def run(test, params, env):
"""
Test svirt in virt-clone.
"""
VIRT_CLONE = None
try:
VIRT_CLONE = utils_misc.find_command("virt-clone")
except ValueError:
raise error.TestNAError("No virt-clone command found.")
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("svirt_virt_clone_host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_virt_clone_vm_sec_type", "dynamic")
sec_model = params.get("svirt_virt_clone_vm_sec_model", "selinux")
sec_label = params.get("svirt_virt_clone_vm_sec_label", None)
sec_relabel = params.get("svirt_virt_clone_vm_sec_relabel", "yes")
sec_dict = {'type': sec_type, 'model': sec_model, 'label': sec_label,
'relabel': sec_relabel}
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get varialbles about image.
img_label = params.get('svirt_virt_clone_disk_label')
# Label the disks of VM with img_label.
disks = vm.get_disk_devices()
backup_labels_of_disks = {}
for disk in disks.values():
disk_path = disk['source']
backup_labels_of_disks[disk_path] = utils_selinux.get_context_of_file(
filename=disk_path)
utils_selinux.set_context_of_file(filename=disk_path,
context=img_label)
# Set selinux of host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the context of the VM.
vmxml.set_seclabel([sec_dict])
vmxml.sync()
clone_name = ("%s-clone" % vm.name)
try:
cmd = ("%s --original %s --name %s --auto-clone" %
(VIRT_CLONE, vm.name, clone_name))
cmd_result = utils.run(cmd, ignore_status=True)
if cmd_result.exit_status:
raise error.TestFail("Failed to execute virt-clone command."
"Detail: %s." % cmd_result)
finally:
# clean up
for path, label in backup_labels_of_disks.items():
utils_selinux.set_context_of_file(filename=path, context=label)
backup_xml.sync()
utils_selinux.set_status(backup_sestatus)
if not virsh.domstate(clone_name).exit_status:
libvirt_vm.VM(clone_name, params, None, None).remove_with_storage()
def run(test, params, env):
vm_name = params.get("main_vm")
status_error = ("yes" == params.get("status_error", "no"))
start_ga = ("yes" == params.get("start_ga", "yes"))
prepare_channel = ("yes" == params.get("prepare_channel", "yes"))
src_path = params.get("src_path")
tgt_name = params.get("tgt_name", "org.qemu.guest_agent.0")
restart_libvirtd = ("yes" == params.get("restart_libvirtd"))
suspend_resume_guest = ("yes" == params.get("suspend_resume_guest"))
hotunplug_ga = ("yes" == params.get("hotunplug_ga"))
label = params.get("con_label")
vm = env.get_vm(vm_name)
if src_path:
socket_file_dir = os.path.dirname(src_path)
if not os.path.exists(socket_file_dir):
os.mkdir(socket_file_dir)
shutil.chown(socket_file_dir, "qemu", "qemu")
utils_selinux.set_context_of_file(filename=socket_file_dir,
context=label)
vmxml = vm_xml.VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
vmxml.remove_agent_channels()
vmxml.sync()
try:
if prepare_channel:
vm.prepare_guest_agent(start=start_ga,
channel=True,
source_path=src_path)
if restart_libvirtd:
utils_libvirtd.libvirtd_restart()
if suspend_resume_guest:
virsh.suspend(vm_name, debug=True)
virsh.resume(vm_name, debug=True)
if hotunplug_ga:
ga_xml = get_ga_xml(vm, vm_name)
result = virsh.detach_device(vm_name, ga_xml)
if result.exit_status:
test.fail("hotunplug guest agent device failed, %s" % result)
vmxml = vm_xml.VMXML.new_from_dumpxml(vm_name)
if vmxml.get_agent_channels():
test.fail("hotunplug guest agent device failed as "
"guest agent xml still exists")
else:
if start_ga != check_ga_state(vm, vm_name):
test.fail("guest agent device is not in correct state")
check_ga_function(vm_name, status_error, hotunplug_ga)
finally:
vm.destroy()
backup_xml.sync()
def test_context(self):
"""
Test the context related method.
"""
output = "output system_u:object_r:svirt_t:s0-s1:c250,c280 test"
result = utils_selinux.get_context_from_str(context=output)
self.assertEqual(result, "system_u:object_r:svirt_t:s0-s1:c250,c280")
result = utils_selinux.get_context_of_file(filename=__file__)
utils_selinux.set_context_of_file(filename=__file__, context=result)
utils_selinux.get_context_of_process(pid=1)
def test_context(self):
"""
Test the context related method.
"""
output = "output system_u:object_r:svirt_t:s0-s1:c250,c280 test"
result = utils_selinux.get_context_from_str(string=output)
self.assertEqual(result, "system_u:object_r:svirt_t:s0-s1:c250,c280")
result = utils_selinux.get_context_of_file(filename=__file__)
utils_selinux.set_context_of_file(filename=__file__, context=result)
utils_selinux.get_context_of_process(pid=1)
def run(test, params, env):
"""
Test svirt in virt-install.
(1). Init variables.
(2). Set selinux on host.
(3). Set label of image.
(4). run unattended install.
(5). clean up.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("host_selinux", "enforcing")
# Set selinux status on host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the image label.
disk_label = params.get("disk_label", None)
vm_name = params.get("main_vm", None)
vm_params = params.object_params(vm_name)
base_dir = params.get("images_base_dir", data_dir.get_data_dir())
image_filename = storage.get_image_filename(vm_params, base_dir)
utils_selinux.set_context_of_file(image_filename, disk_label)
try:
try:
unattended_install.run(test, params, env)
# Install completed.
if status_error:
raise error.TestFail('Test successed in negative case.')
except error.CmdError, e:
# Install failed.
if not status_error:
raise error.TestFail("Test failed in positive case."
"error: %s" % e)
finally:
# cleanup
utils_selinux.set_status(backup_sestatus)
if virsh.domain_exists(vm_name):
virsh.remove_domain(vm_name)
def run(test, params, env):
"""
Test svirt in adding disk to VM.
(1).Init variables for test.
(2).Label the VM and disk with proper label.
(3).Start VM and check the context.
(4).Destroy VM and check the context.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("svirt_undefine_define_host_selinux",
"enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_undefine_define_vm_sec_type", "dynamic")
sec_model = params.get("svirt_undefine_define_vm_sec_model", "selinux")
sec_label = params.get("svirt_undefine_define_vm_sec_label", None)
sec_relabel = params.get("svirt_undefine_define_vm_sec_relabel", "yes")
sec_dict = {
'type': sec_type,
'model': sec_model,
'label': sec_label,
'relabel': sec_relabel
}
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get varialbles about image.
img_label = params.get('svirt_undefine_define_disk_label')
# Label the disks of VM with img_label.
disks = vm.get_disk_devices()
backup_labels_of_disks = {}
for disk in disks.values():
disk_path = disk['source']
backup_labels_of_disks[disk_path] = utils_selinux.get_context_of_file(
filename=disk_path)
utils_selinux.set_context_of_file(filename=disk_path,
context=img_label)
# Set selinux of host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the context of the VM.
vmxml.set_seclabel([sec_dict])
vmxml.sync()
try:
xml_file = (os.path.join(data_dir.get_tmp_dir(), "vmxml"))
if vm.is_alive():
vm.destroy()
virsh.dumpxml(vm.name, to_file=xml_file)
cmd_result = virsh.undefine(vm.name)
if cmd_result.exit_status:
raise error.TestFail("Failed to undefine vm."
"Detail: %s" % cmd_result)
cmd_result = virsh.define(xml_file)
if cmd_result.exit_status:
raise error.TestFail("Failed to define vm."
"Detail: %s" % cmd_result)
finally:
# clean up
for path, label in backup_labels_of_disks.items():
utils_selinux.set_context_of_file(filename=path, context=label)
backup_xml.sync()
utils_selinux.set_status(backup_sestatus)
def run(test, params, env):
"""
Test svirt in adding disk to VM.
(1).Init variables for test.
(2).Label the VM and disk with proper label.
(3).Start VM and check the context.
(4).Destroy VM and check the context.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("svirt_start_destroy_host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_start_destroy_vm_sec_type", "dynamic")
sec_model = params.get("svirt_start_destroy_vm_sec_model", "selinux")
sec_label = params.get("svirt_start_destroy_vm_sec_label", None)
sec_relabel = params.get("svirt_start_destroy_vm_sec_relabel", "yes")
sec_dict = {
'type': sec_type,
'model': sec_model,
'label': sec_label,
'relabel': sec_relabel
}
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get varialbles about image.
img_label = params.get('svirt_start_destroy_disk_label')
# Label the disks of VM with img_label.
disks = vm.get_disk_devices()
backup_labels_of_disks = {}
for disk in disks.values():
disk_path = disk['source']
backup_labels_of_disks[disk_path] = utils_selinux.get_context_of_file(
filename=disk_path)
utils_selinux.set_context_of_file(filename=disk_path,
context=img_label)
# Set selinux of host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the context of the VM.
vmxml.set_seclabel(sec_dict)
vmxml.sync()
try:
# Start VM to check the VM is able to access the image or not.
try:
vm.start()
# Start VM successfully.
# VM with seclabel can access the image with the context.
if status_error:
raise error.TestFail("Test successed in negative case.")
# Check the label of VM and image when VM is running.
vm_context = utils_selinux.get_context_of_process(vm.get_pid())
if (sec_type == "static") and (not vm_context == sec_label):
raise error.TestFail(
"Label of VM is not expected after starting.\n"
"Detail: vm_context=%s, sec_label=%s" %
(vm_context, sec_label))
disk_context = utils_selinux.get_context_of_file(
filename=disks.values()[0]['source'])
if (sec_relabel == "no") and (not disk_context == img_label):
raise error.TestFail("Label of disk is not expected after VM "
"starting.\n"
"Detail: disk_context=%s, img_label=%s." %
(disk_context, img_label))
if sec_relabel == "yes":
vmxml = VMXML.new_from_dumpxml(vm_name)
imagelabel = vmxml.get_seclabel()['imagelabel']
if not disk_context == imagelabel:
raise error.TestFail(
"Label of disk is not relabeled by VM\n"
"Detal: disk_context=%s, imagelabel=%s" %
(disk_context, imagelabel))
# Check the label of disk after VM being destroyed.
vm.destroy()
img_label_after = utils_selinux.get_context_of_file(
filename=disks.values()[0]['source'])
if (not img_label_after == img_label):
raise error.TestFail(
"Bug: Label of disk is not restored in VM "
"shuting down.\n"
"Detail: img_label_after=%s, "
"img_label_before=%s.\n" % (img_label_after, img_label))
except virt_vm.VMStartError, e:
# Starting VM failed.
# VM with seclabel can not access the image with the context.
if not status_error:
raise error.TestFail("Test failed in positive case."
"error: %s" % e)
finally:
# clean up
for path, label in backup_labels_of_disks.items():
utils_selinux.set_context_of_file(filename=path, context=label)
backup_xml.sync()
utils_selinux.set_status(backup_sestatus)
def run(test, params, env):
"""
Test svirt in adding disk to VM.
(1).Init variables for test.
(2).Label the VM and disk with proper label.
(3).Save VM and check the context.
(4).Restore VM and check the context.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("svirt_save_restore_host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_save_restore_vm_sec_type", "dynamic")
sec_model = params.get("svirt_save_restore_vm_sec_model", "selinux")
sec_label = params.get("svirt_save_restore_vm_sec_label", None)
sec_relabel = params.get("svirt_save_restore_vm_sec_relabel", "yes")
sec_dict = {'type': sec_type, 'model': sec_model, 'label': sec_label,
'relabel': sec_relabel}
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get varialbles about image.
img_label = params.get('svirt_save_restore_disk_label')
# Label the disks of VM with img_label.
disks = vm.get_disk_devices()
backup_labels_of_disks = {}
for disk in list(disks.values()):
disk_path = disk['source']
backup_labels_of_disks[disk_path] = utils_selinux.get_context_of_file(
filename=disk_path)
utils_selinux.set_context_of_file(filename=disk_path,
context=img_label)
# Set selinux of host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the context of the VM.
vmxml.set_seclabel([sec_dict])
vmxml.sync()
# Init a path to save VM.
save_path = os.path.join(data_dir.get_tmp_dir(), "svirt_save")
try:
# Start VM to check the VM is able to access the image or not.
try:
vm.start()
vm.save_to_file(path=save_path)
vm.restore_from_file(path=save_path)
# Save and restore VM successfully.
if status_error:
test.fail("Test succeeded in negative case.")
except virt_vm.VMError as e:
if not status_error:
error_msg = "Test failed in positive case.\n error: %s\n" % e
if str(e).count("getfd"):
error_msg += ("More info pleass refer to"
" https://bugzilla.redhat.com/show_bug.cgi?id=976632")
test.fail(error_msg)
finally:
# clean up
for path, label in list(backup_labels_of_disks.items()):
utils_selinux.set_context_of_file(filename=path, context=label)
backup_xml.sync()
utils_selinux.set_status(backup_sestatus)
def run(test, params, env):
"""
Test svirt in adding disk to VM.
(1).Init variables for test.
(2).Create a image to attached to VM.
(3).Attach disk.
(4).Start VM and check result.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("svirt_attach_disk_host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_attach_disk_vm_sec_type", "dynamic")
sec_model = params.get("svirt_attach_disk_vm_sec_model", "selinux")
sec_label = params.get("svirt_attach_disk_vm_sec_label", None)
sec_relabel = params.get("svirt_attach_disk_vm_sec_relabel", "yes")
sec_dict = {'type': sec_type, 'model': sec_model, 'label': sec_label,
'relabel': sec_relabel}
disk_seclabel = params.get("disk_seclabel", "no")
# Get variables about pool vol
with_pool_vol = 'yes' == params.get("with_pool_vol", "no")
check_cap_rawio = "yes" == params.get("check_cap_rawio", "no")
virt_use_nfs = params.get("virt_use_nfs", "off")
pool_name = params.get("pool_name")
pool_type = params.get("pool_type")
pool_target = params.get("pool_target")
emulated_image = params.get("emulated_image")
vol_name = params.get("vol_name")
vol_format = params.get("vol_format", "qcow2")
device_target = params.get("disk_target")
device_bus = params.get("disk_target_bus")
device_type = params.get("device_type", "file")
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get varialbles about image.
img_label = params.get('svirt_attach_disk_disk_label')
sec_disk_dict = {'model': sec_model, 'label': img_label, 'relabel': sec_relabel}
enable_namespace = 'yes' == params.get('enable_namespace', 'no')
img_name = "svirt_disk"
# Default label for the other disks.
# To ensure VM is able to access other disks.
default_label = params.get('svirt_attach_disk_disk_default_label', None)
# Set selinux of host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the default label to other disks of vm.
disks = vm.get_disk_devices()
for disk in list(disks.values()):
utils_selinux.set_context_of_file(filename=disk['source'],
context=default_label)
pvt = None
qemu_conf = utils_config.LibvirtQemuConfig()
libvirtd = utils_libvirtd.Libvirtd()
disk_xml = Disk(type_name=device_type)
disk_xml.device = "disk"
try:
# set qemu conf
if check_cap_rawio:
qemu_conf.user = '******'
qemu_conf.group = 'root'
logging.debug("the qemu.conf content is: %s" % qemu_conf)
libvirtd.restart()
if with_pool_vol:
# Create dst pool for create attach vol img
pvt = utlv.PoolVolumeTest(test, params)
logging.debug("pool_type %s" % pool_type)
pvt.pre_pool(pool_name, pool_type, pool_target,
emulated_image, image_size="1G",
pre_disk_vol=["20M"])
if pool_type in ["iscsi", "disk"]:
# iscsi and disk pool did not support create volume in libvirt,
# logical pool could use libvirt to create volume but volume
# format is not supported and will be 'raw' as default.
pv = libvirt_storage.PoolVolume(pool_name)
vols = list(pv.list_volumes().keys())
vol_format = "raw"
if vols:
vol_name = vols[0]
else:
test.cancel("No volume in pool: %s" % pool_name)
else:
vol_arg = {'name': vol_name, 'format': vol_format,
'capacity': 1073741824,
'allocation': 1048576, }
# Set volume xml file
volxml = libvirt_xml.VolXML()
newvol = volxml.new_vol(**vol_arg)
vol_xml = newvol['xml']
# Run virsh_vol_create to create vol
logging.debug("create volume from xml: %s" % newvol.xmltreefile)
cmd_result = virsh.vol_create(pool_name, vol_xml,
ignore_status=True,
debug=True)
if cmd_result.exit_status:
test.cancel("Failed to create attach volume.")
cmd_result = virsh.vol_path(vol_name, pool_name, debug=True)
if cmd_result.exit_status:
test.cancel("Failed to get volume path from pool.")
img_path = cmd_result.stdout.strip()
if pool_type in ["iscsi", "disk"]:
source_type = "dev"
if pool_type == "iscsi":
disk_xml.device = "lun"
disk_xml.rawio = "yes"
else:
if not enable_namespace:
qemu_conf.namespaces = ''
logging.debug("the qemu.conf content is: %s" % qemu_conf)
libvirtd.restart()
else:
source_type = "file"
# set host_sestatus as nfs pool will reset it
utils_selinux.set_status(host_sestatus)
# set virt_use_nfs
result = process.run("setsebool virt_use_nfs %s" % virt_use_nfs,
shell=True)
if result.exit_status:
test.cancel("Failed to set virt_use_nfs value")
else:
source_type = "file"
# Init a QemuImg instance.
params['image_name'] = img_name
tmp_dir = data_dir.get_tmp_dir()
image = qemu_storage.QemuImg(params, tmp_dir, img_name)
# Create a image.
img_path, result = image.create(params)
# Set the context of the image.
if sec_relabel == "no":
utils_selinux.set_context_of_file(filename=img_path, context=img_label)
disk_xml.target = {"dev": device_target, "bus": device_bus}
disk_xml.driver = {"name": "qemu", "type": vol_format}
if disk_seclabel == "yes":
source_seclabel = []
sec_xml = seclabel.Seclabel()
sec_xml.update(sec_disk_dict)
source_seclabel.append(sec_xml)
disk_source = disk_xml.new_disk_source(**{"attrs": {source_type: img_path},
"seclabels": source_seclabel})
else:
disk_source = disk_xml.new_disk_source(**{"attrs": {source_type: img_path}})
# Set the context of the VM.
vmxml.set_seclabel([sec_dict])
vmxml.sync()
disk_xml.source = disk_source
logging.debug(disk_xml)
# Do the attach action.
cmd_result = virsh.attach_device(domainarg=vm_name, filearg=disk_xml.xml, flagstr='--persistent')
libvirt.check_exit_status(cmd_result, expect_error=False)
logging.debug("the domain xml is: %s" % vmxml.xmltreefile)
# Start VM to check the VM is able to access the image or not.
try:
vm.start()
# Start VM successfully.
# VM with set seclabel can access the image with the
# set context.
if status_error:
test.fail('Test succeeded in negative case.')
if check_cap_rawio:
cap_list = ['CapPrm', 'CapEff', 'CapBnd']
cap_dict = {}
pid = vm.get_pid()
pid_status_path = "/proc/%s/status" % pid
with open(pid_status_path) as f:
for line in f:
val_list = line.split(":")
if val_list[0] in cap_list:
cap_dict[val_list[0]] = int(val_list[1].strip(), 16)
# bit and with rawio capabilitiy value to check cap_sys_rawio
# is set
cap_rawio_val = 0x0000000000020000
for i in cap_list:
if not cap_rawio_val & cap_dict[i]:
err_msg = "vm process with %s: 0x%x" % (i, cap_dict[i])
err_msg += " lack cap_sys_rawio capabilities"
test.fail(err_msg)
else:
inf_msg = "vm process with %s: 0x%x" % (i, cap_dict[i])
inf_msg += " have cap_sys_rawio capabilities"
logging.debug(inf_msg)
if pool_type == "disk":
if libvirt_version.version_compare(3, 1, 0) and enable_namespace:
vm_pid = vm.get_pid()
output = process.system_output(
"nsenter -t %d -m -- ls -Z %s" % (vm_pid, img_path))
else:
output = process.system_output('ls -Z %s' % img_path)
logging.debug("The default label is %s", default_label)
logging.debug("The label after guest started is %s", to_text(output.strip().split()[-2]))
if default_label not in to_text(output.strip().split()[-2]):
test.fail("The label is wrong after guest started\n")
except virt_vm.VMStartError as e:
# Starting VM failed.
# VM with set seclabel can not access the image with the
# set context.
if not status_error:
test.fail("Test failed in positive case."
"error: %s" % e)
cmd_result = virsh.detach_device(domainarg=vm_name, filearg=disk_xml.xml)
libvirt.check_exit_status(cmd_result, status_error)
finally:
# clean up
vm.destroy()
if not with_pool_vol:
image.remove()
if pvt:
try:
pvt.cleanup_pool(pool_name, pool_type, pool_target,
emulated_image)
except exceptions.TestFail as detail:
logging.error(str(detail))
backup_xml.sync()
utils_selinux.set_status(backup_sestatus)
if check_cap_rawio:
qemu_conf.restore()
libvirtd.restart()
def run(test, params, env):
"""
Test svirt in virt-install.
(1). Init variables.
(2). Set selinux on host.
(3). Set label of image.
(4). run a virt-install command.
(5). clean up.
As this test only care whether the qemu-kvm process
can access the image. It is not necessary to install
a full os in a vm. Just verify the vm is alive after
virt-install command is enough. Then we can save a lot
of time and make this test independent from unattended_install.
"""
# Get general variables.
status_error = "yes" == params.get("status_error", "no")
host_sestatus = params.get("host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_install_vm_sec_type", "dynamic")
sec_model = params.get("svirt_install_vm_sec_model", "selinux")
sec_label = params.get("svirt_install_vm_sec_label", None)
sec_relabel = params.get("svirt_install_vm_sec_relabel", "yes")
# Set selinux status on host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the image label.
disk_label = params.get("svirt_install_disk_label", None)
vm_name = params.get("main_vm", None)
# svirt will prevent accessing via a symble link.
data_path = data_dir.get_data_dir()
real_data_path = os.path.realpath(data_path)
image_path = os.path.join(real_data_path, "svirt_image")
if virsh.domain_exists(vm_name):
virsh.remove_domain(vm_name)
if not os.path.exists(image_path):
utils_test.libvirt.create_local_disk("file", path=image_path)
try:
utils_selinux.set_context_of_file(image_path, disk_label)
cmd = "virt-install --name %s --import --disk path=%s --ram '1024' " % (vm_name, image_path)
cmd += " --security"
if sec_type == "static":
if sec_label is None:
raise ValueError("Seclabel is not setted for static.")
cmd += " type=static,label=%s" % (sec_label)
elif sec_type == "dynamic":
cmd += " type=dynamic"
else:
raise ValueError("Security type %s is not supported." % sec_type)
if sec_relabel is not None:
cmd += ",relabel=%s" % sec_relabel
cmd += "&"
utils.run(cmd, ignore_status=True)
def _vm_alive():
return virsh.is_alive(vm_name)
if utils_misc.wait_for(_vm_alive, timeout=5):
if status_error:
raise error.TestFail("Test succeeded in negative case.")
else:
if not status_error:
raise error.TestFail("Test failed in positive case.")
finally:
# cleanup
utils_selinux.set_status(backup_sestatus)
if virsh.domain_exists(vm_name):
virsh.remove_domain(vm_name)
if not os.path.exists(image_path):
utils_test.libvirt.delete_local_disk("file", path=image_path)
def run_svirt_attach_disk(test, params, env):
"""
Test svirt in adding disk to VM.
(1).Init variables for test.
(2).Create a image to attached to VM.
(3).Attach disk.
(4).Start VM and check result.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("svirt_attach_disk_host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_attach_disk_vm_sec_type", "dynamic")
sec_model = params.get("svirt_attach_disk_vm_sec_model", "selinux")
sec_label = params.get("svirt_attach_disk_vm_sec_label", None)
sec_relabel = params.get("svirt_attach_disk_vm_sec_relabel", "yes")
sec_dict = {
'type': sec_type,
'model': sec_model,
'label': sec_label,
'relabel': sec_relabel
}
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get varialbles about image.
img_label = params.get('svirt_attach_disk_disk_label')
img_name = "svirt_disk"
# Default label for the other disks.
# To ensure VM is able to access other disks.
default_label = params.get('svirt_attach_disk_disk_default_label', None)
# Set selinux of host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the default label to other disks of vm.
disks = vm.get_disk_devices()
for disk in disks.values():
utils_selinux.set_context_of_file(filename=disk['source'],
context=default_label)
# Init a QemuImg instance.
params['image_name'] = img_name
tmp_dir = data_dir.get_tmp_dir()
image = qemu_storage.QemuImg(params, tmp_dir, img_name)
# Create a image.
img_path, result = image.create(params)
# Set the context of the image.
utils_selinux.set_context_of_file(filename=img_path, context=img_label)
# Set the context of the VM.
vmxml.set_seclabel(sec_dict)
vmxml.sync()
# Do the attach action.
vm.attach_disk(source=img_path, target="vdf", extra="--persistent")
# Check result.
try:
# Start VM to check the VM is able to access the image or not.
try:
vm.start()
# Start VM successfully.
# VM with set seclabel can access the image with the
# set context.
if status_error:
raise error.TestFail('Test successed in negative case.')
except virt_vm.VMStartError, e:
# Starting VM failed.
# VM with set seclabel can not access the image with the
# set context.
if not status_error:
raise error.TestFail("Test failed in positive case."
"error: %s" % e)
finally:
# clean up
vm.detach_disk(target="vdf", extra="--persistent")
image.remove()
backup_xml.sync()
utils_selinux.set_status(backup_sestatus)
def run(test, params, env):
"""
Test svirt in adding disk to VM.
(1).Init variables for test.
(2).Create a image to attached to VM.
(3).Attach disk.
(4).Start VM and check result.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("svirt_attach_disk_host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_attach_disk_vm_sec_type", "dynamic")
sec_model = params.get("svirt_attach_disk_vm_sec_model", "selinux")
sec_label = params.get("svirt_attach_disk_vm_sec_label", None)
sec_relabel = params.get("svirt_attach_disk_vm_sec_relabel", "yes")
sec_dict = {'type': sec_type, 'model': sec_model, 'label': sec_label,
'relabel': sec_relabel}
# Get variables about pool vol
with_pool_vol = 'yes' == params.get("with_pool_vol", "no")
check_cap_rawio = "yes" == params.get("check_cap_rawio", "no")
virt_use_nfs = params.get("virt_use_nfs", "off")
pool_name = params.get("pool_name")
pool_type = params.get("pool_type")
pool_target = params.get("pool_target")
emulated_image = params.get("emulated_image")
vol_name = params.get("vol_name")
vol_format = params.get("vol_format")
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get varialbles about image.
img_label = params.get('svirt_attach_disk_disk_label')
img_name = "svirt_disk"
# Default label for the other disks.
# To ensure VM is able to access other disks.
default_label = params.get('svirt_attach_disk_disk_default_label', None)
# Set selinux of host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the default label to other disks of vm.
disks = vm.get_disk_devices()
for disk in disks.values():
utils_selinux.set_context_of_file(filename=disk['source'],
context=default_label)
pvt = None
qemu_conf = utils_config.LibvirtQemuConfig()
libvirtd = utils_libvirtd.Libvirtd()
try:
# set qemu conf
if check_cap_rawio:
qemu_conf.user = '******'
qemu_conf.group = 'root'
logging.debug("the qemu.conf content is: %s" % qemu_conf)
libvirtd.restart()
# Set the context of the VM.
vmxml.set_seclabel([sec_dict])
vmxml.sync()
logging.debug("the domain xml is: %s" % vmxml.xmltreefile)
if with_pool_vol:
# Create dst pool for create attach vol img
pvt = utlv.PoolVolumeTest(test, params)
logging.debug("pool_type %s" % pool_type)
pvt.pre_pool(pool_name, pool_type, pool_target,
emulated_image, image_size="1G",
pre_disk_vol=["20M"])
if pool_type in ["iscsi", "disk"]:
# iscsi and disk pool did not support create volume in libvirt,
# logical pool could use libvirt to create volume but volume
# format is not supported and will be 'raw' as default.
pv = libvirt_storage.PoolVolume(pool_name)
vols = pv.list_volumes().keys()
if vols:
vol_name = vols[0]
else:
raise error.TestNAError("No volume in pool: %s" % pool_name)
else:
vol_arg = {'name': vol_name, 'format': vol_format,
'capacity': 1073741824,
'allocation': 1048576, }
# Set volume xml file
volxml = libvirt_xml.VolXML()
newvol = volxml.new_vol(**vol_arg)
vol_xml = newvol['xml']
# Run virsh_vol_create to create vol
logging.debug("create volume from xml: %s" % newvol.xmltreefile)
cmd_result = virsh.vol_create(pool_name, vol_xml,
ignore_status=True,
debug=True)
if cmd_result.exit_status:
raise error.TestNAError("Failed to create attach volume.")
cmd_result = virsh.vol_path(vol_name, pool_name, debug=True)
if cmd_result.exit_status:
raise error.TestNAError("Failed to get volume path from pool.")
img_path = cmd_result.stdout.strip()
if pool_type in ["iscsi", "disk"]:
extra = "--driver qemu --type lun --rawio --persistent"
else:
extra = "--persistent --subdriver qcow2"
# set host_sestatus as nfs pool will reset it
utils_selinux.set_status(host_sestatus)
# set virt_use_nfs
result = utils.run("setsebool virt_use_nfs %s" % virt_use_nfs)
if result.exit_status:
raise error.TestNAError("Failed to set virt_use_nfs value")
else:
# Init a QemuImg instance.
params['image_name'] = img_name
tmp_dir = data_dir.get_tmp_dir()
image = qemu_storage.QemuImg(params, tmp_dir, img_name)
# Create a image.
img_path, result = image.create(params)
# Set the context of the image.
utils_selinux.set_context_of_file(filename=img_path, context=img_label)
extra = "--persistent"
# Do the attach action.
result = virsh.attach_disk(vm_name, source=img_path, target="vdf",
extra=extra, debug=True)
if result.exit_status:
raise error.TestFail("Failed to attach disk %s to VM."
"Detail: %s." % (img_path, result.stderr))
# Start VM to check the VM is able to access the image or not.
try:
vm.start()
# Start VM successfully.
# VM with set seclabel can access the image with the
# set context.
if status_error:
raise error.TestFail('Test succeeded in negative case.')
if check_cap_rawio:
cap_list = ['CapPrm', 'CapEff', 'CapBnd']
cap_dict = {}
pid = vm.get_pid()
pid_status_path = "/proc/%s/status" % pid
with open(pid_status_path) as f:
for line in f:
val_list = line.split(":")
if val_list[0] in cap_list:
cap_dict[val_list[0]] = int(val_list[1].strip(), 16)
# bit and with rawio capabilitiy value to check cap_sys_rawio
# is set
cap_rawio_val = 0x0000000000020000
for i in cap_list:
if not cap_rawio_val & cap_dict[i]:
err_msg = "vm process with %s: 0x%x" % (i, cap_dict[i])
err_msg += " lack cap_sys_rawio capabilities"
raise error.TestFail(err_msg)
else:
inf_msg = "vm process with %s: 0x%x" % (i, cap_dict[i])
inf_msg += " have cap_sys_rawio capabilities"
logging.debug(inf_msg)
except virt_vm.VMStartError, e:
# Starting VM failed.
# VM with set seclabel can not access the image with the
# set context.
if not status_error:
raise error.TestFail("Test failed in positive case."
"error: %s" % e)
try:
virsh.detach_disk(vm_name, target="vdf", extra="--persistent",
debug=True)
except error.CmdError:
raise error.TestFail("Detach disk 'vdf' from VM %s failed."
% vm.name)
def run(test, params, env):
"""
Test svirt in adding disk to VM.
(1).Init variables for test.
(2).Label the VM and disk with proper label.
(3).Start VM and check the context.
(4).Destroy VM and check the context.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get(
"svirt_undefine_define_host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_undefine_define_vm_sec_type", "dynamic")
sec_model = params.get("svirt_undefine_define_vm_sec_model", "selinux")
sec_label = params.get("svirt_undefine_define_vm_sec_label", None)
sec_relabel = params.get("svirt_undefine_define_vm_sec_relabel", "yes")
sec_dict = {'type': sec_type, 'model': sec_model, 'label': sec_label,
'relabel': sec_relabel}
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get varialbles about image.
img_label = params.get('svirt_undefine_define_disk_label')
# Label the disks of VM with img_label.
disks = vm.get_disk_devices()
backup_labels_of_disks = {}
for disk in disks.values():
disk_path = disk['source']
backup_labels_of_disks[disk_path] = utils_selinux.get_context_of_file(
filename=disk_path)
utils_selinux.set_context_of_file(filename=disk_path,
context=img_label)
# Set selinux of host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the context of the VM.
vmxml.set_seclabel([sec_dict])
vmxml.sync()
try:
xml_file = (os.path.join(data_dir.get_tmp_dir(), "vmxml"))
if vm.is_alive():
vm.destroy()
virsh.dumpxml(vm.name, to_file=xml_file)
cmd_result = virsh.undefine(vm.name)
if cmd_result.exit_status:
raise error.TestFail("Failed to undefine vm."
"Detail: %s" % cmd_result)
cmd_result = virsh.define(xml_file)
if cmd_result.exit_status:
raise error.TestFail("Failed to define vm."
"Detail: %s" % cmd_result)
finally:
# clean up
for path, label in backup_labels_of_disks.items():
utils_selinux.set_context_of_file(filename=path, context=label)
backup_xml.sync()
utils_selinux.set_status(backup_sestatus)
def run(test, params, env):
"""
Test svirt in adding disk to VM.
(1).Init variables for test.
(2).Config qemu conf if need
(3).Label the VM and disk with proper label.
(4).Start VM and check the context.
(5).Destroy VM and check the context.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("svirt_start_destroy_host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_start_destroy_vm_sec_type", "dynamic")
sec_model = params.get("svirt_start_destroy_vm_sec_model", "selinux")
sec_label = params.get("svirt_start_destroy_vm_sec_label", None)
security_driver = params.get("security_driver", None)
security_default_confined = params.get("security_default_confined", None)
security_require_confined = params.get("security_require_confined", None)
no_sec_model = 'yes' == params.get("no_sec_model", 'no')
sec_relabel = params.get("svirt_start_destroy_vm_sec_relabel", "yes")
sec_dict = {'type': sec_type, 'relabel': sec_relabel}
sec_dict_list = []
if not no_sec_model:
if "," in sec_model:
sec_models = sec_model.split(",")
for model in sec_models:
sec_dict['model'] = model
if sec_type != "none":
sec_dict['label'] = sec_label
sec_dict_copy = sec_dict.copy()
sec_dict_list.append(sec_dict_copy)
else:
sec_dict['model'] = sec_model
if sec_type != "none":
sec_dict['label'] = sec_label
sec_dict_list.append(sec_dict)
else:
sec_dict_list.append(sec_dict)
logging.debug("sec_dict_list is: %s" % sec_dict_list)
poweroff_with_destroy = ("destroy" == params.get(
"svirt_start_destroy_vm_poweroff", "destroy"))
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get varialbles about image.
img_label = params.get('svirt_start_destroy_disk_label')
# Backup disk Labels.
disks = vm.get_disk_devices()
backup_labels_of_disks = {}
backup_ownership_of_disks = {}
for disk in disks.values():
disk_path = disk['source']
backup_labels_of_disks[disk_path] = utils_selinux.get_context_of_file(
filename=disk_path)
f = os.open(disk_path, 0)
stat_re = os.fstat(f)
backup_ownership_of_disks[disk_path] = "%s:%s" % (stat_re.st_uid,
stat_re.st_gid)
# Backup selinux of host.
backup_sestatus = utils_selinux.get_status()
qemu_conf = utils_config.LibvirtQemuConfig()
libvirtd = utils_libvirtd.Libvirtd()
try:
# Set disk label
for disk in disks.values():
disk_path = disk['source']
utils_selinux.set_context_of_file(filename=disk_path,
context=img_label)
os.chown(disk_path, 107, 107)
# Set selinux of host.
utils_selinux.set_status(host_sestatus)
# Set qemu conf
if security_driver:
qemu_conf.set_string('security_driver', security_driver)
if security_default_confined:
qemu_conf.security_default_confined = security_default_confined
if security_require_confined:
qemu_conf.security_require_confined = security_require_confined
if (security_driver or security_default_confined or
security_require_confined):
logging.debug("the qemu.conf content is: %s" % qemu_conf)
libvirtd.restart()
# Set the context of the VM.
vmxml.set_seclabel(sec_dict_list)
vmxml.sync()
logging.debug("the domain xml is: %s" % vmxml.xmltreefile)
# Start VM to check the VM is able to access the image or not.
try:
vm.start()
# Start VM successfully.
# VM with seclabel can access the image with the context.
if status_error:
raise error.TestFail("Test succeeded in negative case.")
# Check the label of VM and image when VM is running.
vm_context = utils_selinux.get_context_of_process(vm.get_pid())
if (sec_type == "static") and (not vm_context == sec_label):
raise error.TestFail("Label of VM is not expected after "
"starting.\n"
"Detail: vm_context=%s, sec_label=%s"
% (vm_context, sec_label))
disk_context = utils_selinux.get_context_of_file(
filename=disks.values()[0]['source'])
if (sec_relabel == "no") and (not disk_context == img_label):
raise error.TestFail("Label of disk is not expected after VM "
"starting.\n"
"Detail: disk_context=%s, img_label=%s."
% (disk_context, img_label))
if sec_relabel == "yes" and not no_sec_model:
vmxml = VMXML.new_from_dumpxml(vm_name)
imagelabel = vmxml.get_seclabel()[0]['imagelabel']
if not disk_context == imagelabel:
raise error.TestFail("Label of disk is not relabeled by "
"VM\nDetal: disk_context="
"%s, imagelabel=%s"
% (disk_context, imagelabel))
# Check the label of disk after VM being destroyed.
if poweroff_with_destroy:
vm.destroy(gracefully=False)
else:
vm.wait_for_login()
vm.shutdown()
img_label_after = utils_selinux.get_context_of_file(
filename=disks.values()[0]['source'])
if (not img_label_after == img_label):
# Bug 547546 - RFE: the security drivers must remember original
# permissions/labels and restore them after
# https://bugzilla.redhat.com/show_bug.cgi?id=547546
err_msg = "Label of disk is not restored in VM shuting down.\n"
err_msg += "Detail: img_label_after=%s, " % img_label_after
err_msg += "img_label_before=%s.\n" % img_label
err_msg += "More info in https://bugzilla.redhat.com/show_bug"
err_msg += ".cgi?id=547546"
raise error.TestFail(err_msg)
except virt_vm.VMStartError, e:
# Starting VM failed.
# VM with seclabel can not access the image with the context.
if not status_error:
raise error.TestFail("Test failed in positive case."
"error: %s" % e)
finally:
# clean up
for path, label in backup_labels_of_disks.items():
utils_selinux.set_context_of_file(filename=path, context=label)
for path, label in backup_ownership_of_disks.items():
label_list = label.split(":")
os.chown(path, int(label_list[0]), int(label_list[1]))
backup_xml.sync()
utils_selinux.set_status(backup_sestatus)
if (security_driver or security_default_confined or
security_require_confined):
qemu_conf.restore()
libvirtd.restart()
def run(test, params, env):
"""
Test svirt in adding disk to VM.
(1).Init variables for test.
(2).Config qemu conf if need
(3).Label the VM and disk with proper label.
(4).Start VM and check the context.
(5).Destroy VM and check the context.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("svirt_start_destroy_host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_start_destroy_vm_sec_type", "dynamic")
sec_model = params.get("svirt_start_destroy_vm_sec_model", "selinux")
sec_label = params.get("svirt_start_destroy_vm_sec_label", None)
security_driver = params.get("security_driver", None)
security_default_confined = params.get("security_default_confined", None)
security_require_confined = params.get("security_require_confined", None)
no_sec_model = 'yes' == params.get("no_sec_model", 'no')
sec_relabel = params.get("svirt_start_destroy_vm_sec_relabel", "yes")
sec_dict = {'type': sec_type, 'relabel': sec_relabel}
sec_dict_list = []
if not no_sec_model:
if "," in sec_model:
sec_models = sec_model.split(",")
for model in sec_models:
sec_dict['model'] = model
if sec_type != "none":
sec_dict['label'] = sec_label
sec_dict_copy = sec_dict.copy()
sec_dict_list.append(sec_dict_copy)
else:
sec_dict['model'] = sec_model
if sec_type != "none":
sec_dict['label'] = sec_label
sec_dict_list.append(sec_dict)
else:
sec_dict_list.append(sec_dict)
logging.debug("sec_dict_list is: %s" % sec_dict_list)
poweroff_with_destroy = ("destroy" == params.get(
"svirt_start_destroy_vm_poweroff", "destroy"))
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get varialbles about image.
img_label = params.get('svirt_start_destroy_disk_label')
# Backup disk Labels.
disks = vm.get_disk_devices()
backup_labels_of_disks = {}
backup_ownership_of_disks = {}
for disk in disks.values():
disk_path = disk['source']
backup_labels_of_disks[disk_path] = utils_selinux.get_context_of_file(
filename=disk_path)
f = os.open(disk_path, 0)
stat_re = os.fstat(f)
backup_ownership_of_disks[disk_path] = "%s:%s" % (stat_re.st_uid,
stat_re.st_gid)
# Backup selinux of host.
backup_sestatus = utils_selinux.get_status()
qemu_conf = utils_config.LibvirtQemuConfig()
libvirtd = utils_libvirtd.Libvirtd()
try:
# Set disk label
for disk in disks.values():
disk_path = disk['source']
utils_selinux.set_context_of_file(filename=disk_path,
context=img_label)
os.chown(disk_path, 107, 107)
# Set selinux of host.
utils_selinux.set_status(host_sestatus)
# Set qemu conf
if security_driver:
qemu_conf.set_string('security_driver', security_driver)
if security_default_confined:
qemu_conf.security_default_confined = security_default_confined
if security_require_confined:
qemu_conf.security_require_confined = security_require_confined
if (security_driver or security_default_confined
or security_require_confined):
logging.debug("the qemu.conf content is: %s" % qemu_conf)
libvirtd.restart()
# Set the context of the VM.
vmxml.set_seclabel(sec_dict_list)
vmxml.sync()
logging.debug("the domain xml is: %s" % vmxml.xmltreefile)
# Start VM to check the VM is able to access the image or not.
try:
vm.start()
# Start VM successfully.
# VM with seclabel can access the image with the context.
if status_error:
raise error.TestFail("Test succeeded in negative case.")
# Check the label of VM and image when VM is running.
vm_context = utils_selinux.get_context_of_process(vm.get_pid())
if (sec_type == "static") and (not vm_context == sec_label):
raise error.TestFail("Label of VM is not expected after "
"starting.\n"
"Detail: vm_context=%s, sec_label=%s" %
(vm_context, sec_label))
disk_context = utils_selinux.get_context_of_file(
filename=disks.values()[0]['source'])
if (sec_relabel == "no") and (not disk_context == img_label):
raise error.TestFail("Label of disk is not expected after VM "
"starting.\n"
"Detail: disk_context=%s, img_label=%s." %
(disk_context, img_label))
if sec_relabel == "yes" and not no_sec_model:
vmxml = VMXML.new_from_dumpxml(vm_name)
imagelabel = vmxml.get_seclabel()[0]['imagelabel']
if not disk_context == imagelabel:
raise error.TestFail("Label of disk is not relabeled by "
"VM\nDetal: disk_context="
"%s, imagelabel=%s" %
(disk_context, imagelabel))
# Check the label of disk after VM being destroyed.
if poweroff_with_destroy:
vm.destroy(gracefully=False)
else:
vm.wait_for_login()
vm.shutdown()
img_label_after = utils_selinux.get_context_of_file(
filename=disks.values()[0]['source'])
if (not img_label_after == img_label):
# Bug 547546 - RFE: the security drivers must remember original
# permissions/labels and restore them after
# https://bugzilla.redhat.com/show_bug.cgi?id=547546
err_msg = "Label of disk is not restored in VM shuting down.\n"
err_msg += "Detail: img_label_after=%s, " % img_label_after
err_msg += "img_label_before=%s.\n" % img_label
err_msg += "More info in https://bugzilla.redhat.com/show_bug"
err_msg += ".cgi?id=547546"
raise error.TestFail(err_msg)
except virt_vm.VMStartError, e:
# Starting VM failed.
# VM with seclabel can not access the image with the context.
if not status_error:
raise error.TestFail("Test failed in positive case."
"error: %s" % e)
finally:
# clean up
for path, label in backup_labels_of_disks.items():
utils_selinux.set_context_of_file(filename=path, context=label)
for path, label in backup_ownership_of_disks.items():
label_list = label.split(":")
os.chown(path, int(label_list[0]), int(label_list[1]))
backup_xml.sync()
utils_selinux.set_status(backup_sestatus)
if (security_driver or security_default_confined
or security_require_confined):
qemu_conf.restore()
libvirtd.restart()
def run(test, params, env):
"""
Test svirt in adding disk to VM.
(1).Init variables for test.
(2).Create a image to attached to VM.
(3).Attach disk.
(4).Start VM and check result.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("svirt_attach_disk_host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_attach_disk_vm_sec_type", "dynamic")
sec_model = params.get("svirt_attach_disk_vm_sec_model", "selinux")
sec_label = params.get("svirt_attach_disk_vm_sec_label", None)
sec_relabel = params.get("svirt_attach_disk_vm_sec_relabel", "yes")
sec_dict = {
'type': sec_type,
'model': sec_model,
'label': sec_label,
'relabel': sec_relabel
}
disk_seclabel = params.get("disk_seclabel", "no")
# Get variables about pool vol
with_pool_vol = 'yes' == params.get("with_pool_vol", "no")
check_cap_rawio = "yes" == params.get("check_cap_rawio", "no")
virt_use_nfs = params.get("virt_use_nfs", "off")
pool_name = params.get("pool_name")
pool_type = params.get("pool_type")
pool_target = params.get("pool_target")
emulated_image = params.get("emulated_image")
vol_name = params.get("vol_name")
vol_format = params.get("vol_format", "qcow2")
device_target = params.get("disk_target")
device_bus = params.get("disk_target_bus")
device_type = params.get("device_type", "file")
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get varialbles about image.
img_label = params.get('svirt_attach_disk_disk_label')
sec_disk_dict = {
'model': sec_model,
'label': img_label,
'relabel': sec_relabel
}
enable_namespace = 'yes' == params.get('enable_namespace', 'no')
img_name = "svirt_disk"
# Default label for the other disks.
# To ensure VM is able to access other disks.
default_label = params.get('svirt_attach_disk_disk_default_label', None)
# Set selinux of host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the default label to other disks of vm.
disks = vm.get_disk_devices()
for disk in list(disks.values()):
utils_selinux.set_context_of_file(filename=disk['source'],
context=default_label)
pvt = None
qemu_conf = utils_config.LibvirtQemuConfig()
libvirtd = utils_libvirtd.Libvirtd()
disk_xml = Disk(type_name=device_type)
disk_xml.device = "disk"
try:
# set qemu conf
if check_cap_rawio:
qemu_conf.user = '******'
qemu_conf.group = 'root'
logging.debug("the qemu.conf content is: %s" % qemu_conf)
libvirtd.restart()
if with_pool_vol:
# Create dst pool for create attach vol img
pvt = utlv.PoolVolumeTest(test, params)
logging.debug("pool_type %s" % pool_type)
pvt.pre_pool(pool_name,
pool_type,
pool_target,
emulated_image,
image_size="1G",
pre_disk_vol=["20M"])
if pool_type in ["iscsi", "disk"]:
# iscsi and disk pool did not support create volume in libvirt,
# logical pool could use libvirt to create volume but volume
# format is not supported and will be 'raw' as default.
pv = libvirt_storage.PoolVolume(pool_name)
vols = list(pv.list_volumes().keys())
vol_format = "raw"
if vols:
vol_name = vols[0]
else:
test.cancel("No volume in pool: %s" % pool_name)
else:
vol_arg = {
'name': vol_name,
'format': vol_format,
'capacity': 1073741824,
'allocation': 1048576,
}
# Set volume xml file
volxml = libvirt_xml.VolXML()
newvol = volxml.new_vol(**vol_arg)
vol_xml = newvol['xml']
# Run virsh_vol_create to create vol
logging.debug("create volume from xml: %s" %
newvol.xmltreefile)
cmd_result = virsh.vol_create(pool_name,
vol_xml,
ignore_status=True,
debug=True)
if cmd_result.exit_status:
test.cancel("Failed to create attach volume.")
cmd_result = virsh.vol_path(vol_name, pool_name, debug=True)
if cmd_result.exit_status:
test.cancel("Failed to get volume path from pool.")
img_path = cmd_result.stdout.strip()
if pool_type in ["iscsi", "disk"]:
source_type = "dev"
if pool_type == "iscsi":
disk_xml.device = "lun"
disk_xml.rawio = "yes"
else:
if not enable_namespace:
qemu_conf.namespaces = ''
logging.debug("the qemu.conf content is: %s" %
qemu_conf)
libvirtd.restart()
else:
source_type = "file"
# set host_sestatus as nfs pool will reset it
utils_selinux.set_status(host_sestatus)
# set virt_use_nfs
result = process.run("setsebool virt_use_nfs %s" % virt_use_nfs,
shell=True)
if result.exit_status:
test.cancel("Failed to set virt_use_nfs value")
else:
source_type = "file"
# Init a QemuImg instance.
params['image_name'] = img_name
tmp_dir = data_dir.get_tmp_dir()
image = qemu_storage.QemuImg(params, tmp_dir, img_name)
# Create a image.
img_path, result = image.create(params)
# Set the context of the image.
if sec_relabel == "no":
utils_selinux.set_context_of_file(filename=img_path,
context=img_label)
disk_xml.target = {"dev": device_target, "bus": device_bus}
disk_xml.driver = {"name": "qemu", "type": vol_format}
if disk_seclabel == "yes":
source_seclabel = []
sec_xml = seclabel.Seclabel()
sec_xml.update(sec_disk_dict)
source_seclabel.append(sec_xml)
disk_source = disk_xml.new_disk_source(**{
"attrs": {
source_type: img_path
},
"seclabels": source_seclabel
})
else:
disk_source = disk_xml.new_disk_source(
**{"attrs": {
source_type: img_path
}})
# Set the context of the VM.
vmxml.set_seclabel([sec_dict])
vmxml.sync()
disk_xml.source = disk_source
logging.debug(disk_xml)
# Do the attach action.
cmd_result = virsh.attach_device(domainarg=vm_name,
filearg=disk_xml.xml,
flagstr='--persistent')
libvirt.check_exit_status(cmd_result, expect_error=False)
logging.debug("the domain xml is: %s" % vmxml.xmltreefile)
# Start VM to check the VM is able to access the image or not.
try:
vm.start()
# Start VM successfully.
# VM with set seclabel can access the image with the
# set context.
if status_error:
test.fail('Test succeeded in negative case.')
if check_cap_rawio:
cap_list = ['CapPrm', 'CapEff', 'CapBnd']
cap_dict = {}
pid = vm.get_pid()
pid_status_path = "/proc/%s/status" % pid
with open(pid_status_path) as f:
for line in f:
val_list = line.split(":")
if val_list[0] in cap_list:
cap_dict[val_list[0]] = int(
val_list[1].strip(), 16)
# bit and with rawio capabilitiy value to check cap_sys_rawio
# is set
cap_rawio_val = 0x0000000000020000
for i in cap_list:
if not cap_rawio_val & cap_dict[i]:
err_msg = "vm process with %s: 0x%x" % (i, cap_dict[i])
err_msg += " lack cap_sys_rawio capabilities"
test.fail(err_msg)
else:
inf_msg = "vm process with %s: 0x%x" % (i, cap_dict[i])
inf_msg += " have cap_sys_rawio capabilities"
logging.debug(inf_msg)
if pool_type == "disk":
if libvirt_version.version_compare(3, 1,
0) and enable_namespace:
vm_pid = vm.get_pid()
output = process.system_output(
"nsenter -t %d -m -- ls -Z %s" % (vm_pid, img_path))
else:
output = process.system_output('ls -Z %s' % img_path)
logging.debug("The default label is %s", default_label)
logging.debug("The label after guest started is %s",
to_text(output.strip().split()[-2]))
if default_label not in to_text(output.strip().split()[-2]):
test.fail("The label is wrong after guest started\n")
except virt_vm.VMStartError as e:
# Starting VM failed.
# VM with set seclabel can not access the image with the
# set context.
if not status_error:
test.fail("Test failed in positive case." "error: %s" % e)
cmd_result = virsh.detach_device(domainarg=vm_name,
filearg=disk_xml.xml)
libvirt.check_exit_status(cmd_result, status_error)
finally:
# clean up
vm.destroy()
if not with_pool_vol:
image.remove()
if pvt:
try:
pvt.cleanup_pool(pool_name, pool_type, pool_target,
emulated_image)
except exceptions.TestFail as detail:
logging.error(str(detail))
backup_xml.sync()
utils_selinux.set_status(backup_sestatus)
if check_cap_rawio:
qemu_conf.restore()
libvirtd.restart()
def run_svirt_start_destroy(test, params, env):
"""
Test svirt in adding disk to VM.
(1).Init variables for test.
(2).Label the VM and disk with proper label.
(3).Start VM and check the context.
(4).Destroy VM and check the context.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("svirt_start_destroy_host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_start_destroy_vm_sec_type", "dynamic")
sec_model = params.get("svirt_start_destroy_vm_sec_model", "selinux")
sec_label = params.get("svirt_start_destroy_vm_sec_label", None)
sec_relabel = params.get("svirt_start_destroy_vm_sec_relabel", "yes")
sec_dict = {'type': sec_type, 'model': sec_model, 'label': sec_label,
'relabel': sec_relabel}
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get varialbles about image.
img_label = params.get('svirt_start_destroy_disk_label')
# Label the disks of VM with img_label.
disks = vm.get_disk_devices()
backup_labels_of_disks = {}
for disk in disks.values():
disk_path = disk['source']
backup_labels_of_disks[disk_path] = utils_selinux.get_context_of_file(
filename=disk_path)
utils_selinux.set_context_of_file(filename=disk_path,
context=img_label)
# Set selinux of host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the context of the VM.
vmxml.set_seclabel(sec_dict)
vmxml.sync()
try:
# Start VM to check the VM is able to access the image or not.
try:
vm.start()
# Start VM successfully.
# VM with seclabel can access the image with the context.
if status_error:
raise error.TestFail("Test successed in negative case.")
# Check the label of VM and image when VM is running.
vm_context = utils_selinux.get_context_of_process(vm.get_pid())
if (sec_type == "static") and (not vm_context == sec_label):
raise error.TestFail("Label of VM is not expected after starting.\n"
"Detail: vm_context=%s, sec_label=%s"
% (vm_context, sec_label))
disk_context = utils_selinux.get_context_of_file(
filename=disks.values()[0]['source'])
if (sec_relabel == "no") and (not disk_context == img_label):
raise error.TestFail("Label of disk is not expected after VM "
"starting.\n"
"Detail: disk_context=%s, img_label=%s."
% (disk_context, img_label))
if sec_relabel == "yes":
vmxml = VMXML.new_from_dumpxml(vm_name)
imagelabel = vmxml.get_seclabel()['imagelabel']
if not disk_context == imagelabel:
raise error.TestFail("Label of disk is not relabeled by VM\n"
"Detal: disk_context=%s, imagelabel=%s"
% (disk_context, imagelabel))
# Check the label of disk after VM being destroyed.
vm.destroy()
img_label_after = utils_selinux.get_context_of_file(
filename=disks.values()[0]['source'])
if (not img_label_after == img_label):
raise error.TestFail("Bug: Label of disk is not restored in VM "
"shuting down.\n"
"Detail: img_label_after=%s, "
"img_label_before=%s.\n"
% (img_label_after, img_label))
except virt_vm.VMStartError, e:
# Starting VM failed.
# VM with seclabel can not access the image with the context.
if not status_error:
raise error.TestFail("Test failed in positive case."
"error: %s" % e)
finally:
# clean up
for path, label in backup_labels_of_disks.items():
utils_selinux.set_context_of_file(filename=path, context=label)
backup_xml.sync()
utils_selinux.set_status(backup_sestatus)
def run_svirt_attach_disk(test, params, env):
"""
Test svirt in adding disk to VM.
(1).Init variables for test.
(2).Create a image to attached to VM.
(3).Attach disk.
(4).Start VM and check result.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("svirt_attach_disk_host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_attach_disk_vm_sec_type", "dynamic")
sec_model = params.get("svirt_attach_disk_vm_sec_model", "selinux")
sec_label = params.get("svirt_attach_disk_vm_sec_label", None)
sec_relabel = params.get("svirt_attach_disk_vm_sec_relabel", "yes")
sec_dict = {'type': sec_type, 'model': sec_model, 'label': sec_label,
'relabel': sec_relabel}
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get varialbles about image.
img_label = params.get('svirt_attach_disk_disk_label')
img_name = "svirt_disk"
# Default label for the other disks.
# To ensure VM is able to access other disks.
default_label = params.get('svirt_attach_disk_disk_default_label', None)
# Set selinux of host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the default label to other disks of vm.
disks = vm.get_disk_devices()
for disk in disks.values():
utils_selinux.set_context_of_file(filename=disk['source'],
context=default_label)
# Init a QemuImg instance.
params['image_name'] = img_name
tmp_dir = data_dir.get_tmp_dir()
image = qemu_storage.QemuImg(params, tmp_dir, img_name)
# Create a image.
img_path, result = image.create(params)
# Set the context of the image.
utils_selinux.set_context_of_file(filename=img_path, context=img_label)
# Set the context of the VM.
vmxml.set_seclabel(sec_dict)
vmxml.sync()
# Do the attach action.
try:
virsh.attach_disk(vm_name, source=img_path, target="vdf",
extra="--persistent", ignore_status=False)
except error.CmdError:
raise error.TestFail("Attach disk %s to vdf on VM %s failed."
% (img_path, vm.name))
# Check result.
try:
# Start VM to check the VM is able to access the image or not.
try:
vm.start()
# Start VM successfully.
# VM with set seclabel can access the image with the
# set context.
if status_error:
raise error.TestFail('Test successed in negative case.')
except virt_vm.VMStartError, e:
# Starting VM failed.
# VM with set seclabel can not access the image with the
# set context.
if not status_error:
raise error.TestFail("Test failed in positive case."
"error: %s" % e)
finally:
# clean up
try:
virsh.detach_disk(vm_name, target="vdf", extra="--persistent",
ignore_status=False)
except error.CmdError:
raise error.TestFail("Detach disk 'vdf' from VM %s failed."
% vm.name)
image.remove()
backup_xml.sync()
utils_selinux.set_status(backup_sestatus)
def run(test, params, env):
"""
Test svirt in virt-install.
(1). Init variables.
(2). Set selinux on host.
(3). Set label of image.
(4). run a virt-install command.
(5). clean up.
As this test only care whether the qemu-kvm process
can access the image. It is not necessary to install
a full os in a vm. Just verify the vm is alive after
virt-install command is enough. Then we can save a lot
of time and make this test independent from unattended_install.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_install_vm_sec_type", "dynamic")
sec_model = params.get("svirt_install_vm_sec_model", "selinux")
sec_label = params.get("svirt_install_vm_sec_label", None)
sec_relabel = params.get("svirt_install_vm_sec_relabel", "yes")
# Set selinux status on host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the image label.
disk_label = params.get("svirt_install_disk_label", None)
vm_name = params.get("main_vm", None)
# svirt will prevent accessing via a symble link.
data_path = data_dir.get_data_dir()
real_data_path = os.path.realpath(data_path)
image_path = os.path.join(real_data_path, "svirt_image")
if virsh.domain_exists(vm_name):
virsh.remove_domain(vm_name)
if not os.path.exists(image_path):
utils_test.libvirt.create_local_disk("file", path=image_path)
try:
utils_selinux.set_context_of_file(image_path, disk_label)
cmd = "virt-install --name %s --import --disk" % vm_name
cmd += " path=%s --ram '1024' " % image_path
cmd += " --security"
if sec_type == 'static':
if sec_label is None:
raise ValueError("Seclabel is not setted for static.")
cmd += " type=static,label=%s" % (sec_label)
elif sec_type == 'dynamic':
cmd += " type=dynamic"
else:
raise ValueError("Security type %s is not supported." % sec_type)
if sec_relabel is not None:
cmd += ",relabel=%s" % sec_relabel
cmd += " --noautoconsole --graphics vnc --video vga &"
utils.run(cmd, ignore_status=True)
def _vm_alive():
return virsh.is_alive(vm_name)
if (utils_misc.wait_for(_vm_alive, timeout=5)):
if status_error:
raise error.TestFail('Test succeeded in negative case.')
else:
if not status_error:
raise error.TestFail("Test failed in positive case.")
finally:
# cleanup
utils_selinux.set_status(backup_sestatus)
if virsh.domain_exists(vm_name):
virsh.remove_domain(vm_name)
if not os.path.exists(image_path):
utils_test.libvirt.delete_local_disk("file", path=image_path)
def run(test, params, env):
"""
Test svirt in adding disk to VM.
(1).Init variables for test.
(2).Label the VM and disk with proper label.
(3).Save VM and check the context.
(4).Restore VM and check the context.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("svirt_save_restore_host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_save_restore_vm_sec_type", "dynamic")
sec_model = params.get("svirt_save_restore_vm_sec_model", "selinux")
sec_label = params.get("svirt_save_restore_vm_sec_label", None)
sec_relabel = params.get("svirt_save_restore_vm_sec_relabel", "yes")
sec_dict = {'type': sec_type, 'model': sec_model, 'label': sec_label,
'relabel': sec_relabel}
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get variables about image.
img_label = params.get('svirt_save_restore_disk_label')
# Label the disks of VM with img_label.
disks = vm.get_disk_devices()
backup_labels_of_disks = {}
for disk in list(disks.values()):
disk_path = disk['source']
backup_labels_of_disks[disk_path] = utils_selinux.get_context_of_file(
filename=disk_path)
utils_selinux.set_context_of_file(filename=disk_path,
context=img_label)
# Set selinux of host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the context of the VM.
vmxml.set_seclabel([sec_dict])
vmxml.sync()
# Init a path to save VM.
save_path = os.path.join(data_dir.get_tmp_dir(), "svirt_save")
try:
# Start VM to check the VM is able to access the image or not.
try:
vm.start()
vm.save_to_file(path=save_path)
vm.restore_from_file(path=save_path)
# Save and restore VM successfully.
if status_error:
test.fail("Test succeeded in negative case.")
except virt_vm.VMError as e:
if not status_error:
error_msg = "Test failed in positive case.\n error: %s\n" % e
if str(e).count("getfd"):
error_msg += ("For more info please refer to"
" https://bugzilla.redhat.com/show_bug.cgi?id=976632")
test.fail(error_msg)
finally:
# clean up
for path, label in list(backup_labels_of_disks.items()):
utils_selinux.set_context_of_file(filename=path, context=label)
backup_xml.sync()
utils_selinux.set_status(backup_sestatus)
def run(test, params, env):
"""
Test svirt in adding disk to VM.
(1).Init variables for test.
(2).Create a image to attached to VM.
(3).Attach disk.
(4).Start VM and check result.
"""
# Get general variables.
status_error = ('yes' == params.get("status_error", 'no'))
host_sestatus = params.get("svirt_attach_disk_host_selinux", "enforcing")
# Get variables about seclabel for VM.
sec_type = params.get("svirt_attach_disk_vm_sec_type", "dynamic")
sec_model = params.get("svirt_attach_disk_vm_sec_model", "selinux")
sec_label = params.get("svirt_attach_disk_vm_sec_label", None)
sec_relabel = params.get("svirt_attach_disk_vm_sec_relabel", "yes")
sec_dict = {'type': sec_type, 'model': sec_model, 'label': sec_label,
'relabel': sec_relabel}
# Get variables about pool vol
with_pool_vol = 'yes' == params.get("with_pool_vol", "no")
check_cap_rawio = "yes" == params.get("check_cap_rawio", "no")
virt_use_nfs = params.get("virt_use_nfs", "off")
pool_name = params.get("pool_name")
pool_type = params.get("pool_type")
pool_target = params.get("pool_target")
emulated_image = params.get("emulated_image")
vol_name = params.get("vol_name")
vol_format = params.get("vol_format")
# Get variables about VM and get a VM object and VMXML instance.
vm_name = params.get("main_vm")
vm = env.get_vm(vm_name)
vmxml = VMXML.new_from_inactive_dumpxml(vm_name)
backup_xml = vmxml.copy()
# Get varialbles about image.
img_label = params.get('svirt_attach_disk_disk_label')
img_name = "svirt_disk"
# Default label for the other disks.
# To ensure VM is able to access other disks.
default_label = params.get('svirt_attach_disk_disk_default_label', None)
# Set selinux of host.
backup_sestatus = utils_selinux.get_status()
utils_selinux.set_status(host_sestatus)
# Set the default label to other disks of vm.
disks = vm.get_disk_devices()
for disk in disks.values():
utils_selinux.set_context_of_file(filename=disk['source'],
context=default_label)
pvt = None
qemu_conf = utils_config.LibvirtQemuConfig()
libvirtd = utils_libvirtd.Libvirtd()
try:
# set qemu conf
if check_cap_rawio:
qemu_conf.user = '******'
qemu_conf.group = 'root'
logging.debug("the qemu.conf content is: %s" % qemu_conf)
libvirtd.restart()
# Set the context of the VM.
vmxml.set_seclabel([sec_dict])
vmxml.sync()
logging.debug("the domain xml is: %s" % vmxml.xmltreefile)
if with_pool_vol:
# Create dst pool for create attach vol img
pvt = utlv.PoolVolumeTest(test, params)
logging.debug("pool_type %s" % pool_type)
pvt.pre_pool(pool_name, pool_type, pool_target,
emulated_image, image_size="1G",
pre_disk_vol=["20M"])
if pool_type in ["iscsi", "disk"]:
# iscsi and disk pool did not support create volume in libvirt,
# logical pool could use libvirt to create volume but volume
# format is not supported and will be 'raw' as default.
pv = libvirt_storage.PoolVolume(pool_name)
vols = pv.list_volumes().keys()
if vols:
vol_name = vols[0]
else:
raise error.TestNAError("No volume in pool: %s" % pool_name)
else:
vol_arg = {'name': vol_name, 'format': vol_format,
'capacity': 1073741824,
'allocation': 1048576, }
# Set volume xml file
volxml = libvirt_xml.VolXML()
newvol = volxml.new_vol(**vol_arg)
vol_xml = newvol['xml']
# Run virsh_vol_create to create vol
logging.debug("create volume from xml: %s" % newvol.xmltreefile)
cmd_result = virsh.vol_create(pool_name, vol_xml,
ignore_status=True,
debug=True)
if cmd_result.exit_status:
raise error.TestNAError("Failed to create attach volume.")
cmd_result = virsh.vol_path(vol_name, pool_name, debug=True)
if cmd_result.exit_status:
raise error.TestNAError("Failed to get volume path from pool.")
img_path = cmd_result.stdout.strip()
if pool_type in ["iscsi", "disk"]:
extra = "--driver qemu --type lun --rawio --persistent"
else:
extra = "--persistent --subdriver qcow2"
# set host_sestatus as nfs pool will reset it
utils_selinux.set_status(host_sestatus)
# set virt_use_nfs
result = utils.run("setsebool virt_use_nfs %s" % virt_use_nfs)
if result.exit_status:
raise error.TestNAError("Failed to set virt_use_nfs value")
else:
# Init a QemuImg instance.
params['image_name'] = img_name
tmp_dir = data_dir.get_tmp_dir()
image = qemu_storage.QemuImg(params, tmp_dir, img_name)
# Create a image.
img_path, result = image.create(params)
# Set the context of the image.
utils_selinux.set_context_of_file(filename=img_path, context=img_label)
extra = "--persistent"
# Do the attach action.
result = virsh.attach_disk(vm_name, source=img_path, target="vdf",
extra=extra, debug=True)
if result.exit_status:
raise error.TestFail("Failed to attach disk %s to VM."
"Detail: %s." % (img_path, result.stderr))
# Start VM to check the VM is able to access the image or not.
try:
vm.start()
# Start VM successfully.
# VM with set seclabel can access the image with the
# set context.
if status_error:
raise error.TestFail('Test succeeded in negative case.')
if check_cap_rawio:
cap_list = ['CapPrm', 'CapEff', 'CapBnd']
cap_dict = {}
pid = vm.get_pid()
pid_status_path = "/proc/%s/status" % pid
with open(pid_status_path) as f:
for line in f:
val_list = line.split(":")
if val_list[0] in cap_list:
cap_dict[val_list[0]] = int(val_list[1].strip(), 16)
# bit and with rawio capabilitiy value to check cap_sys_rawio
# is set
cap_rawio_val = 0x0000000000020000
for i in cap_list:
if not cap_rawio_val & cap_dict[i]:
err_msg = "vm process with %s: 0x%x" % (i, cap_dict[i])
err_msg += " lack cap_sys_rawio capabilities"
raise error.TestFail(err_msg)
else:
inf_msg = "vm process with %s: 0x%x" % (i, cap_dict[i])
inf_msg += " have cap_sys_rawio capabilities"
logging.debug(inf_msg)
except virt_vm.VMStartError, e:
# Starting VM failed.
# VM with set seclabel can not access the image with the
# set context.
if not status_error:
raise error.TestFail("Test failed in positive case."
"error: %s" % e)
try:
virsh.detach_disk(vm_name, target="vdf", extra="--persistent",
debug=True)
except error.CmdError:
raise error.TestFail("Detach disk 'vdf' from VM %s failed."
% vm.name)