Bug 2057310

Summary:	qemu-guest-agent does not report information due to selinux denials
Product:	Container Native Virtualization (CNV)	Reporter:	Roni Kishner <rkishner>
Component:	Documentation	Assignee:	Shikha Jhala <sjhala>
Status:	CLOSED ERRATA	QA Contact:	Roni Kishner <rkishner>
Severity:	high	Docs Contact:
Priority:	high
Version:	4.10.0	CC:	apinnick, berrange, cfergeau, cnv-qe-bugs, crobinso, ctomasko, dholler, dwalsh, extras-qa, gkapoor, grepl.miroslav, lvrabec, mmalik, omosnace, ondrejj, pbonzini, philmd, pkoncity, rjones, virt-maint, vmojzis, ycui, zpytela
Target Milestone:	---
Target Release:	4.11.0
Hardware:	Unspecified
OS:	Linux
Whiteboard:	docscope 4.10 or 4.11
Fixed In Version:		Doc Type:	Known Issue
Doc Text:	The qemu-guest-agent on a Fedora 35 virtual machine is blocked by SELinux and does not report data. Other Fedora versions might be affected. As a workaround, disable SELinux on the virtual machine, run the qemu-guest-agent commands, and then renable SELinux.	Story Points:	---
Clone Of:	2028762	Environment:
Last Closed:	2022-09-14 19:28:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2028762
Bug Blocks:

Description Roni Kishner 2022-02-23 07:54:40 UTC

+++ This bug was initially created as a clone of Bug #2028762 +++

Reason of cloning: we would like to follow this bug from CNV side since CNV should support fedora 35 fully.
 
Description of problem:


Version-Release number of selected component (if applicable):

> qemu-guest-agent.x86_64                       2:6.1.0-5.fc35                 @anaconda


How reproducible:

Create a fedora 35 VM and query through qemu for information

Query the guest-agent through libvirt/qemu.

Steps to Reproduce:
1. Create a fedora 35 VM
2. Execute on virt_launcher_pod "virsh qemu-agent-command <vm_namespace>_<pod_name> guest-get-fsinfo

Actual results:


The guest agent is missing data due to selinux issues: https://github.com/kubevirt/kubevirt/issues/6857#issuecomment-985109786

Disabling selinux makes it work again.



Expected results:

qemu-guest-agent should be able to report all data by default without getting denies by selinux.

Comment 1 Geetika Kapoor 2022-02-23 12:57:34 UTC

There is a flow that QE used to test : https://polarion.engineering.redhat.com/polarion/#/project/CNV/workitem?id=CNV-3574 but this is now broken if selinux is enabled. 
It would be good to document it so that we can avoid future support cases or customer/internal queries related to it.

Comment 10 Shikha Jhala 2022-07-27 19:51:18 UTC

@rkishner Can you please review this release note PR: https://github.com/openshift/openshift-docs/pull/48328. Thank you.

Comment 11 Roni Kishner 2022-07-28 06:15:29 UTC

Seems good. Thanks

Comment 12 Shikha Jhala 2022-07-28 13:17:54 UTC

Thanks @rkishner. Can you please move this bug to Verified status?

Comment 15 errata-xmlrpc 2022-09-14 19:28:43 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: OpenShift Virtualization 4.11.0 Images security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:6526