Skip to content
Snippets Groups Projects
Commit 7c3b026b authored by Guido Günther's avatar Guido Günther
Browse files

Rediff patches 

Dropped patches fixed upstream
  apparmor-pass-attach_disconnected.patch
  lxc-ensure-libvirt_lxc-and-qemu-nbd-move-into-systemd-mac.patch
  AppArmor-policy-support-merged-usr.patch
parent e3b2d909
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
Showing
with 30 additions and 284 deletions
debian/patches/Allow-access-to-libnl-3-config-files.patch
+ 2
− 2
View file @ 7c3b026b
......@@ -8,7 +8,7 @@ Closes: #786650
1 file changed, 7 insertions(+)
diff --git a/examples/apparmor/usr.lib.libvirt.virt-aa-helper b/examples/apparmor/usr.lib.libvirt.virt-aa-helper
index b34fb35..89b95f6 100644
index 4a8f197..7804b72 100644
--- a/examples/apparmor/usr.lib.libvirt.virt-aa-helper
+++ b/examples/apparmor/usr.lib.libvirt.virt-aa-helper
@@ -16,9 +16,16 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper {
......@@ -27,4 +27,4 @@ index b34fb35..89b95f6 100644
+ deny /dev/mapper/* r,
/usr/{lib,lib64}/libvirt/virt-aa-helper mr,
/sbin/apparmor_parser Ux,
/{usr/,}sbin/apparmor_parser Ux,
debian/patches/Allow-xen-toolstack-to-find-it-s-binaries.patch
+ 1
− 1
View file @ 7c3b026b
......@@ -39,7 +39,7 @@ index 88e08d2..bfbc8c9 100644
</define>
diff --git a/src/xen/xen_hypervisor.c b/src/xen/xen_hypervisor.c
index a9995ad..0f432e4 100644
index 77d01a4..eabed1e 100644
--- a/src/xen/xen_hypervisor.c
+++ b/src/xen/xen_hypervisor.c
@@ -2140,11 +2140,9 @@ xenHypervisorBuildCapabilities(virConnectPtr conn, virArch hostarch,
......
debian/patches/AppArmor-policy-support-merged-usr.patch deleted 100644 → 0
+ 0
− 64
View file @ e3b2d909
From: intrigeri <intrigeri@debian.org>
Date: Sat, 3 Dec 2016 18:32:48 +0000
Subject: AppArmor policy: support merged-/usr.
Acked-by: Christian Ehrhardt <christian.ehrhardt@canonical.co>
---
examples/apparmor/libvirt-qemu | 8 ++++----
examples/apparmor/usr.lib.libvirt.virt-aa-helper | 2 +-
examples/apparmor/usr.sbin.libvirtd | 4 ++--
3 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu
index b8e4e1c..5256816 100644
--- a/examples/apparmor/libvirt-qemu
+++ b/examples/apparmor/libvirt-qemu
@@ -137,12 +137,12 @@
/usr/{lib,lib64}/qemu/block-rbd.so mr,
# for save and resume
- /bin/dash rmix,
- /bin/dd rmix,
- /bin/cat rmix,
+ /{usr/,}bin/dash rmix,
+ /{usr/,}bin/dd rmix,
+ /{usr/,}bin/cat rmix,
# for restore
- /bin/bash rmix,
+ /{usr/,}bin/bash rmix,
# for usb access
/dev/bus/usb/ r,
diff --git a/examples/apparmor/usr.lib.libvirt.virt-aa-helper b/examples/apparmor/usr.lib.libvirt.virt-aa-helper
index a992119..abf340d 100644
--- a/examples/apparmor/usr.lib.libvirt.virt-aa-helper
+++ b/examples/apparmor/usr.lib.libvirt.virt-aa-helper
@@ -28,7 +28,7 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper {
deny /dev/mapper/* r,
/usr/{lib,lib64}/libvirt/virt-aa-helper mr,
- /sbin/apparmor_parser Ux,
+ /{usr/,}sbin/apparmor_parser Ux,
/etc/apparmor.d/libvirt/* r,
/etc/apparmor.d/libvirt/libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw,
diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd
index e0ecfe9..5e2c3e4 100644
--- a/examples/apparmor/usr.sbin.libvirtd
+++ b/examples/apparmor/usr.sbin.libvirtd
@@ -47,12 +47,12 @@
/usr/bin/* PUx,
/usr/sbin/virtlogd pix,
/usr/sbin/* PUx,
- /lib/udev/scsi_id PUx,
+ /{usr/,}lib/udev/scsi_id PUx,
/usr/{lib,lib64}/xen-common/bin/xen-toolstack PUx,
/usr/{lib,lib64}/xen/bin/* Ux,
# force the use of virt-aa-helper
- audit deny /sbin/apparmor_parser rwxl,
+ audit deny /{usr/,}sbin/apparmor_parser rwxl,
audit deny /etc/apparmor.d/libvirt/** wxl,
audit deny /sys/kernel/security/apparmor/features rwxl,
audit deny /sys/kernel/security/apparmor/matching rwxl,
debian/patches/Reduce-udevadm-settle-timeout-to-10-seconds.patch
+ 1
− 1
View file @ 7c3b026b
......@@ -10,7 +10,7 @@ Closes: #663931
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/util/virutil.c b/src/util/virutil.c
index 0291378..f42e29f 100644
index aeaa7f9..cfb326c 100644
--- a/src/util/virutil.c
+++ b/src/util/virutil.c
@@ -1586,7 +1586,7 @@ virSetUIDGIDWithCaps(uid_t uid, gid_t gid, gid_t *groups, int ngroups,
......
debian/patches/Set-defaults-for-zfs-tools.patch
+ 15
− 15
View file @ 7c3b026b
......@@ -4,21 +4,21 @@ Subject: Set defaults for zfs tools
so we don't have to build-depend on a program in contrib
---
configure.ac | 4 ++--
m4/virt-storage-zfs.m4 | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/configure.ac b/configure.ac
index 342db89..adeb0e5 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1822,8 +1822,8 @@ AM_CONDITIONAL([WITH_STORAGE_GLUSTER], [test "$with_storage_gluster" = "yes"])
diff --git a/m4/virt-storage-zfs.m4 b/m4/virt-storage-zfs.m4
index 0c52264..1d5781b 100644
--- a/m4/virt-storage-zfs.m4
+++ b/m4/virt-storage-zfs.m4
@@ -24,8 +24,8 @@ AC_DEFUN([LIBVIRT_STORAGE_ARG_ZFS], [
AC_DEFUN([LIBVIRT_STORAGE_CHECK_ZFS], [
if test "$with_storage_zfs" = "yes" ||
test "$with_storage_zfs" = "check"; then
- AC_PATH_PROG([ZFS], [zfs], [], [$LIBVIRT_SBIN_PATH])
- AC_PATH_PROG([ZPOOL], [zpool], [], [$LIBVIRT_SBIN_PATH])
+ AC_PATH_PROG([ZFS], [zfs], [/sbin/zfs], [$LIBVIRT_SBIN_PATH])
+ AC_PATH_PROG([ZPOOL], [zpool], [/sbin/zpool], [$LIBVIRT_SBIN_PATH])
if test "$with_storage_zfs" = "yes" ||
test "$with_storage_zfs" = "check"; then
- AC_PATH_PROG([ZFS], [zfs], [], [$LIBVIRT_SBIN_PATH])
- AC_PATH_PROG([ZPOOL], [zpool], [], [$LIBVIRT_SBIN_PATH])
+ AC_PATH_PROG([ZFS], [zfs], [/sbin/zfs], [$LIBVIRT_SBIN_PATH])
+ AC_PATH_PROG([ZPOOL], [zpool], [/sbin/zpool], [$LIBVIRT_SBIN_PATH])
if test "$with_storage_zfs" = "yes"; then
if test -z "$ZFS" || test -z "$ZPOOL"; then
if test "$with_storage_zfs" = "yes"; then
if test -z "$ZFS" || test -z "$ZPOOL"; then
debian/patches/apparmor-pass-attach_disconnected.patch deleted 100644 → 0
+ 0
− 32
View file @ e3b2d909
From: =?utf-8?q?Guido_G=C3=BCnther?= <agx@sigxcpu.org>
Date: Mon, 19 Dec 2016 08:15:15 +0100
Subject: apparmor: pass attach_disconnected
to cure
+ virsh lxc-enter-namespace --noseclabel sl /bin/ls /bin/ls
libvirt: error : Expected at least one file descriptor
error: internal error: Child process (2714) unexpected exit status 125
caused by
apparmor="DENIED" operation="open" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/libvirtd" name="" pid=1422 comm="libvirtd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Closes: #847370
---
examples/apparmor/usr.sbin.libvirtd | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd
index 5e2c3e4..c40930b 100644
--- a/examples/apparmor/usr.sbin.libvirtd
+++ b/examples/apparmor/usr.sbin.libvirtd
@@ -2,7 +2,7 @@
#include <tunables/global>
@{LIBVIRT}="libvirt"
-/usr/sbin/libvirtd {
+/usr/sbin/libvirtd flags=(attach_disconnected) {
#include <abstractions/base>
#include <abstractions/dbus>
debian/patches/debian/Don-t-enable-default-network-on-boot.patch
+ 4
− 4
View file @ 7c3b026b
......@@ -9,10 +9,10 @@ to not interfere with existing network configurations
2 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/src/Makefile.am b/src/Makefile.am
index d440548..1a91684 100644
index 21a78e0..598e659 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -3125,8 +3125,7 @@ if WITH_NETWORK
@@ -3144,8 +3144,7 @@ if WITH_NETWORK
$(DESTDIR)$(confdir)/qemu/networks/default.xml && \
rm $(DESTDIR)$(confdir)/qemu/networks/default.xml.t; }
( cd $(DESTDIR)$(confdir)/qemu/networks/autostart && \
......@@ -23,10 +23,10 @@ index d440548..1a91684 100644
uninstall-local:: uninstall-init uninstall-systemd
diff --git a/src/Makefile.in b/src/Makefile.in
index 5db08fe..e164d8a 100644
index 7a78ed4..c8e8e3a 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -11574,8 +11574,7 @@ install-data-local: install-init install-systemd
@@ -11755,8 +11755,7 @@ install-data-local: install-init install-systemd
@WITH_NETWORK_TRUE@ $(DESTDIR)$(confdir)/qemu/networks/default.xml && \
@WITH_NETWORK_TRUE@ rm $(DESTDIR)$(confdir)/qemu/networks/default.xml.t; }
@WITH_NETWORK_TRUE@ ( cd $(DESTDIR)$(confdir)/qemu/networks/autostart && \
......
debian/patches/debian/apparmor_profiles_local_include.patch
+ 2
− 2
View file @ 7c3b026b
......@@ -9,7 +9,7 @@ Include local apparmor profile
2 files changed, 6 insertions(+)
diff --git a/examples/apparmor/usr.lib.libvirt.virt-aa-helper b/examples/apparmor/usr.lib.libvirt.virt-aa-helper
index 89b95f6..a992119 100644
index 7804b72..abf340d 100644
--- a/examples/apparmor/usr.lib.libvirt.virt-aa-helper
+++ b/examples/apparmor/usr.lib.libvirt.virt-aa-helper
@@ -52,4 +52,7 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper {
......@@ -21,7 +21,7 @@ index 89b95f6..a992119 100644
+ #include <local/usr.lib.libvirt.virt-aa-helper>
}
diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd
index 48651b2..e0ecfe9 100644
index 8893e75..c40930b 100644
--- a/examples/apparmor/usr.sbin.libvirtd
+++ b/examples/apparmor/usr.sbin.libvirtd
@@ -85,4 +85,7 @@
......
debian/patches/debian/fix-Debian-specific-path-to-hvm-loader.patch
+ 1
− 1
View file @ 7c3b026b
......@@ -12,7 +12,7 @@ Closes: #517059
5 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/src/xen/xen_hypervisor.c b/src/xen/xen_hypervisor.c
index 0177f83..a9995ad 100644
index bce7b56..77d01a4 100644
--- a/src/xen/xen_hypervisor.c
+++ b/src/xen/xen_hypervisor.c
@@ -2144,7 +2144,7 @@ xenHypervisorBuildCapabilities(virConnectPtr conn, virArch hostarch,
......
debian/patches/debian/remove-RHism.diff.patch
+ 1
− 1
View file @ 7c3b026b
......@@ -7,7 +7,7 @@ Subject: remove-RHism.diff
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/virsh.pod b/tools/virsh.pod
index 247d235..7f67969 100644
index cfa7a24..0940b71 100644
--- a/tools/virsh.pod
+++ b/tools/virsh.pod
@@ -119,7 +119,7 @@ virsh is coming from and which options and driver are compiled in.
......
debian/patches/lxc-ensure-libvirt_lxc-and-qemu-nbd-move-into-systemd-mac.patch deleted 100644 → 0
+ 0
− 155
View file @ e3b2d909
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Thu, 5 Jan 2017 15:30:56 +0000
Subject: lxc: ensure libvirt_lxc and qemu-nbd move into systemd machine slice
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Currently when spawning containers with systemd, the container PID 1
will get moved into the systemd machine slice. Libvirt then manually
moves the libvirt_lxc and qemu-nbd processes into the cgroups associated
with the slice, but skips the systemd controller cgroup. This means that
from systemd's POV, libvirt_lxc and qemu-nbd are still part of the
libvirtd.service unit.
On systemctl daemon-reload, it will notice that libvirt_lxc & qemu-nbd
are in the libvirtd.service unit for the systemd controller, but in the
machine cgroups for resources. Systemd will thus move them back into
the libvirtd.service resource cgroups next time libvirtd is restarted.
This causes libvirtd to kill off the container due to incorrect cgroup
placement.
The solution is to ensure that when moving libvirt_lxc & qemu-nbd, we
also move the systemd cgroup controller placement. Normally this is
not something we ever want todo, but this is a special case as we are
intentionally wanting to move them to a different systemd unit.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Guido Günther <agx@sigxcpu.org>
---
src/libvirt_private.syms | 1 +
src/lxc/lxc_controller.c | 4 ++--
src/util/vircgroup.c | 52 +++++++++++++++++++++++++++++++++++++-----------
src/util/vircgroup.h | 1 +
4 files changed, 44 insertions(+), 14 deletions(-)
diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index 43220e0..9aae1c1 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -1286,6 +1286,7 @@ virBufferVasprintf;
# util/vircgroup.h
+virCgroupAddMachineTask;
virCgroupAddTask;
virCgroupAddTaskController;
virCgroupAllowAllDevices;
diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c
index 508bc3e..9880741 100644
--- a/src/lxc/lxc_controller.c
+++ b/src/lxc/lxc_controller.c
@@ -869,12 +869,12 @@ static int virLXCControllerSetupCgroupLimits(virLXCControllerPtr ctrl)
ctrl->nicindexes)))
goto cleanup;
- if (virCgroupAddTask(ctrl->cgroup, getpid()) < 0)
+ if (virCgroupAddMachineTask(ctrl->cgroup, getpid()) < 0)
goto cleanup;
/* Add all qemu-nbd tasks to the cgroup */
for (i = 0; i < ctrl->nnbdpids; i++) {
- if (virCgroupAddTask(ctrl->cgroup, ctrl->nbdpids[i]) < 0)
+ if (virCgroupAddMachineTask(ctrl->cgroup, ctrl->nbdpids[i]) < 0)
goto cleanup;
}
diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c
index f151193..2d53a89 100644
--- a/src/util/vircgroup.c
+++ b/src/util/vircgroup.c
@@ -1178,16 +1178,8 @@ virCgroupNew(pid_t pid,
}
-/**
- * virCgroupAddTask:
- *
- * @group: The cgroup to add a task to
- * @pid: The pid of the task to add
- *
- * Returns: 0 on success, -1 on error
- */
-int
-virCgroupAddTask(virCgroupPtr group, pid_t pid)
+static int
+virCgroupAddTaskInternal(virCgroupPtr group, pid_t pid, bool withSystemd)
{
int ret = -1;
size_t i;
@@ -1197,8 +1189,10 @@ virCgroupAddTask(virCgroupPtr group, pid_t pid)
if (!group->controllers[i].mountPoint)
continue;
- /* We must never add tasks in systemd's hierarchy */
- if (i == VIR_CGROUP_CONTROLLER_SYSTEMD)
+ /* We must never add tasks in systemd's hierarchy
+ * unless we're intentionally trying to move a
+ * task into a systemd machine scope */
+ if (i == VIR_CGROUP_CONTROLLER_SYSTEMD && !withSystemd)
continue;
if (virCgroupAddTaskController(group, pid, i) < 0)
@@ -1210,6 +1204,40 @@ virCgroupAddTask(virCgroupPtr group, pid_t pid)
return ret;
}
+/**
+ * virCgroupAddTask:
+ *
+ * @group: The cgroup to add a task to
+ * @pid: The pid of the task to add
+ *
+ * Will add the task to all controllers, except the
+ * systemd unit controller.
+ *
+ * Returns: 0 on success, -1 on error
+ */
+int
+virCgroupAddTask(virCgroupPtr group, pid_t pid)
+{
+ return virCgroupAddTaskInternal(group, pid, false);
+}
+
+/**
+ * virCgroupAddMachineTask:
+ *
+ * @group: The cgroup to add a task to
+ * @pid: The pid of the task to add
+ *
+ * Will add the task to all controllers, including the
+ * systemd unit controller.
+ *
+ * Returns: 0 on success, -1 on error
+ */
+int
+virCgroupAddMachineTask(virCgroupPtr group, pid_t pid)
+{
+ return virCgroupAddTaskInternal(group, pid, true);
+}
+
/**
* virCgroupAddTaskController:
diff --git a/src/util/vircgroup.h b/src/util/vircgroup.h
index 4b8f3ff..2de1bf2 100644
--- a/src/util/vircgroup.h
+++ b/src/util/vircgroup.h
@@ -131,6 +131,7 @@ int virCgroupPathOfController(virCgroupPtr group,
char **path);
int virCgroupAddTask(virCgroupPtr group, pid_t pid);
+int virCgroupAddMachineTask(virCgroupPtr group, pid_t pid);
int virCgroupAddTaskController(virCgroupPtr group,
pid_t pid,
debian/patches/patch-qemuMonitorTextGetMigrationStatus-to-intercept.patch
+ 1
− 1
View file @ 7c3b026b
......@@ -42,7 +42,7 @@ to savely detect that the command 'info migrate' is not implemented.
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/src/qemu/qemu_monitor_text.c b/src/qemu/qemu_monitor_text.c
index a2a5885..7413e42 100644
index bc83218..557f06e 100644
--- a/src/qemu/qemu_monitor_text.c
+++ b/src/qemu/qemu_monitor_text.c
@@ -1482,7 +1482,15 @@ int qemuMonitorTextGetMigrationStats(qemuMonitorPtr mon,
......
debian/patches/series
+ 0
− 3
View file @ 7c3b026b
......@@ -15,6 +15,3 @@ debian/apparmor_profiles_local_include.patch
virt-aa-helper-apparmor-allow-usr-share-OVMF-too.patch
Set-defaults-for-zfs-tools.patch
Pass-GPG_TTY-env-var-to-the-ssh-binary.patch
AppArmor-policy-support-merged-usr.patch
apparmor-pass-attach_disconnected.patch
lxc-ensure-libvirt_lxc-and-qemu-nbd-move-into-systemd-mac.patch
debian/patches/virt-aa-helper-apparmor-allow-usr-share-OVMF-too.patch
+ 2
− 2
View file @ 7c3b026b
......@@ -12,10 +12,10 @@ some reason. Let the virtual machine read both.
3 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu
index 11381d4..b8e4e1c 100644
index a9020aa..e0988bb 100644
--- a/examples/apparmor/libvirt-qemu
+++ b/examples/apparmor/libvirt-qemu
@@ -67,6 +67,7 @@
@@ -70,6 +70,7 @@
/usr/share/vgabios/** r,
/usr/share/seabios/** r,
/usr/share/ovmf/** r,
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment