Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
+++ This bug was initially created as a clone of Bug #1066280 +++
Description of problem:
Fail to restore guest from the save file while the save file located in the root directory, also
have set the static selinux lable for the guest and set the relabel='no' in the guest's xml
Version-Release number of selected component (if applicable):
kernel-3.10.0-88.el7.x86_64
qemu-kvm-rhev-1.5.3-47.el7.x86_64
libvirt-1.1.1-23.el7.x86_64
libselinux-2.2.2-6.el7.x86_64
selinux-policy-3.12.1-125.el7.noarch
How reproducible:
100%
Steps
1.# getenforce
Enforcing
2.Prepare a normal guest,add the following xml to the guest'xml
--
--
<seclabel type='static' model='selinux' relabel='no'>
<label>system_u:system_r:svirt_t:s0:c311,c611</label>
</seclabel>
--
3.Change the guest image's lable which should be the same with the step2
#chcon system_u:object_r:svirt_image_t:s0:c311,c611 /var/lib/libvirt/images/rhel7.img
# ll -Z /var/lib/libvirt/images/rhel7raw.img
-rw-------. root root system_u:object_r:svirt_image_t:s0:c311,c611 /var/lib/libvirt/images/rhel7.img
4.Start the guest
# virsh start rhel7
Domain rhel7 started
5.Save the guest to the root directory while the guest start completely
# virsh save rhel7 rhel7.save
Domain rhel7 saved to rhel7.save
6.Restore the guest, will report the following error
# virsh restore rhel7.save
error: Failed to restore domain from rhel7.save
error: internal error: early end of file from monitor: possible problem:
load of migration failed
7.Check the audit.log info
# ausearch -m avc -ts recent
time->Mon Feb 17 17:34:23 2014
type=SYSCALL msg=audit(1392629663.465:198): arch=c000003e syscall=59 success=yes exit=0 a0=7f4af000b1c0 a1=7f4af000bbe0 a2=7f4af000b1e0 a3=8 items=0 ppid=1 pid=11010 auid=4294967295 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=4294967295 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c311,c611 key=(null)
type=AVC msg=audit(1392629663.465:198): avc: denied { read } for pid=11010 comm="qemu-kvm" path="/root/rhel7.save" dev="sda1" ino=137136833 scontext=system_u:system_r:svirt_t:s0:c311,c611 tcontext=system_u:object_r:admin_home_t:s0 tclass=file
8.The virsh restore opertion can be operated successfully if i copy the save file in step5 to another directory, such as /tmp
#cp test.save /tmp/test.save
#virsh restore /tmp/test.save
Domain restored from /tmp/rhel7.save
9.The step6 can be operated successfully if i use the default dynamic selinux label
I got a little different result while operation the steps in bug 1066280 in rhel6.5.z, the guest can restored, however the guest would stay in paused status after we restored the guest from the save file, moreover it will report error while we resume the guest
pkginfo
libvirt-0.10.2-29.el6_5.4.x86_64
qemu-kvm-rhev-0.12.1.2-2.415.el6_5.4.x86_64
kernel-2.6.32-440.el6.x86_64
selinux-policy-3.7.19-231.el6.noarch
steps
1.Excute step 1~5 in comment0 in rhel6.5.z host
2.Restore the guest, didn't get error , however the guest was stay in paused status and it will report error if i resume it
# virsh restore test.save
Domain restored from /tmp/test.save
# virsh list
Id Name State
----------------------------------------------------
15 test paused
# virsh resume test
error: Failed to resume domain test
error: internal error Unable to append command 'id' string
3.Check the audit log in the host, we didn't find any avc deny info
4.Got the same result with step2 in this comment, evenif i copy the save file to another directory, such as /tmp
5.The step2 in this comment can get expected result if i use the default dynamic selinux label
Comment 4RHEL Program Management
2014-04-04 21:26:41 UTC
Development Management has reviewed and declined this request.
You may appeal this decision by reopening this request.