[libvirt PATCH 03/13] selinux: remove redundant use of 'set_variable' function

This function is only needed if we're trying to set a dynamic variable name. Signed-off-by: Daniel P. Berrangé --- src/security/selinux/meson.build | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/security/selinux/meson.build b/src/security/selinux/meson.build index

[libvirt PATCH 11/13] scripts: use variables for cli args in selinux helper

Instead of referencing sys.argv everywhere, use named variables to make the code easier to understand. Signed-off-by: Daniel P. Berrangé --- scripts/selinux-compile-policy.py | 57 +-- 1 file changed, 32 insertions(+), 25 deletions(-) diff --git

[libvirt PATCH 13/13] Install selinux-policy-devel in test environment

From: Vit Mojzis Temporary commit for testing purposes. The change needs to be done in https://gitlab.com/libvirt/libvirt-ci/-/blob/master/guests/lcitool/lcitool/ansible/vars/projects/libvirt.yml Signed-off-by: Vit Mojzis --- ci/containers/centos-8.Dockerfile | 1 +

[libvirt PATCH 12/13] scripts: factor repeated path joins from selinux helper

The os.path.join() function is called repeatedly for the same base file. Factoring this out into named variables makes the code easier to understand. Signed-off-by: Daniel P. Berrangé --- scripts/selinux-compile-policy.py | 34 --- 1 file changed, 18 insertions(+),

[libvirt PATCH 10/13] selinux: remove duplicate sources list for policy

By using the 'files()' function, the sources retain knowledge of the path in which they are held. This avoids the need to duplicate the source list in each subdir. Signed-off-by: Daniel P. Berrangé --- src/security/selinux/mcs/meson.build | 6 -- src/security/selinux/meson.build | 6

[libvirt PATCH 06/13] selinux: don't hardcode policy include files directory

Signed-off-by: Daniel P. Berrangé --- meson_options.txt| 1 + scripts/selinux-compile-policy.py| 15 +++ src/security/selinux/mcs/meson.build | 3 ++- src/security/selinux/meson.build | 2 ++ src/security/selinux/mls/meson.build | 3 ++- 5 files

[libvirt PATCH 08/13] rpm: rename selinux variables to improve clarity

This new name of the option makes it clear that the conditional only affects policy installation, not building of selinux support more generally. The prefix on the module name avoids risk of clashing with other variables. Signed-off-by: Daniel P. Berrangé --- libvirt.spec.in | 47

[libvirt PATCH 09/13] selinux: introduce meson option for selinux policy install

The /etc/os-release file may not even exist on OS and checking specific OS names / versions in the build rules duplicates conditions that are set in the RPM. Instead we just look for existance of the tools we need to build the policy module. In doing so, we also introduce '-Dselinux_policy'

[libvirt PATCH 05/13] selinux: don't hardcode paths to selinux tools

Signed-off-by: Daniel P. Berrangé --- scripts/selinux-compile-policy.py| 18 +++--- src/security/selinux/mcs/meson.build | 3 ++- src/security/selinux/meson.build | 2 ++ src/security/selinux/mls/meson.build | 3 ++- 4 files changed, 17 insertions(+), 9 deletions(-) diff

[libvirt PATCH 04/13] selinux: move selinux policy build helper to scripts directory

The majority of build helper scripts live in this directory Signed-off-by: Daniel P. Berrangé --- scripts/meson.build| 1 + .../compile_policy.py => scripts/selinux-compile-policy.py | 0 src/security/selinux/mcs/meson.build

[libvirt PATCH 07/13] rpm: move logic for setting selinux policy variables

It is currently mixed in with the comment and variables controlling the min OS version. Signed-off-by: Daniel P. Berrangé --- libvirt.spec.in | 10 +- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index aa50db3c16..37f8a218e6 100644 ---

[libvirt PATCH 01/13] security: add SELinux policy for virt

From: Nikola Knazekova SELinux policy was created for: Hypervisor drivers: - virtqemud (QEMU/KVM) - virtlxcd (LXC) - virtvboxd (VirtualBox) Secondary drivers: - virtstoraged (host storage mgmt) - virtnetworkd (virtual network mgmt) - virtinterface (network interface mgmt) - virtnodedevd

[libvirt PATCH 00/13] selinux: introduce sVirt policy and build

This is an extension of https://listman.redhat.com/archives/libvir-list/2021-July/msg00167.html The original patches from that series are unchanged apart from the commit message, and tweak to the min fedora version in the RPM. I then include various refactors/cleanups. On Fedora 34 I notice

[libvirt PATCH 02/13] selinux: introduce build, install, packaging for selinux policy

From: Vit Mojzis Compile the policy using a script executed by meson. Generate 2 versions of the binary policy to allow installation to systems with any selinux type (targeted, mls and minimum). Signed-off-by: Vit Mojzis --- libvirt.spec.in| 92

Re: [libvirt PATCH 0/3] Invalidate the cpu flags cache on changes of kernel command line

On Fri, Aug 06, 2021 at 05:07:45PM +0200, Jiri Denemark wrote: > On Thu, Aug 05, 2021 at 14:50:51 +0100, Daniel P. Berrangé wrote: > > On Thu, Aug 05, 2021 at 03:36:37PM +0200, Tim Wiederhake wrote: > > > The kernel command line can contain settings affecting the availability > > > of cpu

Re: [libvirt PATCH 0/3] Invalidate the cpu flags cache on changes of kernel command line

On Thu, Aug 05, 2021 at 14:50:51 +0100, Daniel P. Berrangé wrote: > On Thu, Aug 05, 2021 at 03:36:37PM +0200, Tim Wiederhake wrote: > > The kernel command line can contain settings affecting the availability > > of cpu features, eg. "tsx=on". This series adds the kernel command line > > to the cpu

[PATCH 1/4] virDomainDefGetSecurityLabelDef: Fix const correctness

The function doesn't write to domain definition really so make @def argument as const. This allows us to call it from functions where the domain definition is already const. Signed-off-by: Michal Privoznik --- src/conf/domain_conf.c | 2 +- src/conf/domain_conf.h | 2 +- 2 files changed, 2

[PATCH 3/4] qemuDomainOpenFile: Take @cfg instead of driver

Again, we don't need full driver, just its config. Signed-off-by: Michal Privoznik --- src/qemu/qemu_domain.c| 5 ++--- src/qemu/qemu_domain.h| 2 +- src/qemu/qemu_driver.c| 4 ++-- src/qemu/qemu_saveimage.c | 5 +++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git

[PATCH 2/4] qemuDomainOpenFile: Take virDomainDef instead of virDomainObj

The function doesn't really need domain object, but domain definition from which it takes seclabels. Signed-off-by: Michal Privoznik --- src/qemu/qemu_domain.c| 8 src/qemu/qemu_domain.h| 2 +- src/qemu/qemu_driver.c| 2 +- src/qemu/qemu_saveimage.c | 2 +- 4 files changed,

[PATCH 4/4] qemu: Open chardev logfile on behalf of QEMU

If the QEMU driver is configured to use the old "file" stdio handler (meaning virtlogd is out of the picture) and a chardev has a log file configured we rely on QEMU being able to create the file itself. This may not be always possible (e.g. if the logfile is set to a directory that QEMU process

[PATCH 0/4] qemu: Open chardev logfile on behalf of QEMU

See 4/4 for explanation. Michal Prívozník (4): virDomainDefGetSecurityLabelDef: Fix const correctness qemuDomainOpenFile: Take virDomainDef instead of virDomainObj qemuDomainOpenFile: Take @cfg instead of driver qemu: Open chardev logfile on behalf of QEMU src/conf/domain_conf.c| 2

[PATCH v2 3/4] virsh: add support for '--validate' option in define interface

Signed-off-by: Kristina Hanicova --- docs/manpages/virsh.rst | 5 +++-- tools/virsh-interface.c | 10 +- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/docs/manpages/virsh.rst b/docs/manpages/virsh.rst index 20936994ce..2efb15fc1c 100644 --- a/docs/manpages/virsh.rst

[PATCH v2 1/4] conf: propagate xmlDocPtr and flags into virInterfaceDefParseXML()

We need to know if validation flag is present in order to validate given XML against schema in virInterfaceDefParseXML(). Signed-off-by: Kristina Hanicova --- src/conf/interface_conf.c | 29 +++-- src/conf/interface_conf.h | 6 +++--

[PATCH v2 4/4] interface_conf: add validation against schema in define

We need to validate the XML against schema if option '--validate' was passed to the virsh 'iface-define' command. Signed-off-by: Kristina Hanicova --- src/conf/interface_conf.c | 11 ++- src/interface/interface_backend_netcf.c | 4 ++-- 2 files changed, 12 insertions(+),

[PATCH v2 2/4] api: add virInterfaceDefineFlags

Signed-off-by: Kristina Hanicova --- include/libvirt/libvirt-interface.h | 4 src/libvirt-interface.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/include/libvirt/libvirt-interface.h b/include/libvirt/libvirt-interface.h index 7591c6c7fb..803cb33ffe

[PATCH v2 0/4] interface define: add support for validation against schema

This is v2 of: https://listman.redhat.com/archives/libvir-list/2021-August/msg00187.html Changes since v1 (suggested by Peter): * split of the patch containing api and virsh adjustments into separate patches * change of documentation (which I forgot to do before) Kristina Hanicova (4): conf:

Re: [PATCH 2/3] virsh: add support for '--validate' option in define interface

On Fri, Aug 06, 2021 at 15:08:15 +0200, Kristina Hanicova wrote: > Signed-off-by: Kristina Hanicova > --- > include/libvirt/libvirt-interface.h | 4 The patch summary just mentions "virsh" but this is really modifying the API. In general API modifications are more important ... >

[PATCH 3/3] interface_conf: add validation against schema in define

We need to validate the XML against schema if option '--validate' was passed to the virsh 'iface-define' command. Signed-off-by: Kristina Hanicova --- src/conf/interface_conf.c | 11 ++- src/interface/interface_backend_netcf.c | 4 ++-- 2 files changed, 12 insertions(+),

[PATCH 2/3] virsh: add support for '--validate' option in define interface

Signed-off-by: Kristina Hanicova --- include/libvirt/libvirt-interface.h | 4 tools/virsh-interface.c | 10 +- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/include/libvirt/libvirt-interface.h b/include/libvirt/libvirt-interface.h index

[PATCH 0/3] interface define: add support for validation against schema

This is just the first series of patches of many more. I will send them soon, I just wanted to know if I am on the right path as they will follow the same pattern. Partially resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1972586 Kristina Hanicova (3): conf: propagate xmlDocPtr and flags

[PATCH 1/3] conf: propagate xmlDocPtr and flags into virInterfaceDefParseXML()

We need to know if validation flag is present in order to validate given XML against schema in virInterfaceDefParseXML(). Signed-off-by: Kristina Hanicova --- src/conf/interface_conf.c | 29 +++-- src/conf/interface_conf.h | 6 +++--

Re: [PATCH] src: stop checking virIdentityNew return value

On Fri, Aug 06, 2021 at 12:03:24 +0100, Daniel P. Berrangé wrote: > This method will always succeed. > > Signed-off-by: Daniel P. Berrangé > --- > src/remote/remote_daemon_dispatch.c | 5 + > src/rpc/virnetserverclient.c| 5 + > src/util/viridentity.c | 5 + > 3

[PATCH] src: stop checking virIdentityNew return value

This method will always succeed. Signed-off-by: Daniel P. Berrangé --- src/remote/remote_daemon_dispatch.c | 5 + src/rpc/virnetserverclient.c| 5 + src/util/viridentity.c | 5 + 3 files changed, 3 insertions(+), 12 deletions(-) diff --git

Re: [PATCH 00/13] Clean up string list freeing

On a %A in %Y, Peter Krempa wrote: > Switch remaining users of virStringListFreeCount to g_auto(GStrv) and > clean up some usage of string lists. > > Depends on the refactor of the virtual function code I've posted > earlier. > > Pipeline: > >

Re: [PATCH 0/6] util: Refactor fetching of virtual function list

On a %A in %Y, Peter Krempa wrote: > Note that this applies on top of the 'VIR_APPEND_ELEMENT' refactor I've > sent earlier. > > Pipeline: > https://gitlab.com/pipo.sk/libvirt/-/pipelines/348524810 > > Peter Krempa (6): > virNetDevGetVirtualFunctions: Remove 'max_vfs' argument >

Re: [PATCH 0/7] vmx: Support super wide SCSI bus

On a %A in %Y, Michal Privoznik wrote: > As of vSphere 6.7 there can be up to 64 units on a SCSI bus. > > Honestly, I'm not a big fan of 5/7 but we want to support three > different values and one of them doesn't depend on the driver that's > assigning the disk address, but at a runtime

Re: [PATCH 5/7] conf: Store SCSI bus length in virDomainDef

On a %A in %Y, Michal Privoznik wrote: > Libvirt assumes that a SCSI bus can fit up to 8 devices > (including controller itself), except for so called wide bus > which can accommodate up to 16 devices (again, including > controller). This plays important role when computing 'drive' > address in