libvirt and required packages

This series introduces a new package, libvirt, along with some required changes:

- nmap: add option to build/install ncat

The libvirt daemon (libvirtd) needs a "nc" command with support for Unix sockets to permit remote management via virt-manager. The netcat-openbsd package provides such command but requires glibc, so we would not have remote management on uClibc-based systems. Ncat is compatible with uClibc and musl.

- netcf: new package

The netcf library library is used by libvirt when udev is not available.

- libvirt: new package

Libvirt is collection of software that provides a convenient way to manage virtual machines and other virtualization functionality, such as storage and network interface management. These software pieces include an API library, a daemon (libvirtd), and a command line utility (virsh).

Carlos Santos (3):
nmap: add option to build/install ncat
netcf: new package
libvirt: new package

 package/Config.in                                  |   2 +
 package/libvirt/Config.in                          |  44 ++++
 package/libvirt/S30devkvmperms                     |  28 +++
 package/libvirt/S90libvirt                         | 139 ++++++++++++
 package/libvirt/device_table.txt                   |  39 ++++
 package/libvirt/libvirt.hash                       |   2 +
 package/libvirt/libvirt.mk                         | 233 +++++++++++++++++++++
 package/netcf/0001-fix-misplaced-empty.patch       |  36 ++++
 ...002-call-aug_load-at-most-once-per-second.patch |  83 ++++++++
 ...g_match-query-for-all-ifcfg-files-related.patch | 113 ++++++++++
 ...ude-bond-element-for-bonds-with-no-slaves.patch |  56 +++++
 ...erly-classify-bond-devices-with-no-slaves.patch |  35 ++++
 ...006-netcf-transaction.sh-remove-bash-isms.patch |  50 +++++
 ...t-script-as-etc-init.d-S30netcf-transacti.patch |  35 ++++
 ...08-configure.ac-fix-AM_INIT_AUTOMAKE-call.patch |  29 +++
 ...LUDES-by-AM_CPPFLAGS-in-some-Makefile.am-.patch |  52 +++++
 package/netcf/Config.in                            |  24 +++
 package/netcf/S30netcf-transaction                 |   9 +
 package/netcf/netcf.hash                           |   2 +
 package/netcf/netcf.mk                             |  22 ++
 package/nmap/Config.in                             |  27 ++-
 package/nmap/nmap.mk                               |  38 +++-
 22 files changed, 1095 insertions(+), 3 deletions(-)
 create mode 100644 package/libvirt/Config.in
 create mode 100755 package/libvirt/S30devkvmperms
 create mode 100644 package/libvirt/S90libvirt
 create mode 100644 package/libvirt/device_table.txt
 create mode 100644 package/libvirt/libvirt.hash
 create mode 100644 package/libvirt/libvirt.mk
 create mode 100644 package/netcf/0001-fix-misplaced-empty.patch
 create mode 100644 package/netcf/0002-call-aug_load-at-most-once-per-second.patch
 create mode 100644 package/netcf/0003-optimize-aug_match-query-for-all-ifcfg-files-related.patch
 create mode 100644 package/netcf/0004-linux-include-bond-element-for-bonds-with-no-slaves.patch
 create mode 100644 package/netcf/0005-Properly-classify-bond-devices-with-no-slaves.patch
 create mode 100644 package/netcf/0006-netcf-transaction.sh-remove-bash-isms.patch
 create mode 100644 package/netcf/0007-Install-init-script-as-etc-init.d-S30netcf-transacti.patch
 create mode 100644 package/netcf/0008-configure.ac-fix-AM_INIT_AUTOMAKE-call.patch
 create mode 100644 package/netcf/0009-Replace-INCLUDES-by-AM_CPPFLAGS-in-some-Makefile.am-.patch
 create mode 100644 package/netcf/Config.in
 create mode 100644 package/netcf/S30netcf-transaction
 create mode 100644 package/netcf/netcf.hash
 create mode 100644 package/netcf/netcf.mk

2.14.3

The forthcoming "libvirt" package will need a "nc" command with support for Unix domain sockets in order to permit remote management using the virt-manager utility. netcat-openbsd provides such command but requires glibc, so we would not have remote management on uClibc-based systems.

Ncat is a much-improved reimplementation of the venerable Netcat and is compatible with uClibc and musl. It provides features not available in the ancient GNU netcat and its Busybox double like IPv6, proxies, and Unix sockets.

Tha nmap package now installs ncat if the BR2_PACKAGE_NMAP_NCAT option is selected. The other programs (nmap, ndiff, etc.) are chosen via the BR2_PACKAGE_NMAP_NMAP option.

We symlink 'nc' to ncat if neiter netcat nor netcat-openbsd is selected, even though ncat does not have the same interface as netcat-openbsd. However, since Fedora/RHEL install nmap-ncat as 'nc', it can be assumed that packages that depend on 'nc' know how to deal with this diversity. For example, the virt-manager package does that. Also user-supplied scripts can be assumed to do the right thing, since the user also selects whether nmap-ncat, netcat or netcat-openbsd is installed.

---
Changes v1->v2:
- Add dependens on BR2_PACKAGE_BUSYBOX_SHOW_OTHERS, like netcat does
- Remove forced dependence on busybox, since its installation script does not override existing programs.
Changes v2->v3:
- Use a better logic to select either ncat tools, nmap or both, as suggested by Arnout Vandecappelle and Thomas Petazzoni.
- Add a prominent comment about the symlink to 'nc', as suggested by Arnout.
Changes v3->v4:
- Restore forced dependence on busybox, since it may be necessary if packages become built in parallel, leading to a race condition on the creation of the "nc" link.
Changes v4->v5
- Rebase to "next" head.
- Explain the this change is required by the forthcoming libvirt package.

---
 package/nmap/Config.in | 27 ++++++++++++++++++++++++++-
 package/nmap/nmap.mk   | 38 ++++++++++++++++++++++++++++++++++++--
 2 files changed, 62 insertions(+), 3 deletions(-)

index 79f587afd1..1843bb6ade 100644
@@ -4,6 +4,12 @@ config BR2_PACKAGE_NMAP
 	depends on BR2_USE_MMU # fork()
 	depends on BR2_TOOLCHAIN_HAS_THREADS
 	select BR2_PACKAGE_LIBPCAP
+	select BR2_PACKAGE_NMAP_NMAP if !BR2_PACKAGE_NMAP_NCAT
+
+if  BR2_PACKAGE_NMAP
+
+config BR2_PACKAGE_NMAP_NMAP
+	bool "install nmap tools"
 	select BR2_PACKAGE_PCRE
 	help
 	  Nmap ("Network Mapper") is a free and open source (license)

@@ -11,6 +17,25 @@ config BR2_PACKAGE_NMAP
 
 	  http://nmap.org
 
-comment "nmap needs a toolchain w/ C++, threads"
+config BR2_PACKAGE_NMAP_NCAT
+	bool "install ncat"
+	depends on BR2_PACKAGE_BUSYBOX_SHOW_OTHERS
+	help
+	  Ncat is a feature-packed networking utility which reads and
+	  writes data across networks from the command line. Ncat was
+	  written for the Nmap Project as a much-improved
+	  reimplementation of the venerable Netcat.
+
+	  If symlink to "nc" is installed if neither netcat or
+	  netcat-openbsd is selected.
+
+comment "a symlink from ncat to 'nc' will be installed"
+	depends on BR2_PACKAGE_NMAP_NCAT
+	depends on !BR2_PACKAGE_NETCAT
+	depends on !BR2_PACKAGE_NETCAT_OPENBSD
+
+endif
+
+comment "nmap-nmap needs a toolchain w/ C++, threads"
 	depends on BR2_USE_MMU
 	depends on !(BR2_INSTALL_LIBSTDCPP && BR2_TOOLCHAIN_HAS_THREADS)

index ceb08ec006..303eaf9a35 100644
@@ -7,10 +7,10 @@
 NMAP_VERSION = 7.60
 NMAP_SITE = https://nmap.org/dist
 NMAP_SOURCE = nmap-$(NMAP_VERSION).tar.bz2
-NMAP_DEPENDENCIES = libpcap pcre host-autoconf
+NMAP_DEPENDENCIES = libpcap host-autoconf
 NMAP_CONF_OPTS = --without-liblua --without-zenmap \
 	--with-libdnet=included --with-liblinear=included \
-	--with-libpcre="$(STAGING_DIR)/usr" --without-ncat
+	--with-libpcre="$(STAGING_DIR)/usr"
 NMAP_LICENSE = GPL-2.0
 NMAP_LICENSE_FILES = COPYING
 

@@ -51,6 +51,16 @@ else
 NMAP_CONF_OPTS += --without-openssl
 endif
 
+ifeq ($(BR2_PACKAGE_NMAP_NMAP),y)
+
+# Ensure Busybox gets built/installed before, so that this package
+# overrides Busybox nc.
+ifeq ($(BR2_PACKAGE_BUSYBOX),y)
+NMAP_DEPENDENCIES += busybox
+endif
+
+NMAP_DEPENDENCIES += pcre
+
 # ndiff only works with python2.x
 ifeq ($(BR2_PACKAGE_PYTHON),y)
 NMAP_DEPENDENCIES += python

@@ -58,4 +68,28 @@ else
 NMAP_CONF_OPTS += --without-ndiff
 endif
 
+ifeq ($(BR2_PACKAGE_NMAP_NCAT),)
+NMAP_CONF_OPTS += --without-ncat
+endif
+
+else # only ncat
+
+NMAP_CONF_OPTS += --without-ndiff --without-zenmap --without-nping --without-nmap-update
+define NMAP_BUILD_CMDS
+	$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) build-ncat
+endef
+define NMAP_INSTALL_TARGET_CMDS
+	$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) DESTDIR=$(TARGET_DIR) install-ncat
+endef
+
+endif
+
+# Add a symlink to "nc" if none of the competing netcats is selected
+ifeq ($(BR2_PACKAGE_NMAP_NCAT):$(BR2_PACKAGE_NETCAT)$(BR2_PACKAGE_NETCAT_OPENBSD),y:)
+define NMAP_INSTALL_NCAT_SYMLINK
+        ln -fs ncat $(TARGET_DIR)/usr/bin/nc
+endef
+NMAP_POST_INSTALL_TARGET_HOOKS += NMAP_INSTALL_NCAT_SYMLINK
+endif
+
 $(eval $(autotools-package))

2.14.3

netcf is a cross-platform network configuration library. It takes the description of a network interface in its own platform-independent format and adapts the local system's network configuration to provide that interface.

Both the ncftool utility and libnetcf are installed. The library is used by libvirt (forthcoming package) when udev is not available.

netcf was originally hosted at fedorahosted.org, which was retired on March 1st, 2017, so we take the code fom the Debian snapshot archive.

Five bug fixes were imported from Fedora 26. Four additional patches are required to clean-up the code and adapt it to the Buildroot directory hierarchy.

---
 package/Config.in                                  |   1 +
 package/netcf/0001-fix-misplaced-empty.patch       |  36 +++++++
 ...002-call-aug_load-at-most-once-per-second.patch |  83 +++++++++++++++
 ...g_match-query-for-all-ifcfg-files-related.patch | 113 +++++++++++++++++++++
 ...ude-bond-element-for-bonds-with-no-slaves.patch |  56 ++++++++++
 ...erly-classify-bond-devices-with-no-slaves.patch |  35 +++++++
 ...006-netcf-transaction.sh-remove-bash-isms.patch |  50 +++++++++
 ...t-script-as-etc-init.d-S30netcf-transacti.patch |  35 +++++++
 ...08-configure.ac-fix-AM_INIT_AUTOMAKE-call.patch |  29 ++++++
 ...LUDES-by-AM_CPPFLAGS-in-some-Makefile.am-.patch |  52 ++++++++++
 package/netcf/Config.in                            |  24 +++++
 package/netcf/S30netcf-transaction                 |   9 ++
 package/netcf/netcf.hash                           |   2 +
 package/netcf/netcf.mk                             |  22 ++++
 14 files changed, 547 insertions(+)
 create mode 100644 package/netcf/0001-fix-misplaced-empty.patch
 create mode 100644 package/netcf/0002-call-aug_load-at-most-once-per-second.patch
 create mode 100644 package/netcf/0003-optimize-aug_match-query-for-all-ifcfg-files-related.patch
 create mode 100644 package/netcf/0004-linux-include-bond-element-for-bonds-with-no-slaves.patch
 create mode 100644 package/netcf/0005-Properly-classify-bond-devices-with-no-slaves.patch
 create mode 100644 package/netcf/0006-netcf-transaction.sh-remove-bash-isms.patch
 create mode 100644 package/netcf/0007-Install-init-script-as-etc-init.d-S30netcf-transacti.patch
 create mode 100644 package/netcf/0008-configure.ac-fix-AM_INIT_AUTOMAKE-call.patch
 create mode 100644 package/netcf/0009-Replace-INCLUDES-by-AM_CPPFLAGS-in-some-Makefile.am-.patch
 create mode 100644 package/netcf/Config.in
 create mode 100644 package/netcf/S30netcf-transaction
 create mode 100644 package/netcf/netcf.hash
 create mode 100644 package/netcf/netcf.mk

index 86acab6427..cdfb90151a 100644
@@ -1710,6 +1710,7 @@ menu "Networking applications"
 	source "package/nbd/Config.in"
 	source "package/ncftp/Config.in"
 	source "package/ndisc6/Config.in"
+	source "package/netcf/Config.in"
 	source "package/netatalk/Config.in"
 	source "package/netcat/Config.in"
 	source "package/netcat-openbsd/Config.in"

new file mode 100644
index 0000000000..74a3a63d7a
@@ -0,0 +1,36 @@
+From 8e00e9c0ba6b66035defc94470ac863f04eba4b5 Mon Sep 17 00:00:00 2001
+From: Laine Stump <[email protected]>
+Date: Thu, 21 May 2015 11:40:53 -0400
+Subject: [PATCH 1/9] fix misplaced <empty/>
+
+When transcribing the link-speed-state bits from libvirt's
+interface.rng to netcf's, I accidentally added an "<empty/>" in the
+wrong place. It should have gone inside the definition of the <link>
+element, rather than just after <link> in the <interface> element.
+---
+ data/xml/interface.rng | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/data/xml/interface.rng b/data/xml/interface.rng
+index 8d70e8b..9098cc9 100644
+--- a/data/xml/interface.rng
++++ b/data/xml/interface.rng
+@@ -41,7 +41,6 @@
+         </element>
+       </optional>
+       <ref name="link-speed-state"/>
+-      <empty/>
+       <!-- FIXME: Allow (some) ethtool options -->
+     </interleave>
+   </define>
+@@ -489,6 +488,7 @@
+         <optional>
+           <attribute name="state"><ref name="link-state"/></attribute>
+         </optional>
++        <empty/>
+       </element>
+     </optional>
+   </define>
+-- 
+2.13.6
+

new file mode 100644
index 0000000000..f255669dab
@@ -0,0 +1,35 @@
+From f3ec5157c7fc97e31c7b48e3a56da268de7e4216 Mon Sep 17 00:00:00 2001
+From: Laine Stump <[email protected]>
+Date: Tue, 13 Oct 2015 14:42:35 -0400
+Subject: [PATCH 5/9] Properly classify bond devices with no slaves
+
+Although initscripts only considers an interface to be a bond if it
+has slaves, there are times when setting up a bond, or testing, when a
+bond may not have any slaves (yet) but does have a BONDING_OPTS
+attribute. Previously in those situations netcf would identify the
+interface as a plain ethernet. This patch makes the check more
+inclusive - now any interface with slaves *or* with a BONDING_OPTS
+attribute is considered to be a bond.
+
+This patch was inspired by an earlier patch sent by Lubomir Rintel
+which looked for BONDING_OPTS *instead of* looking for slaves.
+---
+ data/xml/redhat-put.xsl | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/data/xml/redhat-put.xsl b/data/xml/redhat-put.xsl
+index ed56c66..89145e5 100644
+--- a/data/xml/redhat-put.xsl
++++ b/data/xml/redhat-put.xsl
+@@ -135,7 +135,7 @@
+   </xsl:template>
+ 
+   <xsl:template name="bond-interface"
+-                match="tree[node[@label = 'DEVICE'][@value = //tree/node[@label = 'MASTER']/@value]][count(node[@label = 'BRIDGE']) = 0]">
++                match="tree[count(node[@label = 'BONDING_OPTS']) or (node[@label = 'DEVICE'][@value = //tree/node[@label = 'MASTER']/@value])][count(node[@label = 'BRIDGE']) = 0]">
+     <interface type="bond">
+       <xsl:call-template name="name-attr"/>
+       <xsl:call-template name="startmode"/>
+-- 
+2.13.6
+

new file mode 100644
index 0000000000..5e3c553958
@@ -0,0 +1,35 @@
+From e7aa162d0a14684dafa5d8316c34d19ba01ed503 Mon Sep 17 00:00:00 2001
+From: Carlos Santos <[email protected]>
+Date: Sun, 8 Oct 2017 09:43:08 -0300
+Subject: [PATCH 7/9] Install init script as /etc/init.d/S30netcf-transaction
+
+This is for Buildroot, only.
+
+Signed-off-by: Carlos Santos <[email protected]>
+---
+ src/Makefile.am | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/Makefile.am b/src/Makefile.am
+index 2f76614..ce04b43 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -138,12 +138,12 @@ BUILT_SOURCES += netcf-transaction.sh
+ 
+ if NETCF_USE_INITSCRIPTS
+ install-sysinit: netcf-transaction.init
+-	$(MKDIR_P) $(DESTDIR)$(sysconfdir)/rc.d/init.d
++	$(MKDIR_P) $(DESTDIR)$(sysconfdir)/init.d
+ 	$(INSTALL_SCRIPT) netcf-transaction.init \
+-	  $(DESTDIR)$(sysconfdir)/rc.d/init.d/netcf-transaction
++	  $(DESTDIR)$(sysconfdir)/init.d/S30netcf-transaction
+ 
+ uninstall-sysinit:
+-	rm -f $(DESTDIR)$(sysconfdir)/rc.d/init.d/netcf-transaction \
++	rm -f $(DESTDIR)$(sysconfdir)/init.d/S30netcf-transaction \
+ 	  $(DESTDIR)$(sysconfdir)/sysconfig/netcf-transaction
+ 
+ netcf-transaction.init: netcf-transaction.init.in \
+-- 
+2.13.6
+

new file mode 100644
index 0000000000..4331d84b55
@@ -0,0 +1,29 @@
+From 6daa25084b553351255e8f3e6b252a446e5f88fc Mon Sep 17 00:00:00 2001
+From: Carlos Santos <[email protected]>
+Date: Sun, 8 Oct 2017 13:16:41 -0300
+Subject: [PATCH 8/9] configure.ac: fix AM_INIT_AUTOMAKE call
+
+Add the subdir-objects options, since the main Makefile.am references
+files in subdirectories, to silence a warning when autoreconfiguring.
+
+Signed-off-by: Carlos Santos <[email protected]>
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 15c47cd..1ca80ef 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -3,7 +3,7 @@ AC_CONFIG_SRCDIR([src/netcf.c])
+ AC_CONFIG_AUX_DIR([build-aux])
+ AC_CONFIG_MACRO_DIR([gnulib/m4])
+ AC_CONFIG_HEADERS([config.h])
+-AM_INIT_AUTOMAKE([-Wno-portability 1.11 color-tests parallel-tests])
++AM_INIT_AUTOMAKE([-Wno-portability 1.11 subdir-objects color-tests parallel-tests])
+ AM_SILENT_RULES([yes]) # make --enable-silent-rules the default.
+ AC_CANONICAL_HOST
+ 
+-- 
+2.13.6
+

new file mode 100644
index 0000000000..d38c2dcef0
@@ -0,0 +1,24 @@
+config BR2_PACKAGE_NETCF
+	bool "netcf"
+	depends on !BR2_arc # augeas
+	depends on !BR2_STATIC_LIBS # libnl
+	depends on BR2_TOOLCHAIN_HAS_THREADS # libnl
+	depends on BR2_USE_MMU # fork()
+	depends on BR2_USE_WCHAR # augeas
+	select BR2_PACKAGE_AUGEAS
+	select BR2_PACKAGE_LIBNL
+	select BR2_PACKAGE_LIBXML2
+	select BR2_PACKAGE_LIBXSLT
+	select BR2_PACKAGE_READLINE
+	help
+	  netcf is a cross-platform network configuration library.
+
+	  It takes the description of a network interface in its own
+	  platform-independent format and adapts the local system's
+	  network configuration to provide that interface.
+
+	  Both the ncftool utility and libnetcf are installed.
+
+comment "netcf needs a toolchain w/ wchar"
+	depends on !BR2_arc
+	depends on !BR2_USE_WCHAR

new file mode 100644
index 0000000000..ad67123916
@@ -0,0 +1,9 @@
+#!/bin/sh
+#
+# This script can save the current state of network config, and later
+# revert to that config, or commit the new config (by deleting the
+# snapshot). At boot time, if there are uncommitted changes to the
+# network config, they are reverted (and the discarded changes are
+# archived in /var/lib/netcf/network-rollback-*).
+
+exec /usr/libexec/netcf-transaction.sh "$@"

new file mode 100644
index 0000000000..2ba2a5c204
@@ -0,0 +1,2 @@
+# Locally computed:
+sha256 fd81d607795547807150dfdb82bd164ab2569369ab48a30cb6b0d010d17b127c  netcf_0.2.8.orig.tar.gz

new file mode 100644
index 0000000000..bd2bc8715d
@@ -0,0 +1,22 @@
+################################################################################
+#
+# netcf
+#
+################################################################################
+
+NETCF_VERSION = 0.2.8
+NETCF_SITE = http://snapshot.debian.org/archive/debian/20171007T103908Z/pool/main/n/netcf
+NETCF_SOURCE = netcf_$(NETCF_VERSION).orig.tar.gz
+NETCF_INSTALL_STAGING = YES
+NETCF_LICENSE = LGPL-2.1+
+NETCF_LICENSE_FILES = COPYING
+NETCF_DEPENDENCIES = augeas libnl libxml2 libxslt readline
+NETCF_INSTALL_STAGING = YES
+
+# 0007-Install-init-script-as-etc-init.d-S30netcf-transacti.patch
+NETCF_AUTORECONF = YES
+
+NETCF_CONF_OPTS = \
+	--with-sysinit=$(if $(BR2_INIT_SYSTEMD),systemd,$(if $(BR2_INIT_NONE),none,initscripts))
+
+$(eval $(autotools-package))

2.14.3

Hello,

Just a few remarks;

Hello Carlos,

Thomas Petazzoni, CTO, Bootlin (formerly Free Electrons)
Embedded Linux and Kernel engineering
https://bootlin.com

[snip]

However, since the upstream sysv init script is pretty complicated and must be
patched anyway, it would make sense to always use our own, and in that case it would be

ifeq ($(BR2_INIT_SYSTEMD),y)
NETCF_CONF_OPTS += --with-sysinit=systemd
else
# For SysV init we use our own init script
NETCF_CONF_OPTS += --with-sysinit=none
endif

Regards,
Arnout

Arnout Vandecappelle                          arnout at mind be
Senior Embedded Software Architect            +32-16-286500
Essensium/Mind                                http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium           BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF

Libvirt is collection of software that provides a convenient way to manage virtual machines and other virtualization functionality, such as storage and network interface management. These software pieces include an API library, a daemon (libvirtd), and a command line utility (virsh).

http://libvirt.org/

---
History:
v1: primitive package, for experimental purposes only v1->v2:
- Clarify dependence on !BR2_TOOLCHAIN_USES_MUSL
- Add run-time dependence dnsmask
- Add dependence on eudev and libpciaccess when eudev is selected (thus detected by configure).
v2->v3:
- Condition the use of libtirpc to !BR2_TOOLCHAIN_HAS_NATIVE_RPC
- Check for BR2_PACKAGE_HAS_UDEV instead of BR2_PACKAGE_EUDEV
v3->v4:
- Fix version history :-).
- Add optional dependency on several packages (e.g. attr, libpcap), depending on wether they are selected or not, and explicitly disable features whose required packages are not selected. This is very important to prevent selection of features based on leaks from the host environment (e.g. finding /usr/bin/numad on the host machine).
- Enable the "interface" driver if either udev or netcf is available.
- Disable pm-utils support, since there is no package for Buildroot.
- Use either openssl or gnutls, if available.
- Run qemu as user "qemu", group "kvm", not as root.
- Add a LIBVIRT_USERS variable to create user "qemu" an group "kvm".
- Add a device table file to set the ownership and permissions of the libvirt directories under /etc, /run and /var.
- If udev is not available, add an init script to set the ownership and permissions of /dev/kvm to root:kvm and 0660; otherwise create a corresponding /etc/udev/rules.d/90-kvm.rules file.
- Enable support for systemd, if applicable; otherwise install an init script to start/stop/restart libvirtd.
- Ensure that a modern netcat is available.

---
 package/Config.in                |   1 +
 package/libvirt/Config.in        |  44 ++++++++
 package/libvirt/S30devkvmperms   |  28 +++++
 package/libvirt/S90libvirt       | 139 +++++++++++++++++++++++
 package/libvirt/device_table.txt |  39 +++++++
 package/libvirt/libvirt.hash     |   2 +
 package/libvirt/libvirt.mk       | 233 +++++++++++++++++++++++++++++++++++++++
 7 files changed, 486 insertions(+)
 create mode 100644 package/libvirt/Config.in
 create mode 100755 package/libvirt/S30devkvmperms
 create mode 100644 package/libvirt/S90libvirt
 create mode 100644 package/libvirt/device_table.txt
 create mode 100644 package/libvirt/libvirt.hash
 create mode 100644 package/libvirt/libvirt.mk

index cdfb90151a..1c040f0e1a 100644
@@ -1925,6 +1925,7 @@ menu "System tools"
 	source "package/keyutils/Config.in"
 	source "package/kmod/Config.in"
 	source "package/kvmtool/Config.in"
+	source "package/libvirt/Config.in"
 	source "package/lxc/Config.in"
 	source "package/monit/Config.in"
 	source "package/ncdu/Config.in"

new file mode 100755
index 0000000000..8953256a03
@@ -0,0 +1,28 @@
+#!/bin/sh
+#
+# Set the permissions of /dev/kvm
+#
+
+start() {
+	printf "Setting the ownership and permissions of /dev/kvm: "
+	chown qemu:kvm /dev/kvm && chmod 660 /dev/kvm \
+	&& echo "OK" || echo "FAIL"
+}
+
+stop() {
+	printf "Restoring the ownership and permissions of /dev/kvm: "
+	chown root:root /dev/kvm && chmod 600 /dev/kvm \
+	&& echo "OK" || echo "FAIL"
+}
+
+case "$1" in
+  start|restart|reload)
+      start
+	;;
+  stop)
+      stop
+	;;
+  *)
+	echo "Usage: $0 {start|stop|restart}"
+	exit 1
+esac

new file mode 100644
index 0000000000..a0f155ef24
@@ -0,0 +1,39 @@
+# See package/makedevs/README for details
+#
+# Libvirt directories ownership and permissions
+#
+# <name>				<type>	<mode>	<uid>	<gid>	<major>	<minor>	<start>	<inc>	<count>
+/etc/libvirt				d	700	0	0	-	-	-	-	-
+/etc/libvirt/nwfilter			d	700	0	0	-	-	-	-	-
+/etc/libvirt/qemu			d	700	0	0	-	-	-	-	-
+/etc/libvirt/qemu/autostart		d	700	0	0	-	-	-	-	-
+/etc/libvirt/qemu/networks		d	700	0	0	-	-	-	-	-
+/etc/libvirt/qemu/networks/autostart	d	700	0	0	-	-	-	-	-
+/etc/libvirt/storage			d	755	0	0	-	-	-	-	-
+/etc/libvirt/storage/autostart		d	755	0	0	-	-	-	-	-
+/run/libvirt				d	755	0	0	-	-	-	-	-
+/run/libvirt/hostdevmgr			d	755	0	0	-	-	-	-	-
+/run/libvirt/network			d	755	0	0	-	-	-	-	-
+/run/libvirt/qemu			d	755	0	0	-	-	-	-	-
+/run/libvirt/storage			d	755	0	0	-	-	-	-	-
+/var/lib/libvirt			d	755	0	0	-	-	-	-	-
+/var/lib/libvirt/boot			d	711	0	0	-	-	-	-	-
+/var/lib/libvirt/dnsmasq		d	755	0	0	-	-	-	-	-
+/var/lib/libvirt/filesystems		d	711	0	0	-	-	-	-	-
+/var/lib/libvirt/images			d	711	0	0	-	-	-	-	-
+/var/lib/libvirt/network		d	700	0	0	-	-	-	-	-
+/var/lib/libvirt/qemu			d	751	107	36	-	-	-	-	-
+/var/lib/libvirt/qemu/channel		d	755	107	36	-	-	-	-	-
+/var/lib/libvirt/qemu/channel/target	d	755	107	36	-	-	-	-	-
+/var/lib/libvirt/qemu/dump		d	755	107	36	-	-	-	-	-
+/var/lib/libvirt/qemu/nvram		d	755	107	36	-	-	-	-	-
+/var/lib/libvirt/qemu/save		d	755	107	36	-	-	-	-	-
+/var/lib/libvirt/qemu/snapshot		d	755	107	36	-	-	-	-	-
+# These are lost if /var/cache and/or /var/log are mounted on a tmpfs but they are harmless, anyway
+/var/cache/libvirt			d	711	0	0	-	-	-	-	-
+/var/cache/libvirt/lxc			d	750	0	0	-	-	-	-	-
+/var/cache/libvirt/qemu			d	750	107	36	-	-	-	-	-
+/var/cache/libvirt/qemu/capabilities	d	755	0	0	-	-	-	-	-
+/var/log/libvirt			d	700	0	0	-	-	-	-	-
+/var/log/libvirt/lxc			d	750	0	0	-	-	-	-	-
+/var/log/libvirt/qemu			d	750	107	36	-	-	-	-	-

new file mode 100644
index 0000000000..389a3c1670
@@ -0,0 +1,2 @@
+# locally computed
+sha256 4e7bcb209eeef99f026484293abc733e30ed06dabcdde62c4c3e95f71b2b67ba  libvirt-3.7.0.tar.xz

2.14.3

Hi Carlos,

     http://baruch.siach.name/blog/                  ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch at tkos.co.il - tel: +972.2.679.5364, http://www.tkos.co.il -

Hello,

This is not a simple package. We did a review with Arnout, I'll try to summarize the comments that we had. I'm sure I'll forget about those comments though.

	$(INSTALL) -D -m 0755 package/libvirt/S30devkvmperms \
		$(TARGET_DIR)/etc/init.d/S30devkvmperms

	$(LIBVIRT_INSTALL_KVMPERMS_INIT_SCRIPT)
	$(INSTALL) -D -m 0755 package/libvirt/S90libvirt \
		$(TARGET_DIR)/etc/init.d/S90libvirt

Thomas Petazzoni, CTO, Bootlin (formerly Free Electrons)
Embedded Linux and Kernel engineering
https://bootlin.com

[snip]

Because libvirt calls the 'nc' executable with the ncat command line arguments,
so it needs the nc -> ncat symlink, which is not created when netcat is installed.

However, this makes me think: wouldn't it be easier to patch libvirt to call
ncat instead of nc?

Regards,
Arnout

[snip]

Arnout Vandecappelle                          arnout at mind be
Senior Embedded Software Architect            +32-16-286500
Essensium/Mind                                http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium           BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF

No, because it would be necessary to modify virt-manager, which runs on a separate machine. It accesses the KVM host (built with Buildroot) via ssh, and invokes nc to communicate with libvirtd by means of a unix domain socket.

Notice that virt-manager is smarter than the ordinary bear: it checks which syntax the "nc" command on the remote machine recognizes and invokes it with the suitable parameters. So forcing it to use ncat would prevent it from managing KVM hosts running Debian/Ubuntu.

Notice also that the libvirt package noes not even build/install virt-manager, since it is a GUI tool. Such improvement is left as an exercise for the reader. :-)

Carlos Santos (Casantos) - DATACOM, P&D
?The greatest triumph that modern PR can offer is the transcendent 
success of having your words and actions judged by your reputation, 
rather than the other way about.? ? Christopher Hitchens

OK, but if virt-manager supports both GNU netcat and nmap-ncat, then why does
libvirt depend on nmap-ncat and not netcat? In other words: why not

select BR2_PACKAGE_NMAP if !BR2_PACKAGE_NETCAT select BR2_PACKAGE_NMAP_NCAT if !BR2_PACKAGE_NETCAT

(We could even use busybox nc, but it's not very likely that virt-manager is OK with that, and even so it's impossible to detect in Buildroot if busybox nc is enabled or not.)

Regards,
Arnout

Arnout Vandecappelle                          arnout at mind be
Senior Embedded Software Architect            +32-16-286500
Essensium/Mind                                http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium           BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF

The "nc" commands provided by netcat and busybox are not sufficient because they don't support unix domain sockets.

Moreover, these configuration tricks make the Config.in file harder to read and understand. I still believe that my original approach[1] was better. It would allow us to add some "BR2_HAS_MODERN_NC" config, selected by netcat-openbsd and ncat, and make libvirt depend on it.

1. https://patchwork.ozlabs.org/patch/820503/

Carlos Santos (Casantos) - DATACOM, P&D
?The greatest triumph that modern PR can offer is the transcendent 
success of having your words and actions judged by your reputation, 
rather than the other way about.? ? Christopher Hitchens

virt-manager could be patched however to try 'ncat' in addition to (or instead
of) 'nc'. That would solve the problem with the symlink and you could have parallel netcat and nmap-netcat instalations (if you would want that for whatever reason...).

OK. It's a bit hard to follow with all these different netcat versions :-) So
which is the other netcat supported by virt-manager? Is there a fifth one?

Anyway, if nmap-netcat is the only supported one, then this really is the right
thing to do. It would be good to add a comment above the "depends on !BR2_PACKAGE_NETCAT" to explain that though.

So you think it's an improvement that if you want libvirt, you first have to go
and select nmap-ncat? I find the current structure much more user friendly. Perhaps it could use an additional

comment "libvirt is incompatible with netcat"
depends on all the libvirt dependencies
depends on BR2_PACKAGE_NETCAT

Regards,
Arnout

Arnout Vandecappelle                          arnout at mind be
Senior Embedded Software Architect            +32-16-286500
Essensium/Mind                                http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium           BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF

[trimming the text in order to keep it readable]

We don't have control over virt-manager. It is a Python script runing on a remote machine which can even run a different OS. It accesses the KVM host (the machine running our Buildroot-built OS) using a command line like this one:

ssh -l johnny -- host.example.com sh -c 'if 'nc' -q 2>&1 | grep "requires an argument" >/dev/null 2>&1; then ARG=-q0;else ARG=;fi;'nc' $ARG -U /var/run/libvirt/libvirt-sock'

Then it communicates with libvirtd through the tunnel composed by the socket created by ssh and the redirected stdout/stdin created by nc.

The search for "requires an argument" detects netcat-openbsd (Debian/Ubuntu).

Carlos Santos (Casantos) - DATACOM, P&D
?The greatest triumph that modern PR can offer is the transcendent 
success of having your words and actions judged by your reputation, 
rather than the other way about.? ? Christopher Hitchens