Re: [libvirt-users] Network interface name of guest via python API

2018-03-23 Thread Dennis Jacobfeuerborn
On 19.03.2018 19:07, Laine Stump wrote:
> On 03/19/2018 11:46 AM, Dennis Jacobfeuerborn wrote:
>> Hi,
>> I'm trying to get some basic data from running guests on a libvirt HV
>> but one thing I'm missing is the name of the network interfaces of the
>> guests. I can get the MAC address from the XML but there seems to be no
>> function to actually get the name of the interface.
>>
>> The only function that comes close is this one:
>> https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainInterfaceAddresses
>>
>> This function requires a parameter that I don't really have enough
>> information about.
> 
> Which parameter is that? flags? That seems fairly thoroughly explained
> in the documentation you pointed at.

I'm actually talking about the "source" parameter.

>> What is the best way to enumerate a guests interfaces including the name?
> 
> Assuming you mean the name of the interface *as it appears to the
> guest*... Since the host can't directly know the names of devices on the
> guest, the only way you can learn this is with cooperation from the OS
> running on the guest. One way of getting that cooperation is to make
> sure the guest is running the qemu guest agent (and that libvirt's
> domain config has the proper serial channel configured), then
> virDomainInterfaceAddresses() with the
> VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_AGENT flag will return entries that
> contain the interface name as it appears to the guest (the other modes
> of virDomainInterfaceAddresses will show the names of the tap devices on
> the *host*, not of the interfaces in the guest).
> 
> You can check if your guests are running the qemu guest agent (and try
> out the virDomainInterfaceAddresses() API at the same time) with this
> shell command (run as root on the host):
> 
>virsh domifaddr $guestname --source agent
> 
> Here is info in the libvirt wiki about installing / configuring the qemu
> guest agent:
> 
>   https://wiki.libvirt.org/page/Qemu_guest_agent
> 
> (I just checked on a Fedora 27 guest that I previously defined with
> virt-manager to use spice for video, I found that virt-manager had
> automatically added the necessary serial channel device
> ("org.qemu.guest_agent.0"), and that the Linux kernel in the guest
> automatically noticed that and setup a guest agent in the guest. It may
> (will) take more work to get the guest agent working for other guest
> OSes, e.g. Windows.)
> 

Assuming that the guest agent is running is not really an option as I
don't really have control over how the guests are installed.
What I'm really interested in is a way to uniquely identify a network
interface.
Let's say I want gather statistics for an interface using
virDomainInterfaceStats() for a guest with multiple interfaces how do I
ensure that I always get the proper stats for the individual interfaces?
If there was an ID for each interface that would be easy but that
doesn't seem to exist and now that I realize that the name apparently is
created on startup of the guest that name might not be a stable
identifier either.
I guess I can (ab)use the MAC address but is this really guaranteed to
exist for each Interface? What about SDN-like setups that don't use
Layer-2 networking at all and set the MAC to something like
"00:00:00:00:00:00"?

Regards,
  Dennis

___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users


Re: [libvirt-users] Attempt to define unprivileged LXC by libvirt

2018-03-23 Thread Daniel P . Berrangé
On Fri, Mar 23, 2018 at 02:09:39PM +0100, ales drtik wrote:
> Hi,
> i converted LXC conf to xml by:
> 
> lxcuser@blade1:~/.local/share/lxc/test_deb$ virsh -c lxc:/// domxml-from-
> native lxc-tools /home/lxcuser/.local/share/lxc/test_deb/config
> 
> 
> test_deb
> cce77799-89fd-41fd-99c1-101e00844e23
> 65536
> 65536
> 1
> 
> exe
> /sbin/init
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> destroy
> restart
> destroy
> 
> /usr/lib/libvirt/libvirt_lxc
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> Now attempt to define by virsh gives this err:
> 
> lxcuser@blade1:~/.local/share/lxc/test_deb$ virsh -c lxc:/// define tmp/test
> _deb.xml
> error: Failed to define domain from /tmp/test_deb.xml
> error: unsupported configuration: You must map the root user of container 
> 
> Debian stretch.
> Where am I wrong ?

The libvirt LXC driver only runs in the privileged libvirtd instance at
this time. There is no support for the unprivileged libvirtd with LXC.

Regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users


Re: [libvirt-users] Attempt to define unprivileged LXC by libvirt

2018-03-23 Thread ales drtik
Thanks for info about that.
This means to use apparmor mandatory, isn't it true?




___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users


Re: [libvirt-users] Attempt to define unprivileged LXC by libvirt

2018-03-23 Thread Daniel P . Berrangé
On Fri, Mar 23, 2018 at 02:28:11PM +0100, ales drtik wrote:
> Thanks for info about that.
> This means to use apparmor mandatory, isn't it true?

If you enable user namespaces for the container that is sufficient to provide
a secure config. None the less we still recommend /also/ adding MAC like
SELinux or AppArmor on top.

Regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|

___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users


[libvirt-users] Attempt to define unprivileged LXC by libvirt

2018-03-23 Thread ales drtik
Hi,
i converted LXC conf to xml by:

lxcuser@blade1:~/.local/share/lxc/test_deb$ virsh -c lxc:/// domxml-from-
native lxc-tools /home/lxcuser/.local/share/lxc/test_deb/config


test_deb
cce77799-89fd-41fd-99c1-101e00844e23
65536
65536
1

exe
/sbin/init










destroy
restart
destroy

/usr/lib/libvirt/libvirt_lxc












Now attempt to define by virsh gives this err:

lxcuser@blade1:~/.local/share/lxc/test_deb$ virsh -c lxc:/// define tmp/test
_deb.xml
error: Failed to define domain from /tmp/test_deb.xml
error: unsupported configuration: You must map the root user of container 

Debian stretch.
Where am I wrong ?___
libvirt-users mailing list
libvirt-users@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users