On Wed, Sep 08, 2021 at 04:22:31AM +0000, Leek, Jim wrote: > I'm on a RHEL 8 host, using virt-manager to run a CentOS 8 guest. I need > to be able to have a program on the guest trigger a checkpoint to save > the guest. I came up with a kludgy way to do this involving a script > that ssh's to the host and runs 'virsh qemu-monitor-command --hmp > centos8_1 "savevm savestate1"' and that works to some degree, but it > takes a long time and sometimes I get an error. This is a bad idea. "savevm" completely stops execution of the guest for the duration that it runs.....so your ssh conenction is suspended. Depending on how long this takes, your ssh connection may take some time to recover, or in the worst case fail. Using qemu-monitor-command is not neccessary because libvirt already has support for savevm via its domain snapshot APIs epxosed in virsh using snapshot-* commands. Using qemu-monitor-command in this case is likely to confuse libvirt because it is resulting in unexpected state changes in the guest. Allowing the guest to ssh into the host and connect to libvirt throws away any security isolation your host has from the guest. So if your guest is compromised it'll easily take over the host too. > So, I'm trying to think of ways to simplify the system. If anyone has any ideas, I would love to have them. All I can think of is: > > 1. Connect to the qemu monitor with telnet from inside the VM. (Therefore skipping the whole ssh remote command thing.) Definitely don't want todo that - access to the QEMU monitor again allows guest to attack the host in various ways. If libvirt is connected to the QEMU monitor, you can't have a second connection anyway. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
