Bug 1597285
| Summary: | vhostuser socket creation fails due to selinux | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux Advanced Virtualization | Reporter: | Leon Goldberg <lgoldber> | |
| Component: | libvirt | Assignee: | Virtualization Maintenance <virt-maint> | |
| Status: | CLOSED DEFERRED | QA Contact: | yafu <yafu> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 8.0 | CC: | dyuan, fjin, jdenemar, libvirt-maint, lmen, rbalakri, xuzhang, yalzhang | |
| Target Milestone: | rc | |||
| Target Release: | 8.0 | |||
| Hardware: | x86_64 | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1600867 (view as bug list) | Environment: | ||
| Last Closed: | 2020-05-06 19:58:03 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 1598269, 1600867 | |||
| Bug Blocks: | ||||
This problem was discussed in bug 1478791. The solution is to let libvirt create the socket and then pass its FD to qemu. This is what 30fb2276d88 (v4.5.0-rc1~251) does. However, we had to turn the feature off because qemu has a bug when it comes to FD passing for vhostuser related chardev (ed5aa85f371aebb v4.5.0-47-ged5aa85f37). Once qemu fixes the bug we can turn the feature back on. I'll clone this bug over to qemu for them to fix it. This bug was closed deferred as a result of bug triage. Please reopen if you disagree and provide justification why this bug should get enough priority. Most important would be information about impact on customer or layered product. Please indicate requested target release. |
Description of problem: VM fails to run/vhostuser server socket creation fails due to selinux: VM nari-vm-1 is down with error. Exit message: internal error: process exited while connecting to monitor: 2018-07-01T15:48:00.679391Z qemu-kvm: -chardev socket,id=charnet0,path=/var/run/vdsm/vhostuser/dpdk-vhostuser-01560e59-bceb-476d-9210-057b75d208ef,server: Failed to bind socket to /var/run/vdsm/vhostuser/dpdk-vhostuser-01560e59-bceb-476d-9210-057b75d208ef: Permission denied. AVC's snippet: type=AVC msg=audit(1530452995.805:318): avc: denied { write } for pid=5160 comm="qemu-kvm" name="vhostuser" dev="tmpfs" ino=17292 scontext=system_u:system_r:svirt_t:s0:c285,c817 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir type=USER_AVC msg=audit(1530460080.361:618): pid=777 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.login1.Manager member=Inhibit dest=org.freedesktop.login1 spid=5155 tpid=817 scontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:systemd_logind_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=AVC msg=audit(1530460080.677:634): avc: denied { write } for pid=23049 comm="qemu-kvm" name="vhostuser" dev="tmpfs" ino=17292 scontext=system_u:system_r:svirt_t:s0:c216,c1000 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir type=USER_AVC msg=audit(1530460209.600:686): pid=777 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.login1.Manager member=Inhibit dest=org.freedesktop.login1 spid=5155 tpid=817 scontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:systemd_logind_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=USER_AVC msg=audit(1530460209.602:687): pid=777 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.56 spid=817 tpid=5155 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=AVC msg=audit(1530460209.602:688): avc: denied { write } for pid=5155 comm="virtlogd" path="/run/systemd/inhibit/7.ref" dev="tmpfs" ino=674634 scontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_logind_inhibit_var_run_t:s0 tclass=fifo_file type=AVC msg=audit(1530460209.891:703): avc: denied { write } for pid=23376 comm="qemu-kvm" name="vhostuser" dev="tmpfs" ino=17292 scontext=system_u:system_r:svirt_t:s0:c837,c1004 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir type=AVC msg=audit(1530460209.891:703): avc: denied { add_name } for pid=23376 comm="qemu-kvm" name="dpdk-vhostuser-01560e59-bceb-476d-9210-057b75d208ef" scontext=system_u:system_r:svirt_t:s0:c837,c1004 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir type=AVC msg=audit(1530460209.891:703): avc: denied { create } for pid=23376 comm="qemu-kvm" name="dpdk-vhostuser-01560e59-bceb-476d-9210-057b75d208ef" scontext=system_u:system_r:svirt_t:s0:c837,c1004 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=sock_file type=AVC msg=audit(1530531523.928:1831): avc: denied { write } for pid=23376 comm="qemu-kvm" name="vhostuser" dev="tmpfs" ino=17292 scontext=system_u:system_r:svirt_t:s0:c837,c1004 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir type=AVC msg=audit(1530531523.928:1831): avc: denied { remove_name } for pid=23376 comm="qemu-kvm" name="dpdk-vhostuser-01560e59-bceb-476d-9210-057b75d208ef" dev="tmpfs" ino=698774 scontext=system_u:system_r:svirt_t:s0:c837,c1004 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir type=AVC msg=audit(1530531523.928:1831): avc: denied { unlink } for pid=23376 comm="qemu-kvm" name="dpdk-vhostuser-01560e59-bceb-476d-9210-057b75d208ef" dev="tmpfs" ino=698774 scontext=system_u:system_r:svirt_t:s0:c837,c1004 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=sock_file type=USER_AVC msg=audit(1530531539.544:1866): pid=777 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.login1.Manager member=Inhibit dest=org.freedesktop.login1 spid=5155 tpid=817 scontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:systemd_logind_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=AVC msg=audit(1530531539.792:1879): avc: denied { write } for pid=30701 comm="qemu-kvm" name="vhostuser" dev="tmpfs" ino=17292 scontext=system_u:system_r:svirt_t:s0:c623,c664 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir Version-Release number of selected component (if applicable): libvirt-3.9.0-14.el7_5.5.x86_64 How reproducible: 100% Steps to Reproduce: Create a VM with vhostuser in server mode. Actual results: VM fails to run. Expected results: VM runs.