Bug 826539

Summary: virt-sandbox broken
Product: [Fedora] Fedora Reporter: Ralf Baechle <ralf>
Component: libvirt-sandboxAssignee: Daniel Berrangé <berrange>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 17CC: abo, berrange, crobinso, dwalsh, maci, ralf
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-07-11 18:51:20 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Ralf Baechle 2012-05-30 13:03:33 UTC
Description of problem:

virt-sandbox seems completly broken as packaged in Fedora 17.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. virt-sandbox -c lxc:/// /bin/sh
2. virt-sandbox -c qemu:///session  /bin/date

(Any other invocation I tried is also broken.)
  
Actual results:

For 1) with SELinux enforcement enabled:

Unable to start sandbox: Failed to create domain: Failed to connect to client socket: Permission denied

For 1) with SELinux enforcment disabled:

Unable to start sandbox: Failed to create domain: internal error guest failed to start: PATH=/bin:/sbin TERM=linux container=lxc-libvirt container_uuid=3596df5c-9f32-6cf5-cf7a-43da58f165e4 LIBVIRT_LXC_UUID=3596df5c-9f32-6cf5-cf7a-43da58f165e4 LIBVIRT_LXC_NAME=sandbox /usr/libexec/libvirt-sandbox-init-lxc
2012-05-30 12:58:38.931+0000: 1: info : libvirt version: 0.9.11.3, package: 1.fc17 (Fedora Project, 2012-04-27-21:26:56, x86-06.phx2.fedoraproject.org)
2012-05-30 12:58:38.931+0000: 1: error : lxcContainerMountBasicFS:473 : Failed to mkdir /selinux: Read-only file system
2012-05-30 12:58:38.931+0000: 13022: info : libvirt version: 0.9.11.3, package: 1.fc17 (Fedora Project, 2012-04-27-21:26:56, x86-06.phx2.fedoraproject.org)
2012-05-30 12:58:38.931+0000: 13022: error : lxcControllerRun:1569 : error receiving signal from container: Input/output error


For 2) with SELinux enforcement enabled:

Unable to start sandbox: Failed to create domain: internal error Process exited while reading console log output: char device redirected to /dev/pts/43
char device redirected to /dev/pts/44
qemu: could not load kernel '/boot/vmlinuz-3.3.7-1.fc16.x86_64': Permission denied

(/boot/vmlinuz-3.3.7-1.fc16.x86_64 on the host exists with mode 755.)

For 2) with SELinux enforcement disabled:
Unable to start sandbox: Failed to create domain: internal error process exited while connecting to monitor: char device redirected to /dev/pts/43
char device redirected to /dev/pts/44
Virtio-9p Failed to initialize fs-driver with id:fsdev-fs1 and export path:/root/.cache/libvirt-sandbox/sandbox/config
2012-05-30 13:00:38.405+0000: shutting down

Expected results:


Additional info:

Comment 1 Alexander Boström 2012-06-06 12:57:24 UTC
I opened bug 829313 for the qemu-kvm vs. vmlinuz problem.

Comment 2 Alexander Boström 2012-06-20 21:22:37 UTC
Looks related: https://www.redhat.com/archives/libvir-list/2012-May/msg01352.html

Comment 3 Daniel Berrangé 2012-06-21 10:18:15 UTC
That patch was fixing a flaw that was only present in the GIT snapshot, not the 0.0.3 release in Fedora.

First of all, it is expected that you see failures when SELinux is enforcing - we didn' t get the policy completed.

It should however be working when used with SELinux permissive.

I'm not sure why the LXC case failed for you, so will have to look into that.

WRT to the KVM case though, I believe the issue is that /root is only readable by the 'root:root' user, and KVM runs as 'qemu:qemu' by default.   I had not been testing the libvirt-sandbox KVM driver as root - I always used my own unprivileged user account, where we don't face this permissions problem because QEMU runas the same user account. So if you tried virt-sandbox -c qemu:///session as a non-root user you ought to have more luck.

The latest GIT version of libirt-sandbox has switched to using /var for the root user, but we need todo some more work to ensure everything is readable by the QEMU user.

Comment 4 Marcel Wysocki 2012-11-15 15:04:13 UTC
same problem here:

[root@nb0815 marcel]# getenforce 
Permissive


[root@nb0815 marcel]# yum list installed |grep sandbox
libvirt-sandbox.x86_64          0.0.3-2.fc17        @updates                    
libvirt-sandbox-libs.x86_64     0.0.3-2.fc17        @updates                    
policycoreutils-sandbox.x86_64  2.1.12-5.fc17       @updates-testing     

[root@nb0815 marcel]# yum list installed |grep libvirt
libvirt.x86_64                  0.9.11.7-1.fc17     @updates-testing            
libvirt-client.x86_64           0.9.11.7-1.fc17     @updates-testing            
libvirt-daemon.x86_64           0.9.11.7-1.fc17     @updates-testing            
libvirt-daemon-config-network.x86_64
libvirt-daemon-config-nwfilter.x86_64
libvirt-daemon-lxc.x86_64       0.9.11.7-1.fc17     @updates                    
libvirt-gconfig.x86_64          0.0.8-1.fc17        @updates                    
libvirt-glib.x86_64             0.0.8-1.fc17        @updates                    
libvirt-gobject.x86_64          0.0.8-1.fc17        @updates                    
libvirt-python.x86_64           0.9.11.7-1.fc17     @updates-testing            
libvirt-sandbox.x86_64          0.0.3-2.fc17        @updates                    
libvirt-sandbox-libs.x86_64     0.0.3-2.fc17        @updates                

[root@nb0815 marcel]# yum list installed |grep lxc
libvirt-daemon-lxc.x86_64       0.9.11.7-1.fc17     @updates                    
lxc.x86_64                      0.7.5-1.fc17        @fedora                     
lxc-libs.x86_64                 0.7.5-1.fc17        @fedora                     

[root@nb0815 marcel]# virt-sandbox -v -c lxc:/// /bin/date
Unable to start sandbox: Failed to create domain: internal error guest failed to start: PATH=/bin:/sbin TERM=linux container=lxc-libvirt container_uuid=15c3762c-fda2-1e9d-cb47-102fbabe3207 LIBVIRT_LXC_UUID=15c3762c-fda2-1e9d-cb47-102fbabe3207 LIBVIRT_LXC_NAME=sandbox /usr/libexec/libvirt-sandbox-init-lxc
2012-11-15 15:02:24.864+0000: 1: info : libvirt version: 0.9.11.7, package: 1.fc17 (Fedora Project, 2012-10-27-22:08:08, )
2012-11-15 15:02:24.864+0000: 1: error : lxcContainerMountBasicFS:473 : Failed to mkdir /selinux: Read-only file system
2012-11-15 15:02:24.865+0000: 15080: info : libvirt version: 0.9.11.7, package: 1.fc17 (Fedora Project, 2012-10-27-22:08:08, )
2012-11-15 15:02:24.865+0000: 15080: error : lxcControllerRun:1571 : error receiving signal from container: Input/output error


[root@nb0815 marcel]# virt-sandbox -v -c qemu:///session /bin/date
Unable to start sandbox: Failed to create domain: internal error Process exited while reading console log output: char device redirected to /dev/pts/19
char device redirected to /dev/pts/20
Virtio-9p Failed to initialize fs-driver with id:fsdev-fs1 and export path:/root/.cache/libvirt-sandbox/sandbox/config

Comment 5 Fedora End Of Life 2013-07-03 20:01:30 UTC
This message is a reminder that Fedora 17 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 17. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '17'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 17's end of life.

Bug Reporter:  Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 17 is end of life. If you 
would still like  to see this bug fixed and are able to reproduce it 
against a later version  of Fedora, you are encouraged  change the 
'version' to a later Fedora version prior to Fedora 17's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 6 Cole Robinson 2013-07-11 18:51:20 UTC
Given that F17 is approaching end of life, this is unlikely to be fixed. libvirt-sandbox has seen many improvements by F19, so please try there and reopen if you can still reproduce.