[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [RFC: PATCHv3 3/3] save: generate idempotent inactive xml for running domain



On 07/28/2011 12:59 PM, Laine Stump wrote:
On 07/22/2011 12:21 AM, Eric Blake wrote:
Noticed by comparing the xml generated by virDomainSave with the
xml produced by reparsing and redumping that xml.

* src/conf/domain_conf.c (virDomainDeviceInfoIsSet): Add
parameter, and update all callers. Make static.
(virDomainNetDefFormat): Skip generated ifname.
* src/conf/domain_conf.h (virDomainDeviceInfoIsSet): Delete.
* src/libvirt_private.syms (domain_conf.h): Update.
---

Sending this now, to get review started, but I still have some
more fixing to do - right now, active domains still include:

+<seclabel type='dynamic' model='selinux' relabel='yes'/>

which is not present on reparse, but I'm too tired to find out why.


I know the feeling :-)

Now that I've had some sleep (and 6 days have elapsed), I've finally gotten back to this patch. :-)



So does it turn out that this is important, or not?

It _would_ be, if we cared about non-empty model on inactive parse. That is, if we _wanted_ to force a dynamic security model of selinux instead of apparmor, then the inactive parse needs to be taught to parse model, and enforce that the model is supported by the current host (and prevent migrations between selinux and apparmor machines). But since that particular <seclabel> merely represents the default, and by default you want a secure machine regardless of which security model your host supports, I simply fixed the formatter to omit default information rather than teaching the parser to honor an explicit model (that is, existing behavior has always been to ignore model on inactive parse).

+
+ if (def->ifname&&
+ !((flags& VIR_DOMAIN_XML_INACTIVE)&&
+ (STRPREFIX(def->ifname, "vnet")))) {
+ /* Skip auto-generated target names for inactive config. */


It's kind of bothersome that use of this magic device name prefix isn't
self-contained in domain_conf.c (or somewhere else). Perhaps the string
could be defined in domain_conf.h, then used here and in qemu_command.c
(is it used any place else?).

Split into a separate patch - uml_conf.c also used it.

v4 now posted, and my audit of domain_conf.c is now complete.
https://www.redhat.com/archives/libvir-list/2011-July/msg02064.html

--
Eric Blake   eblake redhat com    +1-801-349-2682
Libvirt virtualization library http://libvirt.org


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]