{"id":771,"date":"2019-02-22T14:38:11","date_gmt":"2019-02-22T11:38:11","guid":{"rendered":"https:\/\/artem.services\/?p=758"},"modified":"2019-02-22T18:06:44","modified_gmt":"2019-02-22T15:06:44","slug":"virsh-macos-mojave-2","status":"publish","type":"post","link":"https:\/\/artem.services\/?p=771&lang=en","title":{"rendered":"Virsh — MacOS Mojave"},"content":{"rendered":"

1. Preparation<\/h4>\n

Install the necessary packages:<\/span><\/span><\/p>\n

\r\napt install iptables-persistent apparmor-utils ovmf\r\n<\/pre>\n
Open the QEMU<\/strong> configuration file:<\/span><\/span><\/p>\n
\r\nvim \/etc\/libvirt\/qemu.conf\r\n<\/pre>\n
And add\/edit the following line:<\/span><\/span><\/p>\n
\r\nsecurity_driver = "apparmor"\r\n<\/pre>\n
Restart libvirt<\/strong> service<\/span><\/span><\/p>\n
\r\nsystemctl restart libvirt-bin\r\nsystemctl restart libvirtd\r\n<\/pre>\n
<\/p>\n
Next you need to create an XML<\/strong> file with the description of our virtual machine.<\/span><\/span><\/p>\n
\r\nvim macos-mojave.xml\r\n<\/pre>\n
With the following content:<\/span><\/span><\/p>\n
\r\n<domain type='kvm' xmlns:qemu='http:\/\/libvirt.org\/schemas\/domain\/qemu\/1.0'>\r\n  <name>macos-mojave<\/name>\r\n  <uuid>2aca0dd6-cec9-4717-9ab2-0b7b13d111c3<\/uuid>\r\n  <title>MacOS-Mojave<\/title>\r\n  <memory unit='KiB'>8192000<\/memory>\r\n  <currentMemory unit='KiB'>8192000<\/currentMemory>\r\n  <vcpu placement='static'>4<\/vcpu>\r\n  <os>\r\n    <type arch='x86_64' machine='pc-q35-2.11'>hvm<\/type>\r\n    <loader readonly='yes' type='pflash'>\/var\/lib\/kvm\/vm_images\/macos-mojave\/OVMF_CODE.fd<\/loader>\r\n    <nvram>\/var\/lib\/kvm\/vm_images\/macos-mojave\/OVMF_VARS-1024x768.fd<\/nvram>\r\n  <\/os>\r\n  <features>\r\n    <acpi\/>\r\n    <kvm>\r\n      <hidden state='on'\/>\r\n    <\/kvm>\r\n  <\/features>\r\n  <clock offset='utc'\/>\r\n  <on_poweroff>destroy<\/on_poweroff>\r\n  <on_reboot>restart<\/on_reboot>\r\n  <on_crash>restart<\/on_crash>\r\n  <devices>\r\n    <emulator>\/usr\/bin\/qemu-system-x86_64<\/emulator>\r\n    <disk type='file' device='disk'>\r\n      <driver name='qemu' type='qcow2' cache='writeback'\/>\r\n      <source file='\/var\/lib\/kvm\/vm_images\/macos-mojave\/mac_hdd.img'\/>\r\n      <target dev='sda' bus='sata'\/>\r\n      <boot order='1'\/>\r\n      \r\n\r\n<address type='drive' controller='0' bus='0' target='0' unit='0'\/>\r\n    <\/disk>\r\n    <controller type='sata' index='0'>\r\n      \r\n\r\n<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'\/>\r\n    <\/controller>\r\n    <controller type='pci' index='0' model='pcie-root'\/>\r\n    <controller type='pci' index='1' model='dmi-to-pci-bridge'>\r\n      <model name='i82801b11-bridge'\/>\r\n      \r\n\r\n<address type='pci' domain='0x0000' bus='0x00' slot='0x1e' function='0x0'\/>\r\n    <\/controller>\r\n    <controller type='pci' index='2' model='pci-bridge'>\r\n      <model name='pci-bridge'\/>\r\n      <target chassisNr='2'\/>\r\n      \r\n\r\n<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'\/>\r\n    <\/controller>\r\n    <controller type='usb' index='0' model='ich9-ehci1'>\r\n      \r\n\r\n<address type='pci' domain='0x0000' bus='0x00' slot='0x1d' function='0x7'\/>\r\n    <\/controller>\r\n    <controller type='usb' index='0' model='ich9-uhci1'>\r\n      <master startport='0'\/>\r\n      \r\n\r\n<address type='pci' domain='0x0000' bus='0x00' slot='0x1d' function='0x0' multifunction='on'\/>\r\n    <\/controller>\r\n    <controller type='usb' index='0' model='ich9-uhci2'>\r\n      <master startport='2'\/>\r\n      \r\n\r\n<address type='pci' domain='0x0000' bus='0x00' slot='0x1d' function='0x1'\/>\r\n    <\/controller>\r\n    <controller type='usb' index='0' model='ich9-uhci3'>\r\n      <master startport='4'\/>\r\n      \r\n\r\n<address type='pci' domain='0x0000' bus='0x00' slot='0x1d' function='0x2'\/>\r\n    <\/controller>\r\n    <interface type='bridge'>\r\n      <mac address='52:54:00:AB:DF:0A'\/>\r\n      <source bridge='virbr0'\/>\r\n      <target dev='tap1'\/>\r\n      <model type='e1000-82545em'\/>\r\n      \r\n\r\n<address type='pci' domain='0x0000' bus='0x02' slot='0x02' function='0x0'\/>\r\n    <\/interface>\r\n    <input type='keyboard' bus='usb'>\r\n      \r\n\r\n<address type='usb' bus='0' port='2'\/>\r\n    <\/input>\r\n    <input type='mouse' bus='ps2'\/>\r\n    <input type='tablet' bus='usb'>\r\n      \r\n\r\n<address type='usb' bus='0' port='3'\/>\r\n    <\/input>\r\n    <input type='keyboard' bus='ps2'\/>\r\n    <graphics type='vnc' port='5901' autoport='no' listen='0.0.0.0' keymap='en-us'>\r\n      <listen type='address' address='0.0.0.0'\/>\r\n    <\/graphics>\r\n    <sound model='ich9'>\r\n      \r\n\r\n<address type='pci' domain='0x0000' bus='0x02' slot='0x01' function='0x0'\/>\r\n    <\/sound>\r\n    <video>\r\n      <model type='vga'\/>\r\n    <\/video>\r\n    <redirdev bus='usb' type='spicevmc'>\r\n      \r\n\r\n<address type='usb' bus='0' port='5'\/>\r\n    <\/redirdev>\r\n    <hub type='usb'>\r\n      \r\n\r\n<address type='usb' bus='0' port='1'\/>\r\n    <\/hub>\r\n    <memballoon model='none'\/>\r\n  <\/devices>\r\n  <qemu:commandline>\r\n    <qemu:arg value='-device'\/>\r\n    <qemu:arg value='isa-applesmc,osk=ourhardworkbythesewordsguardedpleasedontsteal(c)AppleComputerInc'\/>\r\n    <qemu:arg value='-smbios'\/>\r\n    <qemu:arg value='type=2'\/>\r\n    <qemu:arg value='-cpu'\/>\r\n    <qemu:arg value='Penryn,kvm=on,vendor=GenuineIntel,+invtsc,vmware-cpuid-freq=on,+pcid,+ssse3,+sse4.2,+popcnt,+avx,+aes,+xsave,+xsaveopt,check'\/>\r\n  <\/qemu:commandline>\r\n<\/domain>\r\n<\/pre>\n
We described a virtual machine named "macos-mojave<\/strong>", which has 4 cores<\/strong> and 8 GB RAM<\/strong>, a network card in NAT<\/strong> mode (tap1<\/strong> interface), as well as VNC<\/strong> access on port 5901<\/strong>.<\/span><\/span><\/p>\n
Check the paths to the storage of the disk image and OVMF<\/strong> files.<\/span><\/span><\/p><\/blockquote>\n
MAC<\/strong> address and UUID<\/strong> must be unique.<\/span><\/span><\/p>\n
UUID<\/strong> generation:<\/span><\/p>\n
\r\nuuidgen\r\n<\/pre>\n
MAC<\/strong> address generation:<\/span><\/span><\/p>\n
\r\nprintf '52:54:00:AB:%02X:%02X\\n' $((RANDOM%256)) $((RANDOM%256))\r\n<\/pre>\n
 <\/p>\n
2. Virsh<\/h4>\n
Connect to libvirtd<\/strong>:<\/span><\/span><\/p>\n
\r\nvirsh --connect qemu:\/\/\/system\r\n<\/pre>\n
We check our XML<\/strong> file for validity:<\/span><\/span><\/p>\n
\r\nvirt-xml-validate macos-mojave.xml\r\n<\/pre>\n
Create a virtual machine based on the XML<\/strong> file:<\/span><\/span><\/p>\n
\r\nvirsh define macos-mojave.xml\r\n<\/pre>\n
We start the virtual machine:<\/span><\/span><\/p>\n
\r\nvirsh start macos-mojave\r\n<\/pre>\n
Add a virtual machine to autorun.<\/span><\/span><\/p>\n
We look at the list of VM<\/strong><\/span><\/p>\n
\r\nvirsh list --all\r\n<\/pre>\n
\r\nroot@KVM:~# virsh list --all\r\n Id    Name                           State\r\n----------------------------------------------------\r\n -     macos-mojave                   shut off\r\n<\/pre>\n
We look information on the macos virtual machine<\/span><\/span>:<\/p>\n
\r\nvirsh dominfo macos-mojave\r\n<\/pre>\n
\r\nroot@KVM:~# virsh dominfo macos-mojave\r\nId:             -\r\nName:           macos-mojave\r\nUUID:           2aca0dd6-cec9-4717-9ab2-0b7b13d111c3\r\nOS Type:        hvm\r\nState:          shut off\r\nCPU(s):         4\r\nMax memory:     8192000 KiB\r\nUsed memory:    8192000 KiB\r\nPersistent:     yes\r\nAutostart:      disable\r\nManaged save:   no\r\nSecurity model: none\r\nSecurity DOI:   0\r\n<\/pre>\n
We are interested in the line: "Autostart: disable<\/strong>"<\/span><\/span><\/p>\n
Add to autostart:<\/span><\/p>\n
\r\nvirsh autostart macos-mojave\r\n<\/pre>\n
\r\nroot@KVM:~# virsh autostart macos-mojave\r\nDomain macos-mojave marked as autostarted\r\n<\/pre>\n
Check again:<\/span><\/span><\/p>\n
\r\nroot@KVM:~# virsh dominfo macos-mojave\r\nId:             -\r\nName:           macos-mojave\r\nUUID:           2aca0dd6-cec9-4717-9ab2-0b7b13d111c3\r\nOS Type:        hvm\r\nState:          shut off\r\nCPU(s):         4\r\nMax memory:     8192000 KiB\r\nUsed memory:    8192000 KiB\r\nPersistent:     yes\r\nAutostart:      enable\r\nManaged save:   no\r\nSecurity model: none\r\nSecurity DOI:   0\r\n<\/pre>\n
 <\/p>\n
3. IPTables<\/h4>\n
\n
When Virsh<\/strong> starts, it wipes its IPTables<\/strong> rules.<\/span> In order to avoid this, for the beginning you need to save the necessary rules.<\/span>
\nThe current rules can be viewed with the command:<\/span><\/span><\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\r\niptables -S\r\n<\/pre>\n
An example IPTables<\/strong> initial configuration script:<\/span><\/span><\/p>\n
\r\n#!\/bin\/bash\r\n \r\niptables -F\r\niptables -X\r\n \r\niptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\r\niptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP\r\niptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP\r\niptables -A INPUT -m state --state INVALID -j DROP\r\niptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP\r\niptables -A INPUT -i lo -j ACCEPT\r\n \r\n########################## ALLOWED PORTS ###########################\r\n\r\niptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT\r\niptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT\r\niptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT\r\n\r\n#################### FOR SSH CONNECTIONS TO VM's ###################\r\n\r\niptables -A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT\r\n \r\n####################### ALLOWED IP ADDRESSES #######################\r\n\r\n# FOR VNC ACCESS WITHOUT PASSWORD\r\niptables -A INPUT -s 1.1.1.1 -j ACCEPT\r\niptables -A INPUT -s 2.2.2.2 -j ACCEPT\r\n\r\n######################## FOR NAT FROM VM's #########################\r\n\r\niptables -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT\r\niptables -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT\r\niptables -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT\r\niptables -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT\r\n\r\n################### FOR FORWARDING PORTS TO VM's ###################\r\n\r\niptables -t nat -A PREROUTING -p tcp -d MY_EXTERNAL_IP --dport 2222 -j DNAT --to-destination 192.168.122.100:22\r\n\r\niptables -A FORWARD -i eno1 -d 192.168.122.100 -p tcp --dport 22 -j ACCEPT\r\n\r\n######################## FOR NAT FROM VM's #########################\r\n\r\niptables -A FORWARD -d 192.168.122.0\/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\r\niptables -A FORWARD -s 192.168.122.0\/24 -i virbr0 -j ACCEPT\r\niptables -A FORWARD -i virbr0 -o virbr0 -j ACCEPT\r\niptables -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable\r\niptables -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable\r\n\r\niptables -A OUTPUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT\r\n\r\niptables -P OUTPUT ACCEPT\r\niptables -P INPUT DROP\r\niptables -P FORWARD ACCEPT\r\n\r\n<\/pre>\n
Do not forget to substitute your external IP<\/strong> address, and replace the external interface "eno1<\/strong>" with your own.<\/span><\/span><\/p>\n
The script allows access to the ports: 22<\/strong>, 80<\/strong> and 443<\/strong>. As well as full access to the IP<\/strong> addresses "1.1.1.1<\/strong>" and "2.2.2.2<\/strong>", it also forwards the port "2222<\/strong>" from the host to the port "22<\/strong>" of the virtual machine (IP<\/strong> address<\/span> virtual machine — 192.168.122.100<\/strong>)<\/span><\/p>\n
Save the rules:<\/span><\/p>\n
\r\niptables-save > \/etc\/iptables\/rules.v4\r\n<\/pre>\n
If this folder does not exist, you need to create it:<\/span><\/span><\/p>\n
\r\nmkdir \/etc\/libvirt\/hooks\r\n<\/pre>\n
Create a script:<\/span><\/span><\/p>\n
\r\nvim \/etc\/libvirt\/hooks\/network\r\n<\/pre>\n
With the following content:<\/span><\/span><\/p>\n
\r\n#!\/bin\/bash\r\n\r\n# Libvirt hook, see: https:\/\/www.libvirt.org\/hooks.html\r\n# for iptables reloading after host booted\r\n\r\nif [ "$2" = "started" ]; then\r\n\r\n\/bin\/systemctl restart netfilter-persistent\r\n\r\nfi;\r\n\r\nexit 0;\r\n<\/pre>\n
Add the execute bit:<\/span><\/span><\/p>\n
\r\nchmod +x \/etc\/libvirt\/hooks\/network\r\n<\/pre>\n
Now, after starting Virsh, IPTables will be restarted, thereby resetting the rules to the saved ones.<\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"
1. Preparation Install the necessary packages: Open the QEMU configuration file: And add\/edit the following line: Restart libvirt service<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[535],"tags":[525,527,529,381,533],"_links":{"self":[{"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/posts\/771"}],"collection":[{"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/artem.services\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=771"}],"version-history":[{"count":5,"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/posts\/771\/revisions"}],"predecessor-version":[{"id":777,"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/posts\/771\/revisions\/777"}],"wp:attachment":[{"href":"https:\/\/artem.services\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=771"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/artem.services\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=771"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/artem.services\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=771"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}