Bug 630625

Summary: Tunnelled migration doesn't work in RHEL 6.0 without increasing security risk
Product: Red Hat Enterprise Linux 5 Reporter: Jiri Denemark <jdenemar>
Component: libvirtAssignee: Jiri Denemark <jdenemar>
Status: CLOSED NEXTRELEASE QA Contact: Virtualization Bugs <virt-bugs>
Severity: low Docs Contact:
Priority: medium    
Version: 5.6CC: dyuan, eblake, mjenner, pbonzini, roland.friedwagner, theo_nra, veillard, virt-maint, xen-maint, yimwang
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: libvirt-0.8.2-4.el5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 624062
: 643842 (view as bug list) Environment:
Last Closed: 2010-11-24 18:32:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 643842    
Bug Blocks:    

Description Jiri Denemark 2010-09-06 12:45:40 UTC
+++ This bug was initially created as a clone of Bug #624062 +++

Description of problem:

Clone of a corresponding bug fixed in RHEL-6...

Due a bug in the location of a socket file with libvirt, tunnelled migration to move a virtual machine from one host server to another doesn't work in RHEL 6.0.

There *is* a workaround, of changing the process ownership of QEMU from the default qemu:qemu:, to root:root, however this introduces potential security risk.

Chris Lalancette has created (very simple) working patches upstream, which allow tunnelled migration to work properly out of the box.  (No change to root:root ownership needed)

Comment 1 Jiri Denemark 2010-09-13 21:55:24 UTC
Fix built into libvirt-0.8.2-4.el5

Comment 3 dyuan 2010-10-12 03:13:17 UTC
The default ownership of QEMU is root:root on RHEL5.6, it's different from rhel6.

When I change the user & group to qemu in /etc/libvirt/qemu.conf manually, the libvirtd start failed with the following error in /var/log/messages:

Oct 12 11:11:35 dhcp-93-197 libvirtd: 11:11:35.264: warning : qemudStartup:1656 : Unable to create cgroup for driver: No such device or address 
Oct 12 11:11:35 dhcp-93-197 libvirtd: 11:11:35.265: error : virGetUserID:2692 : Failed to find user record for name 'qemu': Success 
Oct 12 11:11:35 dhcp-93-197 libvirtd: 11:11:35.265: error : virStateInitialize:980 : Initialization of QEMU state driver failed 
Oct 12 11:11:35 dhcp-93-197 libvirtd: 11:11:35.265: error : main:3242 : Driver state initialization failed 
Oct 12 11:11:35 dhcp-93-197 libvirtd: 11:11:35.266: warning : qemudDispatchSignalEvent:396 : Shutting down on signal 3 

We can only test the tunnelled migration with root:root on rhel5.6 now.

Comment 4 Jiri Denemark 2010-10-12 08:07:19 UTC
Can you confirm user 'qemu' exists on your system? The error message there is not very helpful in this case :-)

Comment 6 wangyimiao 2010-10-18 02:59:14 UTC
Hi 'JD',

 I use "libvirt-0.8.2-7.el5.x86_64" to test again ,I can not migrate successfully with '--tunnelled'.

It very strange ,in a new enviroment with "libvirt-0.8.2-6.el5",I can not migrate successfully as the result of comment 5 .

Issue:At source host,after a long time command will not exits and give a error message .At target host domain "mig" will keep “paused” statu

Steps:
host A:
1.vim /etc/exports
/var/lib/libvirt/images 10.66.93.197/16(rw,no_root_squash)
2. service nfs restart
3. mount 10.66.93.197:/var/lib/libvirt/images/ /mnt

host B:
4. mount 10.66.93.197:/var/lib/libvirt/images/ /mnt
5. cd /mnt
6. virt-install -n mig -r 1024 -f rhel55.img --import
the guest should boot completely.
7. ssh-keygen -t rsa
8. ssh-copy-id -i ~/.ssh/id_rsa.pub root.93.197
9. virsh migrate --live mig qemu+ssh://10.66.93.197/system --tunnelled --p2p

Issue:At source host,after a long time command will not exits and give a error message .At target host domain "mig" will keep “paused” status.

Comment 7 Jiri Denemark 2010-10-18 09:52:37 UTC
Hmm, this is another and more serious bug, the tunnelled migration doesn't work at all on 5.6. I made a new bug 643842 to track that issue. Changing this bz back to ON_QA since it should be fixed, it's just untestable before 643842 is fixed.

Comment 8 Jiri Denemark 2010-11-24 18:32:04 UTC
This is untestable with current state of qemu-kvm but the fix is included in libvirt package anyway so I'm closing this as NEXTRELEASE