3:25 p.m.
From: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com>
V1 -> V2
resend: qemu user tests
rebase: add a method to fix search permissions
ShaoHe Feng (2):
qemu user tests: probe the username of qemu process started by libvirt
add a method to fix search permissions
src/kimchi/kvmusertests.py | 63 ++++++++++++++++++++++++
src/kimchi/utils.py | 116 ++++++++++++++++++++++++++++++++++++++++++++-
2 files changed, 178 insertions(+), 1 deletion(-)
create mode 100644 src/kimchi/kvmusertests.py
--
1.8.4.2
3:25 p.m.
New subject: [RESEND][PATCH V2 1/2] qemu user tests: probe the username of qemu process started by libvirt
From: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com>
We want to fix the searchable permission for qemu user.
But we should find the username of qemu process firstly.
searchable permission is a known problem.
We have discussed several times on IRC.
Royce reports the qemu username is different on different distros
Adam, Aline, Royce and I think we can probe qemu username with the
similar method of qemu iso stream support.
Signed-off-by: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com>
Signed-off-by: Royce Lv <lvroyce(a)linux.vnet.ibm.com>
Signed-off-by: Aline Manera <alinefm(a)linux.vnet.ibm.com>
---
src/kimchi/kvmusertests.py | 63 ++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 63 insertions(+)
create mode 100644 src/kimchi/kvmusertests.py
diff --git a/src/kimchi/kvmusertests.py b/src/kimchi/kvmusertests.py
new file mode 100644
index 0000000..6552dc1
--- /dev/null
+++ b/src/kimchi/kvmusertests.py
@@ -0,0 +1,63 @@
+#
+# Project Kimchi
+#
+# Copyright IBM, Corp. 2013
+#
+# Authors:
+# ShaoHe Feng <shaohef(a)linux.vnet.ibm.com>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+import libvirt
+import uuid
+import psutil
+
+SIMPLE_VM_XML = """
+<domain type='kvm'>
+ <name>VM-test</name>
+ <uuid>%s</uuid>
+ <memory unit='KiB'>32768</memory>
+ <os>
+ <type arch='x86_64' machine='pc-0.15'>hvm</type>
+ <boot dev='hd'/>
+ </os>
+</domain>"""
+
+
+class UserTests(object):
+ def __init__(self):
+ self.vm_uuid = uuid.uuid3(uuid.NAMESPACE_DNS, 'vm-test.kimchi.org')
+
+ def probe_user(self):
+ xml = SIMPLE_VM_XML % self.vm_uuid
+ user = 'qemu'
+ try:
+ conn = libvirt.open('qemu:///system')
+ dom = conn.defineXML(xml)
+ dom.create()
+ for p in psutil.process_iter():
+ if self.vm_uuid in p.cmdline:
+ user = p.username
+ break
+ dom.destroy()
+ dom.undefine()
+ conn.close()
+ return user
+ except libvirt.libvirtError:
+ return None
+
+if __name__ == '__main__':
+ ut = UserTests()
+ print ut.probe_user()
--
1.8.4.2
3:25 p.m.
New subject: [PATCH V2 2/2] add a method to fix search permissions
From: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com>
First will use setfacl to set the path search permission for user or
group, if failed then set search permission for others on the path.
Usage:
check_path_permission("/tmp/need/to/fix/path", username)
fix_path_permission("/tmp/need/to/fix/path", username)
Signed-off-by: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com>
Signed-off-by: Royce Lv <lvroyce(a)linux.vnet.ibm.com>
---
src/kimchi/utils.py | 116 +++++++++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 115 insertions(+), 1 deletion(-)
diff --git a/src/kimchi/utils.py b/src/kimchi/utils.py
index f7eda93..daf5c8d 100644
--- a/src/kimchi/utils.py
+++ b/src/kimchi/utils.py
@@ -18,11 +18,15 @@
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
#
import cherrypy
import os
+import pwd
+import re
+import stat
+import subprocess
from cherrypy.lib.reprconf import Parser
@@ -33,6 +37,7 @@ from kimchi import config
kimchi_log = cherrypy.log.error_log
+
def is_digit(value):
if isinstance(value, int):
return True
@@ -84,3 +89,112 @@ def import_class(class_path):
def import_module(module_name):
return __import__(module_name, fromlist=[''])
+
+
+def name_uid(user):
+ return pwd.getpwnam(user).pw_uid
+
+
+def run_command(cmd):
+ try:
+ proc = subprocess.Popen(cmd, stdout=subprocess.PIPE,
+ stderr=subprocess.PIPE)
+ out, error = proc.communicate()
+
+ kimchi_log.debug("Run command '%s'", " ".join(cmd))
+ if out or error:
+ kimchi_log.debug("out:\n %s\nerror:\n %s", out, error)
+ except OSError:
+ kimchi_log.debug("Failed to run command %s", " ".join(cmd))
+ return (None, None, None)
+ if proc.returncode != 0:
+ kimchi_log.debug("Cmd '%s' failed, error code: %s", cmd,
error)
+ return (out, error, proc.returncode)
+
+
+def run_setfacl_set_x(path, user="qemu", group=None):
+ set_user = ["setfacl", "--modify", "user:%s:x" % user,
path]
+ set_group = ["setfacl", "--modify", "group:%s:x" %
group, path]
+ out, error, ret = run_command(set_user)
+ if ret != 0 and group:
+ out, error, ret = run_command(set_group)
+ return ret == 0
+
+
+def run_getfacl(path, user="qemu", group=None):
+ cmd = ["getfacl", path]
+ out, error, ret = run_command(cmd)
+ if out and ret == 0:
+ res = re.findall("user:%s:..x" % user, out)
+ res = re.findall("group:%s:..x" % group,
+ out) if group and not res else res
+ return res != []
+ return False
+
+
+def set_x_on_path(path, who="other"):
+ S_IXWHO = ((stat.S_IXUSR if who == "user" else None) or
+ (stat.S_IXGRP if who == "group" else None) or
+ stat.S_IXOTH)
+ mode = os.stat(path).st_mode | S_IXWHO
+ os.chmod(path, mode)
+ ret = os.stat(path).st_mode == mode
+ if not ret:
+ kimchi_log.debug("faild to set +x attribute on %s", path)
+ return ret
+
+
+def get_x_on_path(path, uid):
+ try:
+ info = os.stat(path)
+ mode = info.st_mode
+ return ((uid == info.st_uid and mode & stat.S_IXUSR == stat.S_IXUSR) or
+ (uid == info.st_gid and mode & stat.S_IXGRP == stat.S_IXGRP) or
+ mode & stat.S_IXGRP == stat.S_IXOTH)
+ except OSError:
+ kimchi_log.debug("faild to get attribute on %s as user id: %s",
+ path, uid)
+ return False
+
+
+def check_path_permission(path, user='qemu', group=None):
+ return get_x_on_path(path,
+ name_uid(user)) or run_getfacl(path, user, group)
+
+
+def fix_path_permission(path, user='qemu'):
+ paths = []
+ while path:
+ paths.append(path)
+ if path == "/":
+ break
+ path = os.path.dirname(path)
+
+ paths.reverse()
+ for path in paths:
+ if not (check_path_permission(path) or
+ run_setfacl_set_x(path) or
+ set_x_on_path(path)):
+ return False
+ return True
+
+
+def check_path_acl_permission(path, user='qemu', group=None):
+ return run_getfacl(path, user, group)
+
+
+def fix_path_acl_permission(path, user='qemu'):
+ paths = []
+ while path:
+ paths.append(path)
+ if path == "/":
+ break
+ path = os.path.dirname(path)
+
+ paths.reverse()
+ for path in paths:
+ if not (run_getfacl(path, user) or run_setfacl_set_x(path, user)):
+ kimchi_log.debug("faild to set on researchable permission on %s "
+ "for user: %s", path, user)
+ return False
+ return True
--
1.8.4.2
4:42 a.m.
New subject: [RESEND][PATCH V2 1/2] qemu user tests: probe the username of qemu process started by libvirt
于 2013年12月23日 22:25, shaohef(a)linux.vnet.ibm.com 写道:
From: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com>
We want to fix the searchable permission for qemu user.
But we should find the username of qemu process firstly.
searchable permission is a known problem.
We have discussed several times on IRC.
Royce reports the qemu username is different on different distros
Adam, Aline, Royce and I think we can probe qemu username with the
similar method of qemu iso stream support.
Signed-off-by: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com>
Signed-off-by: Royce Lv <lvroyce(a)linux.vnet.ibm.com>
Signed-off-by: Aline Manera <alinefm(a)linux.vnet.ibm.com>
---
src/kimchi/kvmusertests.py | 63 ++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 63 insertions(+)
create mode 100644 src/kimchi/kvmusertests.py
diff --git a/src/kimchi/kvmusertests.py b/src/kimchi/kvmusertests.py
new file mode 100644
index 0000000..6552dc1
--- /dev/null
+++ b/src/kimchi/kvmusertests.py
@@ -0,0 +1,63 @@
+#
+# Project Kimchi
+#
+# Copyright IBM, Corp. 2013
+#
+# Authors:
+# ShaoHe Feng <shaohef(a)linux.vnet.ibm.com>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+import libvirt
+import uuid
+import psutil
+
+SIMPLE_VM_XML = """
+<domain type='kvm'>
+ <name>VM-test</name>
+ <uuid>%s</uuid>
+ <memory unit='KiB'>32768</memory>
+ <os>
+ <type arch='x86_64' machine='pc-0.15'>hvm</type>
+ <boot dev='hd'/>
+ </os>
+</domain>"""
+
+
+class UserTests(object):
+ def __init__(self):
+ self.vm_uuid = uuid.uuid3(uuid.NAMESPACE_DNS, 'vm-test.kimchi.org')
+
+ def probe_user(self):
+ xml = SIMPLE_VM_XML % self.vm_uuid
+ user = 'qemu'
+ try:
+ conn = libvirt.open('qemu:///system')
+ dom = conn.defineXML(xml)
+ dom.create()
+ for p in psutil.process_iter():
+ if self.vm_uuid in p.cmdline:
+ user = p.username
+ break
Hello. Is the following method better? I think reading the pid file can
save us from iterating the process list.
with open('/var/run/libvirt/qemu/VM-test.pid') as f:
pidStr = f.read()
p = psutil.Process(int(pidstr))
user = p.username
+ dom.destroy()
+ dom.undefine()
+ conn.close()
+ return user
+ except libvirt.libvirtError:
+ return None
+
+if __name__ == '__main__':
+ ut = UserTests()
+ print ut.probe_user()
--
Thanks and best regards!
Zhou Zheng Sheng / 周征晟
E-mail: zhshzhou(a)linux.vnet.ibm.com
Telephone: 86-10-82454397
5:21 a.m.
New subject: [RESEND][PATCH V2 1/2] qemu user tests: probe the username of qemu process started by libvirt
On 12/24/2013 11:42 AM, Zhou Zheng Sheng wrote:
于 2013年12月23日 22:25, shaohef(a)linux.vnet.ibm.com 写道:
> From: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com>
>
> We want to fix the searchable permission for qemu user.
> But we should find the username of qemu process firstly.
>
> searchable permission is a known problem.
> We have discussed several times on IRC.
>
> Royce reports the qemu username is different on different distros
>
> Adam, Aline, Royce and I think we can probe qemu username with the
> similar method of qemu iso stream support.
>
> Signed-off-by: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com>
> Signed-off-by: Royce Lv <lvroyce(a)linux.vnet.ibm.com>
> Signed-off-by: Aline Manera <alinefm(a)linux.vnet.ibm.com>
> ---
> src/kimchi/kvmusertests.py | 63 ++++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 63 insertions(+)
> create mode 100644 src/kimchi/kvmusertests.py
>
> diff --git a/src/kimchi/kvmusertests.py b/src/kimchi/kvmusertests.py
> new file mode 100644
> index 0000000..6552dc1
> --- /dev/null
> +++ b/src/kimchi/kvmusertests.py
> @@ -0,0 +1,63 @@
> +#
> +# Project Kimchi
> +#
> +# Copyright IBM, Corp. 2013
> +#
> +# Authors:
> +# ShaoHe Feng <shaohef(a)linux.vnet.ibm.com>
> +#
> +# This library is free software; you can redistribute it and/or
> +# modify it under the terms of the GNU Lesser General Public
> +# License as published by the Free Software Foundation; either
> +# version 2.1 of the License, or (at your option) any later version.
> +#
> +# This library is distributed in the hope that it will be useful,
> +# but WITHOUT ANY WARRANTY; without even the implied warranty of
> +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
> +# Lesser General Public License for more details.
> +#
> +# You should have received a copy of the GNU Lesser General Public
> +# License along with this library; if not, write to the Free Software
> +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
> +
> +import libvirt
> +import uuid
> +import psutil
> +
> +SIMPLE_VM_XML = """
> +<domain type='kvm'>
> + <name>VM-test</name>
> + <uuid>%s</uuid>
> + <memory unit='KiB'>32768</memory>
> + <os>
> + <type arch='x86_64' machine='pc-0.15'>hvm</type>
> + <boot dev='hd'/>
> + </os>
> +</domain>"""
> +
> +
> +class UserTests(object):
> + def __init__(self):
> + self.vm_uuid = uuid.uuid3(uuid.NAMESPACE_DNS, 'vm-test.kimchi.org')
> +
> + def probe_user(self):
> + xml = SIMPLE_VM_XML % self.vm_uuid
> + user = 'qemu'
> + try:
> + conn = libvirt.open('qemu:///system')
> + dom = conn.defineXML(xml)
> + dom.create()
> + for p in psutil.process_iter():
> + if self.vm_uuid in p.cmdline:
> + user = p.username
> + break
Hello. Is the following method better? I think reading the pid file can
save us from iterating the process list.
with open('/var/run/libvirt/qemu/VM-test.pid') as f:
pidStr = f.read()
p = psutil.Process(int(pidstr))
user = p.username
sure, a good way. it can avoid iterating the process lis
> + dom.destroy()
> + dom.undefine()
> + conn.close()
> + return user
> + except libvirt.libvirtError:
> + return None
> +
> +if __name__ == '__main__':
> + ut = UserTests()
> + print ut.probe_user()
>
--
Sheldon Feng(冯少合)<shaohef(a)linux.vnet.ibm.com>
IBM Linux Technology Center
3798
days inactive
3799
days old
4 comments
3 participants
participants (3)
-
shaohef＠linux.vnet.ibm.com -
Sheldon
-
Zhou Zheng Sheng