Bug 1889885

Summary: libvirt container internal error cannot execute binary /usr/libexec/qemu-kvm permission denied
Product: Red Hat OpenStack Reporter: Alistair Tonner <atonner>
Component: openstack-novaAssignee: nova-maint
Status: CLOSED NOTABUG QA Contact: nova-maint
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 16.1 (Train)CC: dasmith, eglynn, fpalin, jhakimra, kchamart, lyarwood, sbauza, sgordon, stephenfin, vromanso
Target Milestone: ---Keywords: SELinux
Target Release: ---Flags: kchamart: needinfo? (atonner)
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-12-04 15:12:54 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Alistair Tonner 2020-10-20 19:47:59 UTC 
Description of problem:
  QE jenkins job run failed to deploy nova instance post overcloud deployment.
  libvirtd container log showed permission denied for qemu-kvm.


Version-Release number of selected component (if applicable):
core puddle:  RHOS-16.1-RHEL-8-20201007.n.0
container-selinux.noarch                      2:2.124.0-1.module+el8.2.0+6368+cf16aa14        @rhosp-rhel-8.2-appstream
libselinux.x86_64                             2.9-3.el8                                       @anaconda
libselinux-ruby.x86_64                        2.9-3.el8                                       @rhosp-rhel-8.2-appstream
libselinux-utils.x86_64                       2.9-3.el8                                       @anaconda
openstack-selinux.noarch                      0.8.24-1.20200914163011.26243bf.el8ost          @rhelosp-16.1
openvswitch-selinux-extra-policy.noarch       1.0-22.el8fdp                                   @rhosp-rhel-8.2-fdp
puppet-nova.noarch                            15.6.1-1.20200814103355.51a6857.el8ost          @rhelosp-16.1
python3-libselinux.x86_64                     2.9-3.el8                                       @anaconda
python3-novaclient.noarch                     1:15.1.1-0.20200629073413.79959ab.el8ost        @rhelosp-16.1
rpm-plugin-selinux.x86_64                     4.14.2-37.el8                                   @anaconda
selinux-policy.noarch                         3.14.3-41.el8_2.6                               @rhosp-rhel-8.2-baseos
selinux-policy-targeted.noarch                3.14.3-41.el8_2.6                               @rhosp-rhel-8.2-baseos

containers tag: 16.1_20201007.2


How reproducible:

  At least the last 3 runs of this job have hit this.

Steps to Reproduce:
1. Deploy stack with 3 controllers, 1 compute, deploy project instance on compute node
2.
3.

Actual results:

instance fails to deploy on compute instance, libvirtd container log shows permission denied

Expected results:

instance deploys successfully.

Additional info:
Comment 2 Artom Lifshitz 2020-10-21 21:53:11 UTC 
I'm going to say the same thing I said in https://bugzilla.redhat.com/show_bug.cgi?id=1869503#c3:

Is this the same as BZ1841822, or a new bug? Can you double the version of t-h-t used to deploy the environment, and whether it's earlier or later than openstack-tripleo-heat-templates-10.6.3-0.20200113185561.cf467ea?
Comment 3 Alistair Tonner 2020-10-22 12:47:56 UTC 
(In reply to Artom Lifshitz from comment #2)
> I'm going to say the same thing I said in
> https://bugzilla.redhat.com/show_bug.cgi?id=1869503#c3:
> 
> Is this the same as BZ1841822, or a new bug? Can you double the version of
> t-h-t used to deploy the environment, and whether it's earlier or later than
> openstack-tripleo-heat-templates-10.6.3-0.20200113185561.cf467ea?

Artom:
openstack-tripleo-heat-templates-11.3.2-1.20200914170156.el8ost.noarch
Comment 5 Stephen Finucane 2020-11-02 16:20:25 UTC 
What version of podman and RHEL is the affected host using?
Comment 6 Alistair Tonner 2020-11-02 18:10:03 UTC 
Stephen:
  
undercloud is running:
podman-1.6.4-16.module+el8.2.0+7659+b700d80e.x86_64
and RHEL redhat-release-8.2-1.0.el8.x86_64 (as are the nodes)