Red Hat Bugzilla – Bug 1102611
The running guest will disappear while change the security_driver from "none" to "selinux"
Last modified: 2015-03-05 02:36:54 EST
Description of problem: The running guest will disappear while change the security_driver from "none" to "selinux" Version-Release number of selected component (if applicable): qemu-kvm-rhev-1.5.3-60.el7ev_0.2.x86_64 libvirt-1.1.1-29.el7.x86_64 kernel-3.10.0-123.el7.x86_64 How reproducible: 100% Steps to Reproduce: 1.Set security_driver=none in /etc/libvirt/qemu.conf security_driver = "none" #service libvirtd restart 2.Start a guest in the host #virsh start rhel7 # virsh list Id Name State ---------------------------------------------------- 1 rhel7 running 3.Check the selinux label of the guest # ps -efZ|grep rhel7 system_u:system_r:virtd_t:s0-s0:c0.c1023 qemu 9213 1 47 15:33 ? 00:00:11 /usr/libexec/qemu-kvm -name rhel7 # ll /var/lib/libvirt/images/rhel7.img -Z -rw-------. qemu qemu system_u:object_r:virt_image_t:s0 /var/lib/libvirt/images/rhel7.img 4.Change the security_driver="selinux" in /etc/libvirt/qemu.conf security_driver = "selinux" #service libvirtd restart 5.Check the guest's status, found the guest disappear after restart the libvirtd service # virsh list --all Id Name State ---------------------------------------------------- #ps aux|grep rhel7 6.Check the libvirt log, find the following error 014-05-29 07:36:08.136+0000: 9554: info : libvirt version: 1.1.1, package: 29.el7 (Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>, 2014-03-24-06:10:00, x86-021.build.eng.bos.redhat.com) 2014-05-29 07:36:08.136+0000: 9554: error : qemuConnectMonitor:1378 : Failed to set security context for monitor for rhel7 7.Test the upper steps in rhel6.6, met the same error with the rhel7, however the guest in rhel6 won't disappear, it just became "shutoff" status after restart the libvirtd service 8.It works well in rhel6.5 Actual results: The guest will disappear while change the security_driver from "none" to "selinux" Expected results: The guest should keep in running status Additional info:
Fixed upstream by: commit f9bf63e673c11cd189748c29b6ea7d2cf19c8da7 Author: Ján Tomko <jtomko@redhat.com> AuthorDate: 2014-06-09 16:23:52 +0200 Commit: Ján Tomko <jtomko@redhat.com> CommitDate: 2014-06-10 10:18:24 +0200 SELinux: don't fail silently when no label is present This fixes startup of a domain with: <seclabel type='none' model='dac'/> on a host with selinux and dac drivers and security_default_confined = 0 https://bugzilla.redhat.com/show_bug.cgi?id=1105939 https://bugzilla.redhat.com/show_bug.cgi?id=1102611 git describe: v1.2.5-81-gf9bf63e
I could reproduce it with libvirt-1.1.1-29.el7.x86_64 as following steps: 1.Set security_driver=none in /etc/libvirt/qemu.conf security_driver = "none" #service libvirtd restart 2.Start a guest in the host #virsh start rhel6u5 # virsh list Id Name State ---------------------------------------------------- 1 rhel6u5 running 3.Check the selinux label of the guest # ps -efZ|grep rhel6u5 system_u:system_r:virtd_t:s0-s0:c0.c1023 qemu 5130 1 73 03:34 ? 00:00:01 /usr/libexec/qemu-kvm -name rhel6u5 # ll -Z /var/lib/libvirt/images/rhel6u5.img -rw-------. qemu qemu system_u:object_r:virt_image_t:s0 /var/lib/libvirt/images/rhel6u5.img 4.Change the security_driver="selinux" in /etc/libvirt/qemu.conf security_driver = "selinux" #service libvirtd restart 5.Check the guest's status, found the guest disappear after restart the libvirtd service # virsh list --all Id Name State ---------------------------------------------------- #ps aux|grep rhel6u5 6.Check the libvirt log, find the following error: # cat /var/log/libvirtd.log | grep -i qemuConnect 2014-08-21 07:28:41.178+0000: 4836: error : qemuConnectMonitor:1378 : Failed to set security context for monitor for rhel6u5 Verified this issue with libvirt-1.2.7-1.el7.x86_64: 1.Set security_driver=none in /etc/libvirt/qemu.conf security_driver = "none" #service libvirtd restart 2.Start a guest in the host #virsh start rhel6u5 # virsh list Id Name State ---------------------------------------------------- 1 rhel6u5 running 3.Check the selinux label of the guest # ps -efZ|grep rhel6u5 system_u:system_r:virtd_t:s0-s0:c0.c1023 qemu 5130 1 73 03:34 ? 00:00:01 /usr/libexec/qemu-kvm -name rhel6u5 # ll -Z /var/lib/libvirt/images/rhel6u5.img -rw-------. qemu qemu system_u:object_r:virt_image_t:s0 /var/lib/libvirt/images/rhel6u5.img 4.Change the security_driver="selinux" in /etc/libvirt/qemu.conf security_driver = "selinux" #service libvirtd restart 5.Check the guest's status, found the guest is still running after restart the libvirtd service # virsh list --all Id Name State ---------------------------------------------------- 1 rhel6u5 running 6.Check the libvirt log, and not finding about selinux error.
Verify this bug with libvirt-1.2.8-8.el7.x86_64 steps 1.Set security_driver=none in /etc/libvirt/qemu.conf security_driver = "none" #service libvirtd restart 2.Start a guest in the host #virsh start rhel7.0 # virsh list Id Name State ---------------------------------------------------- 1 rhel7.0 running 3.Check the selinux label of the guest # ps -efZ|grep qemu system_u:system_r:virtd_t:s0-s0:c0.c1023 qemu 3922 1 13 13:26 ? 00:00:17 /usr/libexec/qemu-kvm -name rhel7.0 # ll /var/lib/libvirt/images/rhel7.0.qcow2 -Z -rw-r--r--. root root system_u:object_r:virt_image_t:s0 /var/lib/libvirt/images/rhel7.0.qcow2 4.Change the security_driver="selinux" in /etc/libvirt/qemu.conf security_driver = "selinux" #service libvirtd restart 5.Check the guest's status, found the guest is still running after restart the libvirtd service # virsh list --all Id Name State ---------------------------------------------------- 1 rhel7.0 running 6.Check the libvirt log, and not finding about selinux error. 7.Destroy the guest, then re-start it #virsh destroy rhel7.0 #virsh start rhel7.0 8.Check the selinux label of the guest # ps -efZ|grep qemu system_u:system_r:svirt_t:s0:c386,c692 qemu 4252 1 93 13:36 ? 00:00:08 /usr/libexec/qemu-kvm -name rhel7.0 # ll -Z /var/lib/libvirt/images/rhel7.0.qcow2 -rw-r--r--. qemu qemu system_u:object_r:svirt_image_t:s0:c386,c692 /var/lib/libvirt/images/rhel7.0.qcow2 9.Change the security_driver="none" in /etc/libvirt/qemu.conf security_driver = "selinux" #service libvirtd restart 10.Check the guest's status, found the guest is still running after restart the libvirtd service # virsh list --all Id Name State ---------------------------------------------------- 1 rhel7.0 running # ps -efZ|grep qemu system_u:system_r:svirt_t:s0:c386,c692 qemu 4252 1 9 13:36 ? 00:00:17 /usr/libexec/qemu-kvm -name rhel7.0 # ll -Z /var/lib/libvirt/images/rhel7.0.qcow2 -rw-r--r--. qemu qemu system_u:object_r:svirt_image_t:s0:c386,c692 /var/lib/libvirt/images/rhel7.0.qcow2 11.Check the libvirt log, and not finding about selinux error. According to the upper steps, mark this bug verifed
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0323.html