On 03/25/2013 03:09 AM, Benoit Friry wrote:> Hello,
>
> I test libvirt 0.9.12 on Debian.
>
> I am disappointed by changes made on my host without any notice.
The whole point of libvirtd is to make changes on your host; I wouldn't
go so far as to say that it was without notice, just that they are
changes that you weren't aware that libvirtd was capable of exposing.
>
> Examples:
> - editing interfaces with virsh or virt-manager modifies my
> /etc/network/interfaces. It's not clear at first glance that I can even
> cut myself from the host when editing remotely. The initial file is not
> even saved.
The initial file _is_ saved if you properly use the 'virsh iface-begin'
command before making any changes, then 'virsh iface-commit' if you are
happy with the changes. 'virsh iface-rollback' will revert you to a
previous saved state, and since we know that an improper change can cut
off connectivity, we also set things up so that a host reboot will do an
implicit 'virsh iface-rollback' on any uncommitted changes.
> - starting default network (nat) adds rules in netfilter. I have not
> seen how to create another network nat conf without calling
> clean-traffic nwfilter (it is not explicit in network XML file). Is it
> hardcoded ?
What distro are you using? The clean-traffic nwfilter is not installed
by default on Fedora, so I'm wondering if you are hitting a
distro-specific add-on, or something that is added by a higher layer of
the virt stack than just libvirt. Libvirt's own NAT netfilter rules are
required for out-of-the-box NAT to a guest, but no one says you are
forced to use NAT; you can design your own bridge and take over the
netfilter rules yourself if you don't want libvirt messing with iptables.
>
> I think it would be nice:
> - to be alerted before any host modification,
What did you have in mind? Patches are welcome if you can come up with
a proposal.
> - to be able to change the templates, for instance:
> - not including any nwfilter when creating a network,
> - script called when adding a file in a dir pool,
> - and so on.
>
> Did I miss something?
> Am I alone to disappointed by such behavior?
>
--
Eric Blake eblake redhat com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 621 bytes
Desc: OpenPGP digital signature
URL:
<http://listman.redhat.com/archives/libvirt-users/attachments/20130325/a4bbb4e9/attachment.sig>