Re: [libvirt] [PATCH RFC] LXC: don't RO mount /proc, /sys when user namespce enabled

2014-12-23 Thread Chen, Hanxiao
> -Original Message- > From: Richard Weinberger [mailto:richard.weinber...@gmail.com] > Sent: Wednesday, December 24, 2014 5:36 AM > To: Eric Blake > Cc: Chen, Hanxiao/陈 晗霄; libvir-list@redhat.com > Subject: Re: [libvirt] [PATCH RFC] LXC: don't RO mount /proc, /sys when user > namespce en

Re: [libvirt] [PATCH RFC] LXC: don't RO mount /proc, /sys when user namespce enabled

2014-12-23 Thread Richard Weinberger
On Mon, Dec 22, 2014 at 4:12 PM, Eric Blake wrote: > On 12/21/2014 08:57 PM, Chen Hanxiao wrote: > > s/namespce/namespace/ in the subject line > >> If we enabled user ns and provided a uid/gid map, >> we do not need to mount /proc, /sys as readonly. >> Leave it to kernel for protection. >> >> Sign

Re: [libvirt] [PATCHv3] lxc: give RW access to /proc/sys/net/ipv[46] to containers

2014-12-23 Thread Richard Weinberger
On Wed, Dec 10, 2014 at 10:40 AM, Cédric Bosdonnat wrote: > Some programs want to change some values for the network interfaces > configuration in /proc/sys/net/ipv[46] folders. Giving RW access on them > allows wicked to work on openSUSE 13.2+. > > Reusing the lxcNeedNetworkNamespace function to

[libvirt] LSN-2014-0010: CVE-2014-8136 deadlock on failed migration

2014-12-23 Thread Eric Blake
Libvirt Security Notice: LSN-2014-0008 == Summary: deadlock on failed migration Reported on: 20141208 Published on: 20141208 Fixed on: 20141209 Reported by: Peter Krempa Patched by: Peter Krempa See also: CVE-2014

[libvirt] LSN-2014-0009: CVE-2014-8135 crash when using virStorageVolUpload

2014-12-23 Thread Eric Blake
Libvirt Security Notice: LSN-2014-0009 == Summary: crash when using virStorageVolUpload Reported on: 20141202 Published on: 20141203 Fixed on: 20141203 Reported by: Pei Zhang Patched by: Luyao Huang See also: CVE-

[libvirt] LSN-2014-0008: CVE-2014-8131 deadlock or segfault in virConnectGetAllDomainStats

2014-12-23 Thread Eric Blake
Libvirt Security Notice: LSN-2014-0008 == Summary: deadlock or segfault in virConnectGetAllDomainStats Reported on: 20141127 Published on: 20141205 Fixed on: 20141211 Reported by: Martin Kletzander Patched by: Martin Kle

Re: [libvirt] [PATCH] tests: Set up two more overrides for root builders

2014-12-23 Thread Stefan Berger
On 12/23/2014 12:13 AM, Martin Kletzander wrote: There are two more places after commit 3865941b that need to be adapted in order to get rid of some test failures when building as root. I would have patched it if I had seen the test failure -- I don't see a test failure on the tip - odd ?

Re: [libvirt] [PATCH] parallels: report, that cdrom image is raw

2014-12-23 Thread Martin Kletzander
On Tue, Dec 23, 2014 at 04:23:34PM +0300, Dmitry Guryanov wrote: VIR_STORAGE_FILE_AUTO should be used only in xml provided to libvirt by user, if I understood correctly. Driver should set storage source format to specific disk format in *DomainGetXMLDesc. CDROMs in PCS use raw image format. Sig

Re: [libvirt] [PATCH] tests: Set up two more overrides for root builders

2014-12-23 Thread Eric Blake
On 12/22/2014 10:13 PM, Martin Kletzander wrote: > There are two more places after commit 3865941b that need to be adapted > in order to get rid of some test failures when building as root. > > Signed-off-by: Martin Kletzander > --- > tests/networkxml2firewalltest.c | 2 ++ > tests/virfirewallte

Re: [libvirt] [openstack-dev] [nova] - 'nova reboot' causes console-log truncated

2014-12-23 Thread Tony Breeds
On Mon, Dec 22, 2014 at 04:36:02PM -0800, Surojit Pathak wrote: > Hi Daniel, > Having GA to do graceful restart is nice option. But if it were to just > preserve the same console file, even 'virsh reboot' achieves the purpose. As > I explained in my original analysis, Nova seems to have not taken

Re: [libvirt] [openstack-dev] [nova] - 'nova reboot' causes console-log truncated

2014-12-23 Thread Tony Breeds
On Mon, Dec 22, 2014 at 07:16:27PM -0800, Surojit Pathak wrote: > Hi Tony, > > Can you please share some details of the effort, in terms of reference? Well the initial discussions started with qemu at: http://lists.nongnu.org/archive/html/qemu-devel/2014-12/msg00765.html and then here: http://lis

[libvirt] [PATCH] parallels: report, that cdrom image is raw

2014-12-23 Thread Dmitry Guryanov
VIR_STORAGE_FILE_AUTO should be used only in xml provided to libvirt by user, if I understood correctly. Driver should set storage source format to specific disk format in *DomainGetXMLDesc. CDROMs in PCS use raw image format. Signed-off-by: Dmitry Guryanov --- src/parallels/parallels_sdk.c | 2

Re: [libvirt] [PATCH 5/6] qemu: Leave cpuset.mems in parent cgroup alone

2014-12-23 Thread Martin Kletzander
On Mon, Dec 22, 2014 at 10:45:33AM +0100, Martin Kletzander wrote: On Wed, Dec 17, 2014 at 04:59:30PM -0700, Eric Blake wrote: On 12/17/2014 08:06 AM, Martin Kletzander wrote: On Wed, Dec 17, 2014 at 12:00:36AM -0700, Eric Blake wrote: On 12/16/2014 11:51 PM, Eric Blake wrote: On 12/15/2014 1