|
 |
e9d682 |
From 9842eb7301f985e4cc08001aff48c269492b2456 Mon Sep 17 00:00:00 2001
|
|
|
e9d682 |
Message-Id: <9842eb7301f985e4cc08001aff48c269492b2456@dist-git>
|
|
|
e9d682 |
From: Michal Privoznik <mprivozn@redhat.com>
|
|
|
e9d682 |
Date: Tue, 6 Sep 2022 13:45:51 +0200
|
|
|
e9d682 |
Subject: [PATCH] qemu_process.c: Propagate hugetlbfs mounts on reconnect
|
|
|
e9d682 |
|
|
|
e9d682 |
When reconnecting to a running QEMU process, we construct the
|
|
|
e9d682 |
per-domain path in all hugetlbfs mounts. This is a relict from
|
|
|
e9d682 |
the past (v3.4.0-100-g5b24d25062) where we switched to a
|
|
|
e9d682 |
per-domain path and we want to create those paths when libvirtd
|
|
|
e9d682 |
restarts on upgrade.
|
|
|
e9d682 |
|
|
|
e9d682 |
And with namespaces enabled there is one corner case where the
|
|
|
e9d682 |
path is not created. In fact an error is reported and the
|
|
|
e9d682 |
reconnect fails. Ideally, all mount events are propagated into
|
|
|
e9d682 |
the QEMU's namespace. And they probably are, except when the
|
|
|
e9d682 |
target path does not exist inside the namespace. Now, it's pretty
|
|
|
e9d682 |
common for users to mount hugetlbfs under /dev (e.g.
|
|
|
e9d682 |
/dev/hugepages), but if domain is started without hugepages (or
|
|
|
e9d682 |
more specifically - private hugetlbfs path wasn't created on
|
|
|
e9d682 |
domain startup), then the reconnect code tries to create it.
|
|
|
e9d682 |
But it fails to do so, well, it fails to set seclabels on the
|
|
|
e9d682 |
path because, because the path does not exist in the private
|
|
|
e9d682 |
namespace. And it doesn't exist because we specifically create
|
|
|
e9d682 |
only a subset of all possible /dev nodes. Therefore, the mount
|
|
|
e9d682 |
event, whilst propagated, is not successful and hence the
|
|
|
e9d682 |
filesystem is not mounted. We have to do it ourselves.
|
|
|
e9d682 |
|
|
|
e9d682 |
If hugetlbfs is mount anywhere else there's no problem and this
|
|
|
e9d682 |
is effectively a dead code.
|
|
|
e9d682 |
|
|
|
e9d682 |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2123196
|
|
|
e9d682 |
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
e9d682 |
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
|
|
|
e9d682 |
(cherry picked from commit 0377177c7856bb87a9d8aa1324b54f5fbe9f1e5b)
|
|
|
e9d682 |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2152083
|
|
|
e9d682 |
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
e9d682 |
---
|
|
|
e9d682 |
docs/kbase/qemu-passthrough-security.rst | 6 ------
|
|
|
e9d682 |
src/qemu/qemu_process.c | 3 +++
|
|
|
e9d682 |
2 files changed, 3 insertions(+), 6 deletions(-)
|
|
|
e9d682 |
|
|
|
e9d682 |
diff --git a/docs/kbase/qemu-passthrough-security.rst b/docs/kbase/qemu-passthrough-security.rst
|
|
|
e9d682 |
index 106c3cc5b9..ef10d8af9b 100644
|
|
|
e9d682 |
--- a/docs/kbase/qemu-passthrough-security.rst
|
|
|
e9d682 |
+++ b/docs/kbase/qemu-passthrough-security.rst
|
|
|
e9d682 |
@@ -172,9 +172,3 @@ command before any guest is started:
|
|
|
e9d682 |
::
|
|
|
e9d682 |
|
|
|
e9d682 |
# mount --make-rshared /
|
|
|
e9d682 |
-
|
|
|
e9d682 |
-Another requirement for dynamic mount point propagation is to not place
|
|
|
e9d682 |
-``hugetlbfs`` mount points under ``/dev`` because these won't be propagated as
|
|
|
e9d682 |
-corresponding directories do not exist in the private namespace. Or just use
|
|
|
e9d682 |
-``memfd`` memory backend instead which does not require ``hugetlbfs`` mount
|
|
|
e9d682 |
-points.
|
|
|
e9d682 |
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
|
|
|
e9d682 |
index 4b52d664c7..062a0b6dac 100644
|
|
|
e9d682 |
--- a/src/qemu/qemu_process.c
|
|
|
e9d682 |
+++ b/src/qemu/qemu_process.c
|
|
|
e9d682 |
@@ -4039,6 +4039,9 @@ qemuProcessBuildDestroyMemoryPathsImpl(virQEMUDriver *driver,
|
|
|
e9d682 |
return -1;
|
|
|
e9d682 |
}
|
|
|
e9d682 |
|
|
|
e9d682 |
+ if (qemuDomainNamespaceSetupPath(vm, path, NULL) < 0)
|
|
|
e9d682 |
+ return -1;
|
|
|
e9d682 |
+
|
|
|
e9d682 |
if (qemuSecurityDomainSetPathLabel(driver, vm, path, true) < 0)
|
|
|
e9d682 |
return -1;
|
|
|
e9d682 |
} else {
|
|
|
e9d682 |
--
|
|
|
e9d682 |
2.39.0
|
|
|
e9d682 |
|