Bug 1177318

Summary: Guest using rbd based image as disk failed to start when sandbox was enabled
Product: Red Hat Enterprise Linux 7 Reporter: Yang Yang <yanyang>
Component: qemu-kvmAssignee: Miroslav Rezanina <mrezanin>
Status: CLOSED ERRATA QA Contact: FuXiangChun <xfu>
Severity: high Docs Contact:
Priority: high    
Version: 7.1CC: dyuan, huding, juzhang, knoel, lhuang, mzhan, pmoore, rbalakri, virt-bugs, virt-maint, xfu, xuzhang
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: qemu-kvm-1.5.3-112.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 1177309 Environment:
Last Closed: 2016-11-03 19:59:49 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1177309    
Bug Blocks: 1288337    

Description Yang Yang 2014-12-26 05:31:26 UTC
+++ This bug was initially created as a clone of Bug #1177309 +++

Description of problem:
Guest using rbd based image as disk failed to start when sandbox was enabled

Version-Release number of selected component (if applicable):
libvirt-1.2.8-11.el7.x86_64
qemu-kvm-1.5.3-84.el7.x86_64
3.10.0-219.el7.x86_64
librados2-0.80.7-2.el7.x86_64
librbd1-0.80.7-2.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
1.try to start vm with sandbox enabled
# /usr/libexec/qemu-kvm -drive file=rbd:libvirt-pool/yy1.img:auth_supported=none:mon_host=$ip,if=none,id=drive-virtio-disk1,rerror=stop,format=raw,werror=stop -device virtio-blk-pci,drive=drive-virtio-disk1,id=sys-img -monitor stdio -spice port=5931,disable-ticketing -boot menu=on -m 2G -sandbox on 


Actual results:
qemu hang 

Expected results:


Additional info:
from audit.log:

type=SECCOMP msg=audit(1419517736.701:315758): auid=0 uid=0 gid=0 ses=1227 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=19319 comm="qemu-kvm" sig=31 arch=c000003e syscall=99 compat=0 ip=0x7ffff0a7bae7 code=0x0

lhuang found that qemu uses seccomp_sandbox and set white system call list in qemu-seccomp.c.

and when qemu call rados_connect(not a qemu func) in qemu_rbd_open, and after a loooot of func,
GiveSystemInfo use sysinfo which is not in seccomp_whitelist[].
so qemu-kvm have been killed because use a syscall out of whitelist.

--- Additional comment from RHEL Product and Program Management on 2014-12-25 22:58:13 EST ---

Since this bug report was entered in bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.

Comment 3 Jun Li 2015-01-05 02:33:37 UTC
FYI, could ref https://bugzilla.redhat.com/show_bug.cgi?id=1177309#c3

Comment 4 Paul Moore 2015-01-05 20:29:06 UTC
For reference, syscall 99 on x86_64 is sysinfo(2):

 # scmp_sys_resolver -a x86_64 99
 sysinfo

Comment 7 Miroslav Rezanina 2015-09-08 08:41:09 UTC
We have to whitelist sysinit call to be able to use rbd in sandbox mode. Moving to 7.3 as we won't be able to fix this in 7.2 timeframe.

Comment 9 Miroslav Rezanina 2016-05-16 08:06:32 UTC
Fix included in qemu-kvm-1.5.3-112.el7

Comment 11 FuXiangChun 2016-09-06 14:27:44 UTC
reproduced this bug with qemu-kvm-1.5.3-110.el7.x86_64

/usr/libexec/qemu-kvm -drive file=rbd:libvirt-pool/rhel.raw:mon_host=10.66.144.26,if=none,id=drive-virtio-disk1,rerror=stop,format=raw,werror=stop -device virtio-blk-pci,drive=drive-virtio-disk1,id=sys-img -monitor stdio -boot menu=on -m 2G -vnc :1 -sandbox on

result:
qemu-kvm hang.

#tail -f /var/log/audit/audit.log

type=SECCOMP msg=audit(1473171908.568:9688): auid=0 uid=0 gid=0 ses=1286 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=32848 comm="qemu-kvm" sig=31 arch=c000003e syscall=99 compat=0 ip=0x7f2b32bf8077 code=0x0

verified the bug with qemu-kvm-1.5.3-122.el7.x86_64. 

guest works well.

Comment 13 errata-xmlrpc 2016-11-03 19:59:49 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2585.html