security: also parse user/group names instead of just IDs for DAC labels

The DAC driver is missing parsing of group and user names for DAC labels
and currently just parses uid and gid. This patch extends it to support
names, so the following security label definition is now valid:

  <seclabel type='static' model='dac' relabel='yes'>
      <label>qemu:qemu</label>
      <imagelabel>qemu:qemu</imagelabel>
  </seclabel>

When it tries to parse an owner or a group, it first tries to resolve it as
a name, if it fails or it's an invalid user/group name then it tries to
parse it as an UID or GID. A leading '+' can also be used for both owner and
group to force it to be parsed as IDs, so the following example is also
valid:

  <seclabel type='static' model='dac' relabel='yes'>
      <label>+101:+101</label>
      <imagelabel>+101:+101</imagelabel>
  </seclabel>

This ensures that UID 101 and GUI 101 will be used instead of an user or
group named "101".
doc: update description about security labels on formatdomain.html

This patch adds a brief description about labels for each security
driver.
build: update gnulib for FreeBSD build

Several gnulib tests were failing 'make check', and compilation with
CFLAGS=-g failed due to a gcc 4.2.1 limitation.

* .gnulib: Update to latest, for gcc 4.2 support and fixed FreeBSD tests.
docs: rudimentary phyp documentation

Based on a report that phyp is undocumented:
https://www.redhat.com/archives/libvirt-users/2012-July/msg00013.html

* docs/drvphyp.html.in (phyp): New file.
* docs/drivers.html.in: List it.
Correct checking of virStrcpyStatic() return value

Correct the check for the return value of virStrcpyStatic()
when copying port-profile names. Fixes Open vSwitch ports
which utilize port-profiles from network definitions.

Signed-off-by: Kyle Mestery <kmestery@cisco.com>
doc: Add Maven repository to Java bindings documentation

Getting a artifact into Maven central has a lot of restrictions as
where the artifact should be hosted.

This seemed like a big hassle which we don't want to go through now.

Document a way for users to use libvirt.org as a repository so they can
fetch the Java bindings with maven.

Signed-off-by: Wido den Hollander <wido@widodh.nl>
docs: fix links in migration.html TOC

Use of the wrong attribute name caused the table of contents to
be useless.  Fix suggested by Daniel P. Berrange.

* docs/migration.html.in: Use correct anchoring attribute.
private.syms: Drop virKillProcess

After it got renamed to virProcessKill (cf470068a11)
it is no longer needed in the private syms file.
spec: prefer canonical name of util-linux

I noticed that in two places, we require util-linux, and in a third,
we require util-linux-ng.  On Fedora (I tested F15 through rawhide),
util-linux-ng is obsoleted by util-linux; on RHEL 6, util-linux
is obsoleted by util-linux-ng.  That is, on either platform, either
name will get you the correct package installed (where the preferred
name on fedora is util-linux, and on RHEL 6 is util-linux-ng).  But
on RHEL 5, there is no util-linux-ng

* libvirt.spec.in (Requires): Use util-linux, not util-linux-ng.
Check for private symbols presence as well

Currently, we are checking if libvirt.so contains public symbols.
However, sometimes we rename an internal symbol and forget to
change libvirt_private.syms accordingly. Hence, it's safer to check
for internal symbols as well.
build: fix VPATH builds

This reverts part of commit 5468594f465; the perl changes in that
patch were sufficient.  Since libvirt.syms is already a generated
file created in part from libvirt_private.syms, we don't need a
second pass over libvirt_private.syms in isolation.

* src/Makefile.am: Undo addition of check-private-symfile.
S390: Buffer too small for large CPU numbers.

The output buffer for virFileReadAll was too small for systems with
more than 30 CPUs which leads to a log entry and incorrect behavior.
The new size will be sufficient for the current
architectural limits.

Signed-off-by: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com>
esx: Disable libcurl's use of signals to fix a segfault

libcurl uses a SIGALRM in combination with sigsetjmp/siglongjmp to be
able to abort a DNS lookup when it takes too long. The problem with this
in a multi-threaded application is that the signal handler for SIGALRM
and the call to siglongjmp can be executed on a thread that is different
from the one that initially did the SIGALRM setup and the call to
sigsetjmp. In the reported case this triggered a segfault.

Disable libcurl's use of signals to avoid this situation. This has the
disadvantage of losing the ability to abort synchronous DNS lookups which
might result in libcurl getting stuck in a DNS lookup in the worst case.
When libcurl was build with an asynchronous DNS backend such as c-ares
then there is no problem because the timeout mechanism works without
signals here anyway.

Reported by Benjamin Wang.
python: cleanup vcpu related binding APIs

libvirt_virDomainGetVcpus: add error handling, return -1 instead of None
libvirt_virDomainPinVcpu and libvirt_virDomainPinVcpuFlags:
  check the type of argument
  make use of libvirt_boolUnwrap

  Set bitmap according to these values which are contained in given
  argument of vcpu tuple and turn off these bit corresponding to
  missing vcpus in argument tuple

  The original way ignored the error info from PyTuple_GetItem
  if index is out of range.
  "IndexError: tuple index out of range"
  The error message will only be raised on next command in interactive mode.
python: keep consistent handling of Python integer conversion

libvirt_ulonglongUnwrap requires the integer type of python obj.
But libvirt_longlongUnwrap still could handle python obj of
Pyfloat_type which causes the float value to be rounded up
to an integer.

For example
 >>> dom.setSchedulerParameters({'vcpu_quota': 0.88})
 0
libvirt_longlongUnwrap treats 0.88 as a valid value 0

However
 >>> dom.setSchedulerParameters({'cpu_shares': 1000.22})
libvirt_ulonglongUnwrap will throw out an error
"TypeError: an integer is required"

The patch make this consistent.
Fix typo in HAVE_DBUS automake conditional

The variable that is set in the script is with_dbus, not have_dbus.
fix kvm_pv_eoi with kvmclock

When both kvmclock and kvm_pv_eoi are configured (either disabled or
enabled) libvirt will generate invalid CPU specification due to the
fact that even though kvmclock causes the CPU to be specified, it
doesn't set have_cpu flag to true (and the new kvm_pv_eoi as well).
This patch fixes the issue and adds a test exactly for that to show
that it is fixed correctly (and also to keep it that way in the future
of course).
Call curl_global_init from virInitialize to avoid thread-safety issues

curl_global_init is not thread-safe. curl_easy_init might call
curl_global_init when it was no called before. But curl_easy_init
can be called from different threads by the ESX driver. Therefore,
call curl_global_init from virInitialize to stop curl_easy_init from
calling it.

Reported by Benjamin Wang.
util: extend virGetUserID and virGetGroupID to support names and IDs

This patch updates virGetUserID and virGetGroupID to be able to parse a
user or group name in a similar way to coreutils' chown. This means that
a numeric value with a leading plus sign is always parsed as an ID,
otherwise the functions try to parse the input first as a user or group
name and if this fails they try to parse it as an ID.

This patch includes Peter Krempa's changes to correctly handle errors
returned by getpwnam_r and getgrnam_r.
security: update user and group parsing in security_dac.c

The functions virGetUserID and virGetGroupID are now able to parse
user/group names and IDs in a similar way to coreutils' chown. So, user
and group parsing in security_dac can be simplified.