Signed-off-by: Hongliang Wang <hlwang(a)linux.vnet.ibm.com> --- ui/js/src/kimchi.window.js | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/ui/js/src/kimchi.window.js b/ui/js/src/kimchi.window.js index b32ab60..c2af63e 100644 --- a/ui/js/src/kimchi.window.js +++ b/ui/js/src/kimchi.window.js @@ -17,6 +17,7 @@ */ kimchi.window = (function() { var _windows = []; + var _listeners = {}; var open = function(settings) { var settings = jQuery.type(settings) === 'object' ? settings : { url: settings @@ -29,6 +30,7 @@ kimchi.window = (function() { } _windows.push(windowID); + _listeners[windowID] = settings['close']; var windowNode = $('<div></div>', { id: windowID, 'class': settings['class'] ? settings['class'] + ' bgmask' : 'bgmask' @@ -37,9 +39,6 @@ kimchi.window = (function() { $(windowNode).css(settings['style'] || ''); $(windowNode).appendTo('body').on('click', '.window .close', function() { - if (settings.close) { - settings.close(); - } kimchi.window.close(); }); @@ -52,7 +51,14 @@ kimchi.window = (function() { }; var close = function() { - $('#' + _windows.pop()).fadeOut(100, function() { + var windowID = _windows.pop(); + if(_listeners[windowID]) { + _listeners[windowID](); + _listeners[windowID] = null; + } + delete _listeners[windowID]; + + $('#' + windowID).fadeOut(100, function() { $(this).remove(); }); }; -- 1.8.1.4

2 2

[PATCH] Bug fix: Kimchi could not start guest with iscsi lun assigned as disk
by Rodrigo Trujillo 10 Mar '14

10 Mar '14

There is an error in Kimchi when you try to start a guest created based on a template that is using an iscsi storage pool. A lun should be used as disk, but the iscsi case was not being expected and kimchi assigned an .img file to the guest, raising error in the starting. This patch fixed this problem. Signed-off-by: Rodrigo Trujillo <rodrigo.trujillo(a)linux.vnet.ibm.com> --- src/kimchi/vmtemplate.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/kimchi/vmtemplate.py b/src/kimchi/vmtemplate.py index f380170..9825159 100644 --- a/src/kimchi/vmtemplate.py +++ b/src/kimchi/vmtemplate.py @@ -24,6 +24,7 @@ import urlparse from kimchi import osinfo +from kimchi.config import READONLY_POOL_TYPE from kimchi.exception import InvalidParameter, IsoFormatError from kimchi.isoinfo import IsoImage from kimchi.utils import check_url_path, pool_name_from_uri @@ -271,7 +272,7 @@ class VMTemplate(object): # Current implementation just allows to create disk in one single # storage pool, so we cannot mix the types (scsi volumes vs img file) - if self._get_storage_type() == 'scsi': + if self._get_storage_type() in READONLY_POOL_TYPE: params['disks'] = self._get_scsi_disks_xml(kwargs.get('volumes')) else: params['disks'] = self._get_disks_xml(vm_uuid) -- 1.8.5.3

2 2

[PATCH] Rebuild .po files when running "make"
by Crístian Viana 10 Mar '14

10 Mar '14

Tested on Fedora 20. Crístian Viana (1): Rebuild .po files when running "make" po/Makefile.in.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 1.8.5.3

3 5

[PATCH] bug fix: setup disks to use cache=none to support live migration.
by Paulo Vital 10 Mar '14

10 Mar '14

When executing a virsh live migration of a VM created by Kimchi, the migration stops due to miss configuration "cache=none" on disk's performance parameters. Signed-off-by: Paulo Vital <pvital(a)linux.vnet.ibm.com> --- src/kimchi/vmtemplate.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/kimchi/vmtemplate.py b/src/kimchi/vmtemplate.py index e2d78a4..89b5e72 100644 --- a/src/kimchi/vmtemplate.py +++ b/src/kimchi/vmtemplate.py @@ -152,7 +152,7 @@ class VMTemplate(object): params = {'src': src, 'dev': dev, 'bus': self.info['disk_bus']} ret += """ <disk type='file' device='disk'> - <driver name='qemu' type='qcow2'/> + <driver name='qemu' type='qcow2' cache='none'/> <source file='%(src)s' /> <target dev='%(dev)s' bus='%(bus)s' /> </disk> @@ -182,7 +182,7 @@ class VMTemplate(object): # Passthrough configuration disk_xml = """ <disk type='volume' device='lun'> - <driver name='qemu' type='raw'/> + <driver name='qemu' type='raw' cache='none'/> <source dev='%(src)s'/> <target dev='%(dev)s' bus='scsi'/> </disk>""" -- 1.8.3.1

7 8

[RFC PATCH 0/3] Issue #322
by shaohef＠linux.vnet.ibm.com 10 Mar '14

10 Mar '14

From: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com> It is complex to check the permission for qemu user. x bit for seach, group, user, selinux and so on. So now I try to open the iso with qemu user. It is simple and avoid handling corner case. Also I can try to start a simple guest with the given iso. ShaoHe Feng (3): add a method to probe the permission as qemu user qemu user tests: probe the username of qemu process started by libvirt Don't allow templates to be created with ISOs that won't be usable. Makefile.am | 1 + src/kimchi/i18n.py | 5 ++++ src/kimchi/kvmusertests.py | 62 +++++++++++++++++++++++++++++++++++++++++++ src/kimchi/model/templates.py | 11 +++++++- src/kimchi/utils.py | 26 ++++++++++++++++++ 5 files changed, 104 insertions(+), 1 deletion(-) create mode 100644 src/kimchi/kvmusertests.py -- 1.8.4.2

2 5

Re: [Kimchi-devel] [PATCH] Don't allow templates to be created with ISOs that won't be usable.
by Sheldon 10 Mar '14

10 Mar '14

On 03/08/2014 04:20 AM, Christy Perez wrote: > Sorry this took me a while to get back to you. Answers below. > > Do you want to pick this back up in the overall kimchi thread? > > > On Thu, 2014-03-06 at 13:29 +0800, Sheldon wrote: >> On 03/04/2014 06:38 AM, Christy Perez wrote: >>> On Wed, 2014-02-26 at 20:26 +0800, Sheldon wrote: >>>> On 02/25/2014 08:23 AM, Christy Perez wrote: >>>>> qemu can't use an ISO if 'other' can't execute all the directories >>>>> containing the file. Return an error explaning this, and suggest >>>>> the way to fix it. >>>>> >>>>> Signed-off-by: Christy Perez <christy(a)linux.vnet.ibm.com> >>>>> --- >>>>> po/en_US.po | 6 ++++++ >>>>> src/kimchi/exception.py | 4 ++++ >>>>> src/kimchi/i18n.py | 2 ++ >>>>> src/kimchi/utils.py | 9 +++++++++ >>>>> src/kimchi/vmtemplate.py | 7 +++++-- >>>>> 5 files changed, 26 insertions(+), 2 deletions(-) >>>>> >>>>> diff --git a/po/en_US.po b/po/en_US.po >>>>> index ca1fe86..38af64c 100644 >>>>> --- a/po/en_US.po >>>>> +++ b/po/en_US.po >>>>> @@ -674,6 +674,12 @@ msgid "Bad format while reading volume descriptor in ISO %(filename)s" >>>>> msgstr "" >>>>> >>>>> #, python-format >>>>> +msgid "The hypervisor doesn't have permission to use this ISO %(filename)s. \ >>>>> + Consider moving it under /var/lib/libvirt, or \ >>>>> + (not recommended) 'chmod -R o+x 'path_to_iso'." >>>>> +msgstr "" >>>>> + >>>>> +#, python-format >>>>> msgid "Virtual machine %(name)s already exists" >>>>> msgstr "" >>>>> >>>>> diff --git a/src/kimchi/exception.py b/src/kimchi/exception.py >>>>> index 2d974a8..263bd0c 100644 >>>>> --- a/src/kimchi/exception.py >>>>> +++ b/src/kimchi/exception.py >>>>> @@ -75,6 +75,10 @@ class InvalidParameter(KimchiException): >>>>> pass >>>>> >>>>> >>>>> +class InvalidPermission(KimchiException): >>>>> + pass >>>>> + >>>>> + >>>>> class InvalidOperation(KimchiException): >>>>> pass >>>>> >>>>> diff --git a/src/kimchi/i18n.py b/src/kimchi/i18n.py >>>>> index fea0184..05b347c 100644 >>>>> --- a/src/kimchi/i18n.py >>>>> +++ b/src/kimchi/i18n.py >>>>> @@ -57,6 +57,8 @@ messages = { >>>>> "KCHISO0005E": _("Invalid El Torito boot indicator in ISO %(filename)s"), >>>>> "KCHISO0006E": _("Unexpected volume type for primary volume in ISO %(filename)s"), >>>>> "KCHISO0007E": _("Bad format while reading volume descriptor in ISO %(filename)s"), >>>>> + "KCHISO0008E": _("The hypervisor doesn't have permission to use this ISO %(filename)s. \ >>>>> + Consider moving it under /var/lib/libvirt, or (not recommended) 'chmod -R o+x 'path_to_iso'." ), >>>>> >>>>> "KCHVM0001E": _("Virtual machine %(name)s already exists"), >>>>> "KCHVM0002E": _("Virtual machine %(name)s does not exist"), >>>>> diff --git a/src/kimchi/utils.py b/src/kimchi/utils.py >>>>> index 6be1c04..c325be3 100644 >>>>> --- a/src/kimchi/utils.py >>>>> +++ b/src/kimchi/utils.py >>>>> @@ -27,6 +27,7 @@ import psutil >>>>> import re >>>>> import subprocess >>>>> import urllib2 >>>>> +import stat >>>>> from threading import Timer >>>>> >>>>> from cherrypy.lib.reprconf import Parser >>>>> @@ -234,3 +235,11 @@ def run_setfacl_set_attr(path, attr="r", user=""): >>>>> set_user = ["setfacl", "--modify", "user:%s:%s" % (user, attr), path] >>>>> out, error, ret = run_command(set_user) >>>>> return ret == 0 >>>>> + >>>>> +def check_iso_path_perm(path): >>>>> + """ >>>>> + libvirt requires that all parent dirs have o+x >>>>> + """ >>>>> + if path == '/': return True >>>>> + return os.stat(path).st_mode & stat.S_IXOTH and \ >>>>> + check_iso_path_perm(os.path.dirname(path)) >>>> just test other's permission is not enough. >>>> 1. when the path user is qemu. why we need S_IXOTH? >>> That's what the libvirt doc says, and what I've found is needed: " The >>> directories containing disk images must either have their ownership set >>> to match the user/group configured for QEMU, or their UNIX file >>> permissions must have the 'execute/search' bit enabled for 'others'. " >>> Source: http://libvirt.org/drvqemu.html >> so that's means the disk images without S_IXOTH, qemu still can have >> search permissions right? > Yep. > The images themselves won't have S_IXOTH. qemu will own them, though: > > [root@kop4 kimchi-ginger-pkvm]# ls -lah /var/lib | grep libvirt > drwxr-xr-x. 9 root root 4.0K Feb 19 11:16 libvirt > [root@kop4 kimchi-ginger-pkvm]# ls -lah /var/lib/libvirt | grep images > drwx--x--x. 2 root root 4.0K Mar 7 06:22 images > [root@kop4 kimchi-ginger-pkvm]# ls -lah /var/lib/libvirt/images/ > total 2.9G > drwx--x--x. 2 root root 4.0K Mar 7 06:22 . > drwxr-xr-x. 9 root root 4.0K Feb 19 11:16 .. > -rw-------. 1 qemu qemu 193K Mar 7 06:22 > 2f7130eb-539c-4401-82eb-cccd18708f56-0.img > -r--r--r--. 1 qemu qemu 2.9G Mar 7 06:20 > RHEL-7.0-20140226.0-Server-ppc64-dvd1.iso > >> o+x is sufficient but not necessary condition? > o+x is necessary. >>>> 2. as you said "libvirt requires that all parent dirs have o+x" >>>> you has adding 'X' to the ACL for each directory to try it. >>>> I wander have check your ACL enable? >>> I don't think the ACL will be enough. It looks like it has to have o+x >>> for all parent paths. And yes, my ACLs were enabled on my filesystem. >> That's strangely. but the docs http://libvirt.org/drvqemu.html >> says: >> it simple to set o+x, means this is the only way. > Yes, I think so. it is strange from what I test, it seems o+x is not necessary but sufficient. I really want to know why o+x is necessary and why it is the only way to check the permission. I have try 5 test case with kimchi. 1. There's a iso on my laptop, with o+x permission $ ls /home/shhfeng/iso/RHEL6.4-20130123.0-Server-x86_64-DVD1.iso /home/shhfeng/iso/RHEL6.4-20130123.0-Server-x86_64-DVD1.iso $ ls /home/shhfeng/ -l |grep iso drwxrwxrwx. 4 shhfeng shhfeng 4096 Oct 3 00:22 iso I can create a vm and start is successfully. 2. Now I remove x permission $ sudo chmod o-x /home/shhfeng/iso $ ls /home/shhfeng/ -l |grep iso drwxrwxrw-. 4 shhfeng shhfeng 4096 Oct 3 00:22 iso I failed to start it for permission. 3. I change the own of this iso, still without x permission. $ sudo chown qemu:qemu /home/shhfeng/iso $ ls /home/shhfeng/ -l |grep iso drwxrwxrw-. 4 qemu qemu 4096 Oct 3 00:22 iso Now I can start it successfully. 4. just set the qemu user as search permission. $ sudo chown shhfeng:shhfeng /home/shhfeng/iso/ $ ls -l /home/shhfeng/ |grep iso drwxrwxrw-. 4 shhfeng shhfeng 4096 Oct 3 00:22 iso $ setfacl -m u:qemu:x /home/shhfeng/iso $ getfacl /home/shhfeng/iso getfacl: Removing leading '/' from absolute path names # file: home/shhfeng/iso # owner: shhfeng # group: shhfeng user::rwx user:qemu:--x group::rwx mask::rwx other::rw- Now I can also start it successfully. 5. remove qemu user as search permission, add set the 'kvm' group to the path, qemu is in "kvm" group $ setfacl -x u:qemu /home/shhfeng/iso $ groups qemu qemu : qemu kvm $ sudo chown shhfeng:kvm /home/shhfeng/iso/ Now I can also start it successfully. only case 2, the kimchi deny to start vm for permission. I write a python script checkperm.py It is the same result of libvirt run qemu. you can have a try. If others do like like checkperm.py, I think we can probe the permission by let libvirt to start the guest with the iso. $ sudo python checkperm.py /home/shhfeng/iso/RHEL6.4-20130123.0-Server-x86_64-DVD1.iso # checkperm.py 1 from multiprocessing import Process, Queue 2 import sys 3 import grp 4 import os 5 import pwd 6 7 8 def probe_file_permission_as_user(file, user): 9 def probe_permission(q, file, user): 10 uid = pwd.getpwnam(user).pw_uid 11 gid = pwd.getpwnam(user).pw_gid 12 gids = [g.gr_gid for g in grp.getgrall() if user in g.gr_mem] 13 os.setgid(gid) 14 os.setgroups(gids) 15 os.setuid(uid) 16 try: 17 with open(file): 18 q.put(True) 19 except Exception: 20 q.put(False) 21 22 queue = Queue() 23 p = Process(target=probe_permission, args=(queue, file, user)) 24 p.start() 25 p.join() 26 return queue.get() 27 28 if __name__ == '__main__': 29 print probe_file_permission_as_user(sys.argv[1], 'qemu') >> """ >> The simplest option is the latter one, of just enabling the >> 'execute/search' bit. For any directory to be used for storing disk >> images, this can be achieved by running the following command on the >> directory itself, and any parent directories >> >> chmod o+x /path/to/directory >> >> In particular note that if using the "system" instance and attempting to >> store disk images in a user home directory, the default permissions on >> $HOME are typically too restrictive to allow access. >> """ >> >> >>>> 3. have you check add qemu in all the paths group? >>>> and open set g+x? >>>> >>>> >>>> can you try my patch, seen it can works? >>>> add a method to probe the permission as qemu user >>> I don't see how the patch listed there will apply. Maybe github >>> reformats it strangely when you paste it in? >>> >>> Even so, as I pasted from the libvirt doc, I don't think that will be >>> enough to make libvirt happy. >> save as, and git apply. but I think it will not successfully, for the >> upstream changes so quickly. >> Yes, we should make libvirt and kimchi user happy? > I think it's a security leak to allow someone to put a file in one > directory, and then we give o+x to every parent of it. If I put an ISO > at /home/christy/example.iso and kimchi changed recursively all parents > to o+x, it would give all users the ability to see what's in /home/. >>>>> diff --git a/src/kimchi/vmtemplate.py b/src/kimchi/vmtemplate.py >>>>> index af07ee3..76ac772 100644 >>>>> --- a/src/kimchi/vmtemplate.py >>>>> +++ b/src/kimchi/vmtemplate.py >>>>> @@ -29,9 +29,9 @@ import urlparse >>>>> >>>>> from kimchi import isoinfo >>>>> from kimchi import osinfo >>>>> -from kimchi.exception import InvalidParameter, IsoFormatError >>>>> +from kimchi.exception import InvalidParameter, IsoFormatError, InvalidPermission >>>>> from kimchi.isoinfo import IsoImage >>>>> - >>>>> +from kimchi.utils import check_iso_path_perm >>>>> >>>>> QEMU_NAMESPACE = "xmlns:qemu='http://libvirt.org/schemas/domain/qemu/1.0'" >>>>> >>>>> @@ -55,6 +55,9 @@ class VMTemplate(object): >>>>> iso_distro = iso_version = 'unknown' >>>>> iso = args.get('cdrom', '') >>>>> >>>>> + if iso.startswith('/') and \ >>>>> + not check_iso_path_perm(os.path.dirname(iso)): >>>>> + raise InvalidPermission("KCHISO0008E", {'filename': iso}) >>>>> if scan and len(iso) > 0: >>>>> iso_distro, iso_version = self.get_iso_info(iso) >>>>> if not iso.startswith('/'): >>> Regards, >>> >>> - Christy >>> >> > Regards, > > - Christy > -- Thanks and best regards! Sheldon Feng(冯少合)<shaohef(a)linux.vnet.ibm.com> IBM Linux Technology Center

2 1

[PATCHv2 0/2] Make vms model singleton
by lvroyce＠linux.vnet.ibm.com 10 Mar '14

10 Mar '14

From: Royce Lv <lvroyce(a)linux.vnet.ibm.com> Everytime when when VMsModel.get_list() need to be called one more background task to collect vm status is started. Fix this by making vms model singleton. Royce Lv (2): Make vms model to be a singleton Hack test_model to support vm model singleton src/kimchi/model/vms.py | 3 +++ tests/test_model.py | 2 ++ 2 files changed, 5 insertions(+) -- 1.8.1.2

5 10

[PATCH] [UI] Window - Correct Footer Height
by Hongliang Wang 07 Mar '14

07 Mar '14

The footer height is 56 pixel, though window content only leaves 48 pixel for it by: margin: 48px 0; Fix it in this patch. Signed-off-by: Hongliang Wang <hlwang(a)linux.vnet.ibm.com> --- ui/css/theme-default/window.css | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ui/css/theme-default/window.css b/ui/css/theme-default/window.css index 09a9840..7e057fd 100644 --- a/ui/css/theme-default/window.css +++ b/ui/css/theme-default/window.css @@ -77,7 +77,7 @@ top: 0; bottom: 0; overflow: auto; - margin: 48px 0; + margin: 48px 0 56px; } .window .close { -- 1.8.1.4

4 3

[PATCHv1 0/2] fix create vm on logical pool
by lvroyce＠linux.vnet.ibm.com 07 Mar '14

07 Mar '14

From: Royce Lv <lvroyce(a)linux.vnet.ibm.com> VG path is create under 'dev' and logical volume's format should be raw, to avoid qcow2 write exceed problem. Royce Lv (2): Fix storage volume format on logical pool for vm logical pool: Fix logical pool target path src/kimchi/model/libvirtstoragepool.py | 2 +- src/kimchi/vmtemplate.py | 8 +++++--- tests/test_storagepool.py | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) -- 1.8.1.2

2 4

[PATCH] Use a pool of threads to valid all remote ISOs in parallel
by Aline Manera 07 Mar '14

07 Mar '14

From: Aline Manera <alinefm(a)br.ibm.com> That way we can reduce processing time in 8s. Without threads the requests takes 15s to complete: GET http://localhost:8000/config/distros 200 OK 10.64s And with the pool of threads it takes 2s: GET http://localhost:8000/config/distros 200 OK 2.01s Signed-off-by: Aline Manera <alinefm(a)br.ibm.com> --- src/kimchi/model/config.py | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/src/kimchi/model/config.py b/src/kimchi/model/config.py index d44ef90..3580ad3 100644 --- a/src/kimchi/model/config.py +++ b/src/kimchi/model/config.py @@ -17,6 +17,8 @@ # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +from multiprocessing.pool import ThreadPool + import cherrypy from kimchi.basemodel import Singleton @@ -91,12 +93,16 @@ class DistrosModel(object): self.distros = distroloader.get() def get_list(self): - res = [] - # only return distro with valid URL - for distro, data in self.distros.iteritems(): - url = data['path'] - if check_url_path(url): - res.append(distro) + def validate_distro(distro): + if check_url_path(distro['path']): + return distro['name'] + + n_processes = len(self.distros.keys()) + pool = ThreadPool(processes=n_processes) + map_res = pool.map_async(validate_distro, self.distros.values()) + pool.close() + pool.join() + res = list(set(map_res.get()) - set([None])) return sorted(res) -- 1.7.10.4

2 3

[PATCH] bug fix: "sudo: sorry, you must have a tty to run sudo".
by Paulo Vital 07 Mar '14

07 Mar '14

The authorization code executes some sudo commands in backend to check if the user used to login in Kimchi has permission to execute privileged commands. By default, sudo needs a TTY to be executed and when Kimchi is executed as a service by systemd (systemctl start kimchid.service), it runs disconnected from any TTY, and sudo returns an error and the message: "sudo: sorry, you must have a tty to run sudo". This patch sets in Kimchi service file for systemd the /dev/tty11 as default TTY to execute the service. Signed-off-by: Paulo Vital <pvital(a)linux.vnet.ibm.com> --- contrib/kimchid.service.fedora | 3 +++ 1 file changed, 3 insertions(+) diff --git a/contrib/kimchid.service.fedora b/contrib/kimchid.service.fedora index 7abe49b..5f274fb 100644 --- a/contrib/kimchid.service.fedora +++ b/contrib/kimchid.service.fedora @@ -8,6 +8,9 @@ Type=simple ExecStart=/usr/bin/kimchid ExecStop=/bin/kill -TERM $MAINPID EnvironmentFile=/etc/kimchi/kimchi.conf +StandardInput=tty +StandardOutput=tty +TTYPath=/dev/tty11 [Install] WantedBy=multi-user.target -- 1.8.3.1

2 2

[PATCH 0/3] Fix issue #301
by Aline Manera 07 Mar '14

07 Mar '14

From: Aline Manera <alinefm(a)br.ibm.com> Aline Manera (3): issue #301: Only list remote ISOs with valid URL issue #301: Add a loading message while listing default remote ISOs Update distros JSON files to always point to a valid URL po/en_US.po | 8 +++++++- po/kimchi.pot | 8 +++++++- po/pt_BR.po | 8 +++++++- po/zh_CN.po | 8 +++++++- src/distros.d/debian.json | 4 ++-- src/distros.d/gentoo.json | 6 +++--- src/kimchi/model/config.py | 10 ++++++++-- ui/js/src/kimchi.template_add_main.js | 4 ++++ ui/pages/template-add.html.tmpl | 12 +++++++++++- 9 files changed, 56 insertions(+), 12 deletions(-) -- 1.7.10.4

3 8

[PATCH] Increase memory size for vm template on ppc platform
by Mark Wu 07 Mar '14

07 Mar '14

The minimum memory size required by graphics installer is 1280. So to allow user install vm in graphics, this patch increases it to 1280. Signed-off-by: Mark Wu <wudxw(a)linux.vnet.ibm.com> --- src/kimchi/osinfo.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/kimchi/osinfo.py b/src/kimchi/osinfo.py index a50daae..106cc0e 100644 --- a/src/kimchi/osinfo.py +++ b/src/kimchi/osinfo.py @@ -42,11 +42,12 @@ template_specs = {'x86': {'old': dict(common_spec, disk_bus='ide', sound_model= 'ich6')}, 'power': {'old': dict(common_spec, disk_bus='scsi', nic_model='spapr-vlan', cdrom_bus='scsi', - kbd_bus='usb', mouse_bus='usb'), + kbd_bus='usb', mouse_bus='usb', + memory=1280), 'modern': dict(common_spec, disk_bus='virtio', nic_model='virtio', cdrom_bus='scsi', kbd_bus='usb', - mouse_bus='usb')}} + mouse_bus='usb', memory=1280)}} modern_version_bases = {'x86': {'debian': '6.0', 'ubuntu': '7.10', -- 1.8.4.2

2 1

[PATCH 1/3] Fix issue #339: Enable backend to handle not persistent pools
by Rodrigo Trujillo 07 Mar '14

07 Mar '14

This patch changes the error message when storage pool is not found and adds the isPersistent checkings, in order to return correctly from deactivate function. Signed-off-by: Rodrigo Trujillo <rodrigo.trujillo(a)linux.vnet.ibm.com> --- src/kimchi/control/storagepools.py | 3 ++- src/kimchi/model/storagepools.py | 11 +++++++++-- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/src/kimchi/control/storagepools.py b/src/kimchi/control/storagepools.py index 62f9525..b75bca0 100644 --- a/src/kimchi/control/storagepools.py +++ b/src/kimchi/control/storagepools.py @@ -90,7 +90,8 @@ class StoragePool(Resource): 'source': self.info['source'], 'type': self.info['type'], 'nr_volumes': self.info['nr_volumes'], - 'autostart': self.info['autostart']} + 'autostart': self.info['autostart'], + 'persistent': self.info['persistent']} val = self.info.get('task_id') if val: diff --git a/src/kimchi/model/storagepools.py b/src/kimchi/model/storagepools.py index fe70fa1..fea19f6 100644 --- a/src/kimchi/model/storagepools.py +++ b/src/kimchi/model/storagepools.py @@ -175,7 +175,7 @@ class StoragePoolModel(object): return conn.storagePoolLookupByName(name.encode("utf-8")) except libvirt.libvirtError as e: if e.get_error_code() == libvirt.VIR_ERR_NO_STORAGE_POOL: - raise NotFoundError("KCHTMPL0002E", {'name': name}) + raise NotFoundError("KCHPOOL0002E", {'name': name}) else: raise @@ -229,6 +229,7 @@ class StoragePoolModel(object): pool = self.get_storagepool(name, self.conn) info = pool.info() autostart = True if pool.autostart() else False + persistent = True if pool.isPersistent() else False xml = pool.XMLDesc(0) path = xmlutils.xpath_get_text(xml, "/pool/target/path")[0] pool_type = xmlutils.xpath_get_text(xml, "/pool/@type")[0] @@ -254,7 +255,8 @@ class StoragePoolModel(object): 'capacity': info[1], 'allocated': info[2], 'available': info[3], - 'nr_volumes': nr_volumes} + 'nr_volumes': nr_volumes, + 'persistent': persistent} if not pool.isPersistent(): # Deal with deep scan generated pool @@ -354,10 +356,15 @@ class StoragePoolModel(object): {'name': name, 'server': source['addr']}) return try: + persistent = pool.isPersistent() pool.destroy() except libvirt.libvirtError as e: raise OperationFailed("KCHPOOL0010E", {'name': name, 'err': e.get_error_message()}) + # If pool was not persistent, then it was erased by destroy() and + # must return nothing here, to trigger _redirect() and avoid errors + if not persistent: + return "" def delete(self, name): if self._pool_used_by_template(name): -- 1.8.5.3

3 6

[PATCH] Fix rollback order
by Rodrigo Trujillo 07 Mar '14

07 Mar '14

This patch changes the order of two rollback calls, avoiding the chance of tests left a test file or a test vm in the system. Signed-off-by: Rodrigo Trujillo <rodrigo.trujillo(a)linux.vnet.ibm.com> --- tests/test_model.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/test_model.py b/tests/test_model.py index f849039..1fa40fa 100644 --- a/tests/test_model.py +++ b/tests/test_model.py @@ -179,10 +179,10 @@ class ModelTests(unittest.TestCase): iso_path = '/tmp/existent.iso' iso_path2 = '/tmp/existent2.iso' open(iso_path, 'w').close() - open(iso_path2, 'w').close() - wrong_iso_path = '/nonexistent.iso' rollback.prependDefer(os.remove, iso_path) + open(iso_path2, 'w').close() rollback.prependDefer(os.remove, iso_path2) + wrong_iso_path = '/nonexistent.iso' # Create a cdrom cdrom_args = {"type": "cdrom", @@ -546,9 +546,9 @@ class ModelTests(unittest.TestCase): params_1 = {'name': 'kimchi-vm1', 'template': '/templates/test'} params_2 = {'name': 'kimchi-vm2', 'template': '/templates/test'} inst.vms_create(params_1) - inst.vms_create(params_2) rollback.prependDefer(self._rollback_wrapper, inst.vm_delete, 'kimchi-vm1') + inst.vms_create(params_2) rollback.prependDefer(self._rollback_wrapper, inst.vm_delete, 'kimchi-vm2') -- 1.8.5.3

3 2

[PATCH] bug fix: Set default flags for virDomain.state() function
by Aline Manera 07 Mar '14

07 Mar '14

From: Aline Manera <alinefm(a)br.ibm.com> Some libvirt versions do not set the default value for flags, so we need to explicity set it. libvirt.virDomain.state = state(self, flags) unbound libvirt.virDomain method Otherwise, the following error will be raised [06/Mar/2014:23:40:05] HTTP Traceback (most recent call last): File "/usr/lib/python2.7/dist-packages/cherrypy/_cprequest.py", line 656, in respond response.body = self.handler() File "/usr/lib/python2.7/dist-packages/cherrypy/lib/encoding.py", line 188, in __call__ self.body = self.oldhandler(*args, **kwargs) File "/usr/lib/python2.7/dist-packages/cherrypy/_cpdispatch.py", line 34, in __call__ return self.callable(*self.args, **self.kwargs) File "/home/alinefm/kimchi/src/kimchi/control/base.py", line 71, in wrapper ident = fn(*model_args) File "/home/alinefm/kimchi/src/kimchi/model/networks.py", line 214, in deactivate if self._get_vms_attach_to_a_network(name, "running"): File "/home/alinefm/kimchi/src/kimchi/model/networks.py", line 199, in _get_vms_attach_to_a_network state == dom.state()[0]): File "/home/alinefm/kimchi/src/kimchi/model/libvirtconnection.py", line 62, in wrapper ret = f(*args, **kwargs) TypeError: state() takes exactly 2 arguments (1 given) Signed-off-by: Aline Manera <alinefm(a)br.ibm.com> --- src/kimchi/model/networks.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/kimchi/model/networks.py b/src/kimchi/model/networks.py index f032875..0d6ccec 100644 --- a/src/kimchi/model/networks.py +++ b/src/kimchi/model/networks.py @@ -196,7 +196,7 @@ class NetworkModel(object): for dom in conn.listAllDomains(0): networks = self._vm_get_networks(dom) if network in networks and (state is None or - state == dom.state()[0]): + state == dom.state(0)[0]): vms.append(dom.name()) return vms -- 1.7.10.4

4 4

[PATCH] Issue #222: add python-xml to suse require list
by shaohef＠linux.vnet.ibm.com 07 Mar '14

07 Mar '14

From: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com> check on suse xml.etree module is from python-xml on suse. need to add python-xml to require list This is different from fedora distro. xml.etree module is from python standlib python-libs on fedora issue: https://github.com/kimchi-project/kimchi/issues/222 Signed-off-by: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com> --- contrib/kimchi.spec.suse.in | 1 + docs/README.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/contrib/kimchi.spec.suse.in b/contrib/kimchi.spec.suse.in index 99b4fea..beddada 100644 --- a/contrib/kimchi.spec.suse.in +++ b/contrib/kimchi.spec.suse.in @@ -21,6 +21,7 @@ Requires: python-jsonschema >= 1.3.0 Requires: python-ethtool Requires: python-ipaddr Requires: python-lxml +Requires: python-xml Requires: nfs-client Requires: open-iscsi BuildRequires: libxslt-tools diff --git a/docs/README.md b/docs/README.md index fcf53c5..5721878 100644 --- a/docs/README.md +++ b/docs/README.md @@ -89,7 +89,7 @@ for more information on how to configure your system to access this repository. python-pam python-M2Crypto python-jsonschema \ rpm-build kvm python-psutil python-ethtool \ python-ipaddr python-lxml nfs-client open-iscsi \ - libxslt-tools + libxslt-tools python-xml Packages version requirement: python-psutil >= 0.6.0 -- 1.8.4.2

2 1