Bug 716612

Summary: Failed to reload iptables rules with root permission when starting libvirtd in the way of executing /usr/sbin/libvirtd
Product: Red Hat Enterprise Linux 6 Reporter: Gunannan Ren <gren>
Component: libvirtAssignee: Laine Stump <laine>
Status: CLOSED NOTABUG QA Contact: Virtualization Bugs <virt-bugs>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.2CC: dallan, dwalsh, gsun, rwu
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: sVirt
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-09-13 02:48:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
libvirtd.log
none
audit.log none

Description Gunannan Ren 2011-06-25 13:44:39 UTC 
Description of problem:
Stopped libvirtd service, then executed the /usr/sbin/libvirtd to start the libvirtd as the foreground process. it failed to reload iptables rules. In the libvirtd.log it showed error as the follows.

21:51:55.634: 11972: debug : virCommandRunAsync:1310 : About to run /sbin/iptables --table nat --delete POSTROUTING --source 192.168.122.0/24 -p tcp ! --destination 192.168.122.0/24 --jump MASQUERADE --to-ports 1024-65535
21:51:55.634: 11972: debug : virExecWithHook:488 : /sbin/iptables --table nat --delete POSTROUTING --source 192.168.122.0/24 -p tcp ! --destination 192.168.122.0/24 --jump MASQUERADE --to-ports 1024-65535
21:51:55.634: 11972: debug : virCommandRunAsync:1326 : Command result 0, with PID 11979
21:51:55.638: 11972: error : virCommandWait:1393 : internal error Child process (/sbin/iptables --table nat --delete POSTROUTING --source 192.168.122.0/24 -p tcp ! --destination 192.168.122.0/24 --jump MASQUERADE --to-ports 1024-65535) status unexpected: exit status 1
21:51:55.638: 11972: debug : virCommandRun:1147 : Result status 0, stdout: '' stderr: '21:51:55.635: 11979: info : libvirt version: 0.9.2, package: 1.el6 (Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>, 2011-06-20-09:08:08, hs20-bc2-5.build.redhat.com)
21:51:55.635: 11979: debug : virCommandHook:1244 : Hook is done 0
libvir: error : cannot execute binary /sbin/iptables: Permission denied

I tried to set selinux to "Permissive", then checking out the log again, it showed information without errors.

Version-Release number of selected component (if applicable):

libvirt-0.9.2-1.el6.x86_64.rpm

How reproducible:

always

Steps to Reproduce:
1. service libvirtd stop
2. /usr/sbin/libvirtd
3. checkout the libvirtd log
  
Actual results:

Reloading iptables rules failed with permission denied.

Expected results:

success to reload

Additional info:
Comment 1 Gunannan Ren 2011-06-25 13:46:02 UTC 
Created attachment 509895 [details]
libvirtd.log
Comment 2 Gunannan Ren 2011-06-25 13:46:35 UTC 
Created attachment 509896 [details]
audit.log
Comment 4 Laine Stump 2011-09-09 16:38:00 UTC 
Dan - is this expected behavior (libvirtd run from a shell prompt failing to exec iptables, while libvirtd run with /etc/init.d/libvirtd start succeeds)?
Comment 5 Daniel Walsh 2011-09-12 19:42:30 UTC 
If you run libvirtd directly it will not transition to the proper domain (virtd_t) and will stay in unconfined_t,  Thus when libvirt attempts to transition to other domains, it blows up with these errors.  We always recommend confined services be run from the init scripts to mimic what happens in the real world.

http://danwalsh.livejournal.com/20210.html
Comment 6 Laine Stump 2011-09-13 02:48:50 UTC 
Based on Dan's explanation, I'm closing this as NOTABUG - this is expected behavior.