Hide Forgot
Description of problem: Fail to start lxc with disabled selinux due to the existed empaty /selinux Version-Release number of selected component (if applicable): libvirt-0.10.2-29.el6.x86_64 qemu-kvm-rhev-0.12.1.2-2.415.el6.x86_64 kernel-2.6.32-429.el6.x86_64 selinux-policy-3.7.19-231.el6.noarch How reproducible: 100% Steps to Reproduce: 1. #getenforce Enforcing There is a dir /selinux , generated by the system 2.Disabled selinux # cat /etc/selinux/config | grep disabled # disabled - No SELinux policy is loaded. SELINUX=disabled #reboot 3.After that , the selinux DOESN't remove the dir /selinux but clean all content in it. #ll -a /selinux/ total 8 drwxr-xr-x. 2 root root 4096 Oct 12 11:28 . dr-xr-xr-x. 25 root root 4096 Oct 12 13:52 .. 4.This lead to lxc fail to start: #virsh -c lxc:/// start toy error: Failed to start domain toy error: internal error guest failed to start: PATH=/bin:/sbin TERM=linux container=lxc-libvirt container_uuid=bb428983-cb9f-4702-0f8d-7d4e143d9aad LIBVIRT_LXC_UUID=bb428983-cb9f-4702-0f8d-7d4e143d9aad LIBVIRT_LXC_NAME=toy /bin/sh error receiving signal from container: Input/output error 5. If remove the dir , everthing will be fine. And on rhel7 , there is no /selinux , so it has not effect. Expected results: Lxc started Additional info:
Please attach both daemon and machine logs, thanks.
This should be fixed upstream with commit v1.1.4-22-g9ecbd38: commit 9ecbd38c4c4a582bc17749b97c4641ee80f42d75 Author: Daniel P. Berrange <berrange> Date: Mon Oct 7 13:12:15 2013 +0100 Skip any files which are not mounted on the host
Created attachment 867312 [details] system log
Created attachment 867313 [details] libvirtd log
Created attachment 867314 [details] lxc log
logs generated basing on libvirt-0.10.2-29.el6_5.4.x86_64 kernel-2.6.32-431.5.1.el6.x86_64 selinux-policy-3.7.19-231.el6.noarch
Thank you very much, that confirms my hypothesis.
This bug was not selected to be addressed in Red Hat Enterprise Linux 6. We will look at it again within the Red Hat Enterprise Linux 7 product.
In RHEL7 this can't be reproduced. So, I would change this to verified status
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0323.html