* Merged with Debian git 5.3.0-1~1.gbp7b1637 and upstreams 5.4 release
Among many other new features and fixes this includes fixes for:
LP: #1759509 - virsh dompmwakeup fails to wake VM from dompmsuspend state
Remaining changes:
- Disable libssh2 support (universe dependency)
- Disable firewalld support (universe dependency)
- Set qemu-group to kvm (for compat with older ubuntu)
- Additional apport package-hook
- Autostart default bridged network (As upstream does, but not Debian).
In addition to just enabling it our solution provides:
+ do not autostart if subnet is already taken (e.g. in guests).
+ iterate some alternative subnets before giving up
- d/p/ubuntu/Allow-libvirt-group-to-access-the-socket.patch: This is
the group based access to libvirt functions as it was used in Ubuntu
for quite long.
+ d/p/ubuntu/daemon-augeas-fix-expected.patch fix some related tests
due to the group access change.
+ d/libvirt-daemon-system.postinst: add users in sudo to the libvirt
group.
- ubuntu/parallel-shutdown.patch: set parallel shutdown by default.
- Update Vcs-Git and Vcs-Browser fields to point to launchpad
- Xen related
- d/p/ubuntu/ubuntu-libxl-qemu-path.patch: this change was split. The
section that adapts the path of the emulator to the Debian/Ubuntu
packaging is kept.
- d/p/ubuntu/ubuntu-libxl-Fix-up-VRAM-to-minimum-requirements.patch: auto
set VRAM to minimum requirements
- d/p/ubuntu/xen-default-uri.patch: set default URI on xen hosts
- Add libxl log directory
- libvirt-uri.sh: Automatically switch default libvirt URI for users on
Xen dom0 via user profile (was missing on changelogs before)
- d/p/ubuntu/apibuild-skip-libvirt-common.h: drop libvirt-common.h from
included_files to avoid build failures due to duplicate definitions.
- Update README.Debian with Ubuntu changes
- Enable some additional features on ppc64el and s390x (for arch parity)
+ systemtap, zfs, numa and numad on s390x.
+ systemtap on ppc64el.
- d/t/control, d/t/smoke-qemu-session: fixup smoke-qemu-session by making
vmlinuz available and accessible (Debian bug 848314)
- d/t/control, d/t/smoke-lxc: fix up lxc smoke test isolation
- d/p/ubuntu/ubuntu_machine_type.patch: accept ubuntu types as pci440fx
- Further upstreamed apparmor Delta, especially any new one
Our former delta is split into logical pieces and is either Ubuntu only
or is part of a continuous upstreaming effort.
Listing related remaining changes in debian/patches/ubuntu-aa/:
+ 0001-apparmor-Allow-pygrub-to-run-on-Debian-Ubuntu.patch: apparmor:
Allow pygrub to run on Debian/Ubuntu
+ 0003-apparmor-libvirt-qemu-Allow-read-access-to-overcommi.patch:
apparmor, libvirt-qemu: Allow read access to overcommit_memory
+ 0007-apparmor-libvirt-qemu-Allow-owner-read-access-to-PRO.patch:
apparmor, libvirt-qemu: Allow owner read access to @{PROC}/*/auxv
+ 0017-apparmor-virt-aa-helper-Allow-access-to-tmp-director.patch:
apparmor, virt-aa-helper: Allow access to tmp directories
+ ubuntu-aa/0020-virt-aa-helper-ubuntu-storage-paths.patch:
apparmor, virt-aa-helper: Allow various storage pools and image
locations
+ 0021-apparmor-virt-aa-helper-Add-openvswitch-support.patch:
apparmor, virt-aa-helper: Add openvswitch support
+ 0029-appmor-libvirt-qemu-Add-9p-support.patch: appmor, libvirt-qemu: Add 9p support
+ 0030-virt-aa-helper-Complete-9p-support.patch: virt-aa-helper:
add l to 9p file options.
+ 0031-virt-aa-helper-Ask-for-no-deny-rule-for-readonly-dis.patch: virt-aa-helper: Ask for no deny rule for readonly disk (renamed and
reworded, was virt-aa-helper-no-explicity-deny-for-basefiles.patch)
+ 0032-apparmor-libvirt-qemu-Allow-reading-charm-specific-c.patch:
apparmor, libvirt-qemu: Allow reading charm-specific ceph config
+ 0033-UBUNTU-only-apparmor-for-kvm.powerpc-LP-1680384.patch: allow
commands executed by ubuntu only kvm wrapper on ppc64el
(LP 1686621 LP 1680384 LP 1784023)
+ 0034-apparmor-virt-aa-helper-access-for-snapped-nova.patch:
apparmor, virt-aa-helper: access for snapped nova
+ d/p/ubuntu-aa/0050-local-include-for-libvirt-qemu.patch, d/libvirt-daemon-system.postinst: provide a local apparmor include
for abstraction/libvirt-qemu (LP: 1786019)
+ d/p/ubuntu-aa/lp-1815910-allow-vhost-net.patch: avoid apparmor issues
with vhost-net/vhost-vsock/vhost-scsi hotplug (LP: 1815910)
- d/rules: enable build time self tests on all architectures
- dnsmasq related enhancements
+ run dnsmasq as libvirt-dnsmasq (LP: 1743718)
+ d/libvirt-daemon-system.postinst: add libvirt-dnsmasq user and group
+ d/libvirt-daemon-system.postrm: remove libvirt-dnsmasq user and group
on purge
+ d/p/ubuntu/dnsmasq-as-priv-user: write dnsmasq config with user libvirt-dnsmasq and adapt the self tests to expect that config
+ d/libvirt-daemon-system.postinst: fix old libvirt-dnsmasq users group
+ Add dnsmasq configuration to work with system wide dnsmasq-base
- debian/rules: disable the netcf backend. (LP: 1764314)
- debian/control: drop libnetcf from Build-Depends.
- debian/patches/ubuntu/ovmf_paths.patch: adjust paths to secboot.fd UEFI
Secure Boot enabled variants of the OVMF firmware and variable store for
the paths where we ship these files in Ubuntu.
- d/rules: install virtlockd correctly with defaults file (LP: 1729516)
- d/rules: also check build time self test results on all architectures
- d/p/ubuntu/set-default-machine-to-ubuntu.patch: to select default
machine type correctly with newer qemu/libvirt
- d/t/control: fix smoke-qemu-session by ensuring the service will run
installing libvirt-daemon-system
- d/t/smoke-lxc: fix smoke-lxc by ignoring potential issues on destroy as
long as the following undefine succeeds
- avoid service dependency issues on upgrade (LP: 1786179)
This will in the long term be resolved in dh_* tools, but to let an
upgrade work for now we need to drop the sysV scripts (which we don't
use anyway) and slightly modify the systemd service to work with todays
dh_systemd_start properly. Can be dropped once Debian bug 905772 is
resolved in dh_* tools and libvirt uses those new code.
- d/libvirt-daemon-system.virtlogd.init: removed sysV init file
- d/libvirt-daemon-system.libvirtd.init: removed sysV init file
- debian/libvirt-daemon-system.maintscript: rm_conffile for virtlogd
and lbivirtd sysV init file
- d/p/ubuntu/avoid-restarting-virtlog-socket.patch: drop Also references
to virtlogd/virtlockd sockets as they would imply a restart of
virtlogd breaking it.
- d/t/smoke-lxc: use systemd instead of sysV to restart the service
* Added Changes:
- Refreshed patches to match new upstream
- d/p/Reduce-udevadm-settle-timeout-to-10-seconds.patch
- d/p/ubuntu/ubuntu_machine_type.patch
- d/control: Revert iptables/ebtables dependency as Eoan still is on 1.6.x
This can be dropped once >=1.8.1
- d/rules: adapt iptables binary paths present in Eoan (LP: #1832297)
This can be dropped once >=1.8.1
- d/p/ubuntu/dnsmasq-as-priv-user: update to include the new test
nat-network-mtu
- revert [c3c4cd4] drop in helper for firewalld as it is disabled on
Ubuntu [can be squashed with the disabling of firewalld on next merge]
- d/libvirt0.symbols: bump symbol versions for 5.4.0
- d/rules: add --no-restart-after-upgrade to services that are supposed to
stay up through upgrades - this also applies to related sockets.
* Dropped Changes (upstream)
- d/p/ubuntu-aa/lp-1804766-*: Allow rendering node access as needed
for the ease use of mdev and gl devices (LP: 1804766)
- d/p/ubuntu/lp-1771662-*: fix handling of VFs without associated PF
(LP: 1771662)
- d/p/ubuntu/lp-1825195-*.patch: fix issues with old guests that defined
the never functional osxsave and ospke features (LP: 1825195).
- d/p/ubuntu-aa/lp-1829223-virt-aa-helper-allow-vhost-scsi.patch fix
vhost-scsi hotplug in virt-aa-helper (LP: 1829223)
- SECURITY UPDATE: Add support for md-clear functionality
+ debian/patches/ubuntu/md-clear.patch: Define md-clear CPUID bit in src/cpu_map/x86_features.xml.
+ CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
- Implement further apparmor rules for usage of gl enabled
graphics (LP: 1815452)
+ d/p/ubuntu-aa/lp-1815452-more-gl-rules.patch
+ d/p/ubuntu-aa/lp-1815452-virt-aa-helper-rule.patch
- Implement further apparmor rules for usage of gl enabled
graphics with nvidia cards (LP: 1817943)
+ d/p/ubuntu-aa/lp-1817943-nvidia-gl-rules.patch
+ d/p/ubuntu-aa/lp-1817943-devices-in-sysfs.patch
* Dropped Changes (in Debian)
- d/rules: strip -Bsymbolic-functions from linker flags as it breaks
libvirt tests
-- Christian Ehrhardt <email address hidden> Fri, 07 Jun 2019 11:55:52 +0200
This bug was fixed in the package libvirt - 5.4.0-0ubuntu1
---------------
libvirt (5.4.0-0ubuntu1) eoan; urgency=medium
* Merged with Debian git 5.3.0-1~1.gbp7b1637 and upstreams 5.4 release Allow-libvirt- group-to- access- the-socket. patch: This is daemon- augeas- fix-expected. patch fix some related tests daemon- system. postinst: add users in sudo to the libvirt parallel- shutdown. patch: set parallel shutdown by default. ubuntu- libxl-qemu- path.patch: this change was split. The ubuntu- libxl-Fix- up-VRAM- to-minimum- requirements. patch: auto xen-default- uri.patch: set default URI on xen hosts apibuild- skip-libvirt- common. h: drop libvirt-common.h from files to avoid build failures due to duplicate definitions. qemu-session: fixup smoke-qemu-session by making ubuntu_ machine_ type.patch: accept ubuntu types as pci440fx patches/ ubuntu- aa/: Allow-pygrub- to-run- on-Debian- Ubuntu. patch: apparmor: libvirt- qemu-Allow- read-access- to-overcommi. patch: libvirt- qemu-Allow- owner-read- access- to-PRO. patch: virt-aa- helper- Allow-access- to-tmp- director. patch: aa/0020- virt-aa- helper- ubuntu- storage- paths.patch: virt-aa- helper- Add-openvswitch -support. patch: libvirt- qemu-Add- 9p-support. patch: appmor,
libvirt- qemu: Add 9p support aa-helper- Complete- 9p-support. patch: virt-aa-helper: aa-helper- Ask-for- no-deny- rule-for- readonly- dis.patch:
virt-aa- helper: Ask for no deny rule for readonly disk (renamed and helper- no-explicity- deny-for- basefiles. patch) libvirt- qemu-Allow- reading- charm-specific- c.patch: only-apparmor- for-kvm. powerpc- LP-1680384. patch: allow virt-aa- helper- access- for-snapped- nova.patch: aa/0050- local-include- for-libvirt- qemu.patch,
d/libvirt- daemon- system. postinst: provide a local apparmor include libvirt- qemu (LP: 1786019) aa/lp-1815910- allow-vhost- net.patch: avoid apparmor issues vhost-vsock/ vhost-scsi hotplug (LP: 1815910) daemon- system. postinst: add libvirt-dnsmasq user and group daemon- system. postrm: remove libvirt-dnsmasq user and group dnsmasq- as-priv- user: write dnsmasq config with user
libvirt- dnsmasq and adapt the self tests to expect that config daemon- system. postinst: fix old libvirt-dnsmasq users group patches/ ubuntu/ ovmf_paths. patch: adjust paths to secboot.fd UEFI set-default- machine- to-ubuntu. patch: to select default daemon- system systemd_ start properly. Can be dropped once Debian bug 905772 is daemon- system. virtlogd. init: removed sysV init file daemon- system. libvirtd. init: removed sysV init file libvirt- daemon- system. maintscript: rm_conffile for virtlogd avoid-restartin g-virtlog- socket. patch: drop Also references udevadm- settle- timeout- to-10-seconds. patch ubuntu_ machine_ type.patch dnsmasq- as-priv- user: update to include the new test network- mtu after-upgrade to services that are supposed to aa/lp-1804766- *: Allow rendering node access as needed lp-1771662- *: fix handling of VFs without associated PF lp-1825195- *.patch: fix issues with old guests that defined aa/lp-1829223- virt-aa- helper- allow-vhost- scsi.patch fix patches/ ubuntu/ md-clear. patch: Define md-clear CPUID bit in
src/cpu_ map/x86_ features. xml. aa/lp-1815452- more-gl- rules.patch aa/lp-1815452- virt-aa- helper- rule.patch aa/lp-1817943- nvidia- gl-rules. patch aa/lp-1817943- devices- in-sysfs. patch functions from linker flags as it breaks
Among many other new features and fixes this includes fixes for:
LP: #1759509 - virsh dompmwakeup fails to wake VM from dompmsuspend state
Remaining changes:
- Disable libssh2 support (universe dependency)
- Disable firewalld support (universe dependency)
- Set qemu-group to kvm (for compat with older ubuntu)
- Additional apport package-hook
- Autostart default bridged network (As upstream does, but not Debian).
In addition to just enabling it our solution provides:
+ do not autostart if subnet is already taken (e.g. in guests).
+ iterate some alternative subnets before giving up
- d/p/ubuntu/
the group based access to libvirt functions as it was used in Ubuntu
for quite long.
+ d/p/ubuntu/
due to the group access change.
+ d/libvirt-
group.
- ubuntu/
- Update Vcs-Git and Vcs-Browser fields to point to launchpad
- Xen related
- d/p/ubuntu/
section that adapts the path of the emulator to the Debian/Ubuntu
packaging is kept.
- d/p/ubuntu/
set VRAM to minimum requirements
- d/p/ubuntu/
- Add libxl log directory
- libvirt-uri.sh: Automatically switch default libvirt URI for users on
Xen dom0 via user profile (was missing on changelogs before)
- d/p/ubuntu/
included_
- Update README.Debian with Ubuntu changes
- Enable some additional features on ppc64el and s390x (for arch parity)
+ systemtap, zfs, numa and numad on s390x.
+ systemtap on ppc64el.
- d/t/control, d/t/smoke-
vmlinuz available and accessible (Debian bug 848314)
- d/t/control, d/t/smoke-lxc: fix up lxc smoke test isolation
- d/p/ubuntu/
- Further upstreamed apparmor Delta, especially any new one
Our former delta is split into logical pieces and is either Ubuntu only
or is part of a continuous upstreaming effort.
Listing related remaining changes in debian/
+ 0001-apparmor-
Allow pygrub to run on Debian/Ubuntu
+ 0003-apparmor-
apparmor, libvirt-qemu: Allow read access to overcommit_memory
+ 0007-apparmor-
apparmor, libvirt-qemu: Allow owner read access to @{PROC}/*/auxv
+ 0017-apparmor-
apparmor, virt-aa-helper: Allow access to tmp directories
+ ubuntu-
apparmor, virt-aa-helper: Allow various storage pools and image
locations
+ 0021-apparmor-
apparmor, virt-aa-helper: Add openvswitch support
+ 0029-appmor-
+ 0030-virt-
add l to 9p file options.
+ 0031-virt-
reworded, was virt-aa-
+ 0032-apparmor-
apparmor, libvirt-qemu: Allow reading charm-specific ceph config
+ 0033-UBUNTU-
commands executed by ubuntu only kvm wrapper on ppc64el
(LP 1686621 LP 1680384 LP 1784023)
+ 0034-apparmor-
apparmor, virt-aa-helper: access for snapped nova
+ d/p/ubuntu-
for abstraction/
+ d/p/ubuntu-
with vhost-net/
- d/rules: enable build time self tests on all architectures
- dnsmasq related enhancements
+ run dnsmasq as libvirt-dnsmasq (LP: 1743718)
+ d/libvirt-
+ d/libvirt-
on purge
+ d/p/ubuntu/
+ d/libvirt-
+ Add dnsmasq configuration to work with system wide dnsmasq-base
- debian/rules: disable the netcf backend. (LP: 1764314)
- debian/control: drop libnetcf from Build-Depends.
- debian/
Secure Boot enabled variants of the OVMF firmware and variable store for
the paths where we ship these files in Ubuntu.
- d/rules: install virtlockd correctly with defaults file (LP: 1729516)
- d/rules: also check build time self test results on all architectures
- d/p/ubuntu/
machine type correctly with newer qemu/libvirt
- d/t/control: fix smoke-qemu-session by ensuring the service will run
installing libvirt-
- d/t/smoke-lxc: fix smoke-lxc by ignoring potential issues on destroy as
long as the following undefine succeeds
- avoid service dependency issues on upgrade (LP: 1786179)
This will in the long term be resolved in dh_* tools, but to let an
upgrade work for now we need to drop the sysV scripts (which we don't
use anyway) and slightly modify the systemd service to work with todays
dh_
resolved in dh_* tools and libvirt uses those new code.
- d/libvirt-
- d/libvirt-
- debian/
and lbivirtd sysV init file
- d/p/ubuntu/
to virtlogd/virtlockd sockets as they would imply a restart of
virtlogd breaking it.
- d/t/smoke-lxc: use systemd instead of sysV to restart the service
* Added Changes:
- Refreshed patches to match new upstream
- d/p/Reduce-
- d/p/ubuntu/
- d/control: Revert iptables/ebtables dependency as Eoan still is on 1.6.x
This can be dropped once >=1.8.1
- d/rules: adapt iptables binary paths present in Eoan (LP: #1832297)
This can be dropped once >=1.8.1
- d/p/ubuntu/
nat-
- revert [c3c4cd4] drop in helper for firewalld as it is disabled on
Ubuntu [can be squashed with the disabling of firewalld on next merge]
- d/libvirt0.symbols: bump symbol versions for 5.4.0
- d/rules: add --no-restart-
stay up through upgrades - this also applies to related sockets.
* Dropped Changes (upstream)
- d/p/ubuntu-
for the ease use of mdev and gl devices (LP: 1804766)
- d/p/ubuntu/
(LP: 1771662)
- d/p/ubuntu/
the never functional osxsave and ospke features (LP: 1825195).
- d/p/ubuntu-
vhost-scsi hotplug in virt-aa-helper (LP: 1829223)
- SECURITY UPDATE: Add support for md-clear functionality
+ debian/
+ CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
- Implement further apparmor rules for usage of gl enabled
graphics (LP: 1815452)
+ d/p/ubuntu-
+ d/p/ubuntu-
- Implement further apparmor rules for usage of gl enabled
graphics with nvidia cards (LP: 1817943)
+ d/p/ubuntu-
+ d/p/ubuntu-
* Dropped Changes (in Debian)
- d/rules: strip -Bsymbolic-
libvirt tests
-- Christian Ehrhardt <email address hidden> Fri, 07 Jun 2019 11:55:52 +0200