Tuesday, May 14, 2024

Setup KVM Hypervisor on SparkyLinux 2024.05

Virt-manager still appears to be the most powerful tool in regards of deployment and managment of KVM guests. Current version in Debian SID is 1:4.1.0-4. The presence of Web Cockpit Console is a nice way to manage KVM guest's via clicking the button "Launch remote viewer"  built into Cockpit Web Console. Bridge attached to external network interface was also created utilizing network management section inside Web Console and provides an alternative for guests attachment via NAT.  

Install KVM

 $ sudo apt install qemu-kvm libvirt-clients libvirt-daemon-system 
                bridge-utils virtinst libvirt-daemon virt-manager -y 
 $ sudo virsh net-start default
 $ sudo virsh net-autostart default                    
 $ sudo modprobe vhost_net 
 $ lsmod | grep vhost
 $ echo vhost_net | sudo tee -a /etc/modules
 $ sudo usermod -a -G libvirt  $(whoami)
 $ sudo reboot

boris@boris-spaky2405:~$ neofetch
                                               boris@boris-spaky2405 
           .            `-:-`                  --------------------- 
          .o`       .-///-`                    OS: SparkyLinux 8 (Seven-Sisters) x86_64 
         `oo`    .:/++:.                       Host: KVM/QEMU (Standard PC (Q35 + ICH9, 2009) pc-q35-8.2) 
         os+`  -/+++:` ``.........```          Kernel: 6.9.0-sparky8-amd64 
        /ys+`./+++/-.-::::::----......``       Uptime: 1 min 
       `syyo`++o+--::::-::/+++/-``             Packages: 2474 (dpkg) 
       -yyy+.+o+`:/:-:sdmmmmmmmmdy+-`          Shell: bash 5.2.21 
::-`   :yyy/-oo.-+/`ymho++++++oyhdmdy/`        Resolution: 1280x800 
`/yy+-`.syyo`+o..o--h..osyhhddhs+//osyy/`      Terminal: /dev/pts/1 
  -ydhs+-oyy/.+o.-: ` `  :/::+ydhy+```-os-     CPU: AMD Ryzen 7 3700X (8) @ 3.599GHz 
   .sdddy::syo--/:.     `.:dy+-ohhho    ./:    GPU: 00:01.0 Red Hat, Inc. Virtio 1.0 GPU 
     :yddds/:+oo+//:-`- /+ +hy+.shhy:     ``   Memory: 906MiB / 15631MiB 
      `:ydmmdysooooooo-.ss`/yss--oyyo
        `./ossyyyyo+:-/oo:.osso- .oys                                  
       ``..-------::////.-oooo/   :so                                  
    `...----::::::::--.`/oooo:    .o:
           ```````     ++o+:`     `:`
                     ./+/-`        `
                   `-:-.
                   ``

boris@boris-spaky2405:~$ dpkg -l | grep virt-manager
ii  virt-manager                                             1:4.1.0-4                                all          desktop application for managing virtual machines
boris@boris-spaky2405:~$ dpkg -l | grep virtinst
ii  virtinst                                                 1:4.1.0-4                                all          utilities to create and edit virtual machines
boris@boris-spaky2405:~$ sudo virsh --connect qemu:///system
[sudo] password for boris: 
Welcome to virsh, the virtualization interactive terminal.

Type:  'help' for help with commands
       'quit' to quit

virsh # version
Compiled against library: libvirt 10.2.0
Using library: libvirt 10.2.0
Using API: QEMU 10.2.0
Running hypervisor: QEMU 8.2.3








































Install Web Cockpit Console
 $  sudo apt install cockpit cockpit-machines
 $  sudo systemctl start cockpit.socket

 Update of /usr/lib/systemd/system/cockpit.service is still required  two lines below are supposed to be added to *.service file :
  [Install]

  WantedBy=graphical.target

 $  sudo systemctl enable cockpit.socket

 Tuning firewall
 $  sudo apt install firewalld
 $  sudo firewall-cmd --add-service=cockpit --permanent
 $  sudo firewall-cmd --reload



















Virt-manager 1:4.1.0-4 was submitted to SID on 05/14/2024




















Friday, May 3, 2024

Manjaro Testing Instance setup as KVM Guest in UEFI mode (Fedora 40 KVM Hypervisor)

 Original Virt-manager UEFI option setup  should be configured as follows /usr/share/edk2/ovmf/OVMF_CODE_4M.qcow2 . Next step is supposed to be creating /boot/efi  fat32 EFI partition during Calamares Installer virtual disk layout configuration

Creating /boot/efi partition performing instance setup via Calamares Installer























Runtime snapshots after upgrading instance deployed via ISO image as of 04/06/2024 up to Manjaro Testing Instance, followed by kernel upgrade up to 6.8.8-2












Same Virt-Manager UEFI option setup allows to deploy CachyOS-240401 KVM Guest in UEFI mode



EndeavourOS 24.04 as KVM Guest in UEFI Mode



UPDATE as of 05/05/2024 

Deploying KVM Guests in UEFI mode on 

Manjaro Testing KVM Host





















Wednesday, May 1, 2024

Saturday, April 6, 2024

Precautionary measures at Manjaro Testing Branch in context of CVE-2024-3094

UPDATE as of 04/19/2024   Current status of Manjaro Testing 

branch.  KDE Frameworks 6.1.0 and KDE Plasma 6.0.4 arrived on Manjaro Testing Branch





UPDATE as of 04/09/20224                   
As of now you might need 
$ sudo pacman -Syyu after updating mirror's list. Another way  
$ sudo pacman -Syy ; $ sudo pacman -Syu

Your installation should go through phase

:: Synchronizing package databases...
core                              147.7 KiB   444 KiB/s 00:00 [##################################] 100%
extra                               8.7 MiB  6.76 MiB/s 00:01 [##################################] 100%
multilib                          144.9 KiB   315 KiB/s 00:00 [##################################] 100%
:: Some packages should be upgraded first...
resolving dependencies...
looking for conflicting packages...

Packages (1) archlinux-keyring-20240313-1

Total Download Size:   1.16 MiB
Total Installed Size:  1.66 MiB
Net Upgrade Size:      0.00 MiB

:: Proceed with installation? [Y/n] Y

.  .  .  .  .  .  .
:: Starting full system upgrade...
:: Replace baloo5 with extra/baloo? [Y/n] Y
:: Replace breeze with extra/breeze5? [Y/n] Y
:: Replace ksysguard with extra/plasma-systemmonitor? [Y/n] Y
:: Replace kuserfeedback5 with extra/kuserfeedback? [Y/n] Y
:: Replace oxygen with extra/oxygen5? [Y/n] Y
:: Replace plasma-integration with extra/plasma5-integration? [Y/n] Y
:: Replace plasma-wayland-session with extra/plasma-workspace? [Y/n] Y
:: Replace plasma5-themes-breath with extra/plasma6-themes-breath? [Y/n] Y
:: Replace plasma5-themes-breath-migration with extra/plasma6-themes-breath-migration? [Y/n] Y
resolving dependencies...
:: There are 2 providers available for qt6-multimedia-backend:
:: Repository extra
  1) qt6-multimedia-ffmpeg  2) qt6-multimedia-gstreamer

Enter a number (default=1): 1

END UPDATE

Per https://forum.manjaro.org/t/xz-package-contains-a-vulnerability/159028/26 

Arch does not directly link openssh to liblzma, and thus this attack vector is not possible. You can confirm this by issuing the following command:

ldd "$(command -v sshd)"

However, out of an abundance of caution, we advise users to remove the malicious code from their system by upgrading either way. This is because other yet-to-be discovered methods to exploit the backdoor could exist.
– Arch Linux - News: The xz package has been backdoored 

On Manjaro Testing I was able only downgrade (say) to xz-5.4.6-1 and lib32-xz-5.4.6-1

Running https://github.com/cyclone-github/scripts/blob/main/xz_cve-2... on Manjaro Testing :-








































Per https://archlinux.org/news/the-xz-package-has-been-backdoored/

It is strongly advised to do a full system upgrade right away if your system currently has xz version 5.6.0-1 or 5.6.1-1 installed:

$ pacman -Syu

After running  on Manjaro stable KDE as of 04/06/24

$ sudo pacman-mirrors --api --set-branch testing

$ sudo pacman-mirrors --fasttrack 5 && sudo pacman -Syu
I obtained 
$  pacman -Ss xz                                                               
    core/xz 5.6.1-3 [installed]
   Library and command line tools for XZ and LZMA compressed files
   extra/pixz 1.0.7-4
   Parallel, indexed xz compressor
   multilib/lib32-xz 5.6.1-3 [installed]
   Library and command line tools for XZ and LZMA compressed files (32-bit)
$ pacman -Ss lib32-xz                                                        
   multilib/lib32-xz 5.6.1-3 [installed]
   Library and command line tools for XZ and LZMA compressed files (32-bit)
Per link above version  5.6.1-3 was already fixed . I'd just skipped this notice ( 5.6.1-2 had been already fixed ). See first paragraph. So, there is no need to downgrade xz-5.6.1-3 and lib32-xz-5.6.1-3 on Manjaro Testing .














The most recent version of xz released for Arch Linux

Sunday, March 31, 2024

Virt-manager && Deploying KVM Guests in UEFI mode on AlmaLinux 9.3

The main purpose of this post is to demonstrate that the cockpit.service is not required for deploying KVM guests in UEFI mode on AlmaLinux 9.3, which has binary-compatibility with RHEL. Linux bridge for VMs has been installed via nmcli to avoid any involvement of cockpit.service. See for detailis  http://lxer.com/module/newswire/view/338368/index.html  Everything works on AlmaLinux 9.3 as on openSUSE Tumbleweed. KVM Setup on AlmaLinux 9.(X) follows standard guide lines.





















































When installing virt-manager, the presence of the Cockpit web console becomes optional. It's a good idea to have Cockpit Web Console installed, but it's not required. The presence of edk2-ovmf is required. We have the same situation with Tumbleweed, Ubuntu 22.04, Debian12.(X), Manjaro Linux 23.1.3