Bug 969510

Summary:	libvirtd fails when security_require_confined=1 even when no LXC is used at all
Product:	[Community] Virtualization Tools	Reporter:	Christoph Anton Mitterer <calestyo>
Component:	libvirt	Assignee:	Libvirt Maintainers <libvirt-maint>
Status:	CLOSED DEFERRED	QA Contact:
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	crobinso, rbalakri
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	All
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-04-09 23:33:31 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Christoph Anton Mitterer 2013-05-31 15:41:34 UTC

Hi.

With 1.0.5, when having the following lxc.conf:
security_default_confined = 1
security_require_confined = 1
everything else at defaults.

SElinux being disabled.

Starting libvirtd fails with:
2013-05-31 15:36:51.722+0000: 10040: info : libvirt version: 1.0.5
2013-05-31 15:36:51.722+0000: 10040: warning : ebiptablesDriverInitCLITools:4225 : Could not find 'ebtables' executable
2013-05-31 15:36:53.823+0000: 10040: error : virSecurityManagerNew:172 : unsupported configuration: Security driver "none" cannot create confined guests
2013-05-31 15:36:53.823+0000: 10040: error : lxcSecurityInit:1373 : Failed to initialize security drivers
2013-05-31 15:36:53.823+0000: 10040: error : virStateInitialize:837 : Initialization of LXC state driver failed
2013-05-31 15:36:53.823+0000: 10040: error : daemonRunStateInit:879 : Driver state initialization failed

Shouldn't this only fail, when there are actually any VMs using LXC (which I have not)?

Cheers,
Chris.

Comment 1 Cole Robinson 2016-04-09 23:33:31 UTC

The security manager is initialized at driver time, and your host isn't in a state to honor your explicit config request. I think failing here is fine