Bug 1009977 - 60+ second delay when launching a LXC container in 6.4
60+ second delay when launching a LXC container in 6.4
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
6.4
All Linux
high Severity high
: rc
: ---
Assigned To: Miroslav Grepl
Michal Trunecka
: ZStream
Depends On:
Blocks: 1017908
  Show dependency treegraph
 
Reported: 2013-09-19 11:51 EDT by Daniel Berrange
Modified: 2014-09-30 19:35 EDT (History)
9 users (show)

See Also:
Fixed In Version: selinux-policy-3.7.19-217.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-11-21 05:52:21 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2013:1598 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2013-11-20 16:39:24 EST

  None (edit)
Description Daniel Berrange 2013-09-19 11:51:46 EDT
Description of problem:
Any attempt to launch an LXC container is met with a 60+ second delay

Debugging found that the delay occurs when libvirt spawns the libvirt_lxc process.

Further debugging shows that the libvirt_lxc process is waiting on execution of

  /bin/sh /usr/bin/pm-is-supported --suspend-hybrid

(or the same command with different --suspend args).

This is being run to initialize the capabilities.

The pm-is-supported program uses dbus to talk to hal, and it never gets a reply from hal, so suffers from the dbus message reply timeout (30 seconds IIRC)


In 6.4 the SELinux policy for libvirt_lxc was applied, so it runs in a context 

  unconfined_u:system_r:virtd_lxc_t:s0-s0:c0.c1023

And it seems this is blocked from communicating with hal


type=USER_AVC msg=audit(1379605503.647:24171): user pid=1262 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.86 spid=13198 tpid=6431 scontext=unconfined_u:system_r:hald_t:s0 tcontext=unconfined_u:system_r:virtd_lxc_t:s0-s0:c0.c1023 tclass=dbus  exe="/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'


This delay isn't seen in Fedora, but then Fedora doesn't use HAL anymore, so probably avoids the issue.


Version-Release number of selected component (if applicable):
# rpm -q libvirt selinux-policy
libvirt-0.10.2-18.el6_4.9.x86_64
selinux-policy-3.7.19-195.el6_4.12.noarch


How reproducible:
Always, if SELinux is enforcing and libvirtd is confined

Steps to Reproduce:
1. Install RHEL-6.4
2. Install libvirtd and run it 'service libvirtd start' (NB, must be run via 'service' to gain correct selinux context).
3. # virt-install  --connect lxc:/// --name lxcsh  --nodisks --ram 100  --init /bin/sh

Actual results:
60+ second delay in virt-install

Expected results:
Instant creation fo container.

Additional info:
Comment 3 Daniel Walsh 2013-09-19 12:30:10 EDT
fcdd9a1f92bd8846ab5ceca12b4479462e0dbf9c fixes this in git.

Miroslav can we squeeze this into 6.5?
Comment 10 errata-xmlrpc 2013-11-21 05:52:21 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1598.html

Note You need to log in before you can comment on or make changes to this bug.