Bug 1102611
| Summary: | The running guest will disappear while change the security_driver from "none" to "selinux" | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | zhenfeng wang <zhwang> | |
| Component: | libvirt | Assignee: | Ján Tomko <jtomko> | |
| Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 7.0 | CC: | ajia, dyuan, gsun, jtomko, mzhan, rbalakri, ydu | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | x86_64 | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | libvirt-1.2.7-1.el7 | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1102612 (view as bug list) | Environment: | ||
| Last Closed: | 2015-03-05 07:36:54 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1102612 | |||
|
Description
zhenfeng wang
2014-05-29 09:50:08 UTC
Fixed upstream by:
commit f9bf63e673c11cd189748c29b6ea7d2cf19c8da7
Author: Ján Tomko <jtomko>
AuthorDate: 2014-06-09 16:23:52 +0200
Commit: Ján Tomko <jtomko>
CommitDate: 2014-06-10 10:18:24 +0200
SELinux: don't fail silently when no label is present
This fixes startup of a domain with:
<seclabel type='none' model='dac'/>
on a host with selinux and dac drivers and
security_default_confined = 0
https://bugzilla.redhat.com/show_bug.cgi?id=1105939
https://bugzilla.redhat.com/show_bug.cgi?id=1102611
git describe: v1.2.5-81-gf9bf63e
I could reproduce it with libvirt-1.1.1-29.el7.x86_64 as following steps: 1.Set security_driver=none in /etc/libvirt/qemu.conf security_driver = "none" #service libvirtd restart 2.Start a guest in the host #virsh start rhel6u5 # virsh list Id Name State ---------------------------------------------------- 1 rhel6u5 running 3.Check the selinux label of the guest # ps -efZ|grep rhel6u5 system_u:system_r:virtd_t:s0-s0:c0.c1023 qemu 5130 1 73 03:34 ? 00:00:01 /usr/libexec/qemu-kvm -name rhel6u5 # ll -Z /var/lib/libvirt/images/rhel6u5.img -rw-------. qemu qemu system_u:object_r:virt_image_t:s0 /var/lib/libvirt/images/rhel6u5.img 4.Change the security_driver="selinux" in /etc/libvirt/qemu.conf security_driver = "selinux" #service libvirtd restart 5.Check the guest's status, found the guest disappear after restart the libvirtd service # virsh list --all Id Name State ---------------------------------------------------- #ps aux|grep rhel6u5 6.Check the libvirt log, find the following error: # cat /var/log/libvirtd.log | grep -i qemuConnect 2014-08-21 07:28:41.178+0000: 4836: error : qemuConnectMonitor:1378 : Failed to set security context for monitor for rhel6u5 Verified this issue with libvirt-1.2.7-1.el7.x86_64: 1.Set security_driver=none in /etc/libvirt/qemu.conf security_driver = "none" #service libvirtd restart 2.Start a guest in the host #virsh start rhel6u5 # virsh list Id Name State ---------------------------------------------------- 1 rhel6u5 running 3.Check the selinux label of the guest # ps -efZ|grep rhel6u5 system_u:system_r:virtd_t:s0-s0:c0.c1023 qemu 5130 1 73 03:34 ? 00:00:01 /usr/libexec/qemu-kvm -name rhel6u5 # ll -Z /var/lib/libvirt/images/rhel6u5.img -rw-------. qemu qemu system_u:object_r:virt_image_t:s0 /var/lib/libvirt/images/rhel6u5.img 4.Change the security_driver="selinux" in /etc/libvirt/qemu.conf security_driver = "selinux" #service libvirtd restart 5.Check the guest's status, found the guest is still running after restart the libvirtd service # virsh list --all Id Name State ---------------------------------------------------- 1 rhel6u5 running 6.Check the libvirt log, and not finding about selinux error. Verify this bug with libvirt-1.2.8-8.el7.x86_64 steps 1.Set security_driver=none in /etc/libvirt/qemu.conf security_driver = "none" #service libvirtd restart 2.Start a guest in the host #virsh start rhel7.0 # virsh list Id Name State ---------------------------------------------------- 1 rhel7.0 running 3.Check the selinux label of the guest # ps -efZ|grep qemu system_u:system_r:virtd_t:s0-s0:c0.c1023 qemu 3922 1 13 13:26 ? 00:00:17 /usr/libexec/qemu-kvm -name rhel7.0 # ll /var/lib/libvirt/images/rhel7.0.qcow2 -Z -rw-r--r--. root root system_u:object_r:virt_image_t:s0 /var/lib/libvirt/images/rhel7.0.qcow2 4.Change the security_driver="selinux" in /etc/libvirt/qemu.conf security_driver = "selinux" #service libvirtd restart 5.Check the guest's status, found the guest is still running after restart the libvirtd service # virsh list --all Id Name State ---------------------------------------------------- 1 rhel7.0 running 6.Check the libvirt log, and not finding about selinux error. 7.Destroy the guest, then re-start it #virsh destroy rhel7.0 #virsh start rhel7.0 8.Check the selinux label of the guest # ps -efZ|grep qemu system_u:system_r:svirt_t:s0:c386,c692 qemu 4252 1 93 13:36 ? 00:00:08 /usr/libexec/qemu-kvm -name rhel7.0 # ll -Z /var/lib/libvirt/images/rhel7.0.qcow2 -rw-r--r--. qemu qemu system_u:object_r:svirt_image_t:s0:c386,c692 /var/lib/libvirt/images/rhel7.0.qcow2 9.Change the security_driver="none" in /etc/libvirt/qemu.conf security_driver = "selinux" #service libvirtd restart 10.Check the guest's status, found the guest is still running after restart the libvirtd service # virsh list --all Id Name State ---------------------------------------------------- 1 rhel7.0 running # ps -efZ|grep qemu system_u:system_r:svirt_t:s0:c386,c692 qemu 4252 1 9 13:36 ? 00:00:17 /usr/libexec/qemu-kvm -name rhel7.0 # ll -Z /var/lib/libvirt/images/rhel7.0.qcow2 -rw-r--r--. qemu qemu system_u:object_r:svirt_image_t:s0:c386,c692 /var/lib/libvirt/images/rhel7.0.qcow2 11.Check the libvirt log, and not finding about selinux error. According to the upper steps, mark this bug verifed Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0323.html |