Bug 1138500
| Summary: | guest will be shutoff after libvirtd is restarted when selinux security driver is disabled and didn't enable the model='selinux' in guest's xml | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Luyao Huang <lhuang> |
| Component: | libvirt | Assignee: | Michal Privoznik <mprivozn> |
| Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.6 | CC: | dyuan, jdenemar, mprivozn, mzhan, rbalakri, zhwang |
| Target Milestone: | rc | Keywords: | Upstream |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | All | ||
| Whiteboard: | |||
| Fixed In Version: | libvirt-0.10.2-47.el6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-07-22 05:47:09 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Luyao Huang
2014-09-05 02:46:58 UTC
Patches proposed upstream: https://www.redhat.com/archives/libvir-list/2014-September/msg00201.html And I've just pushed patches upstream:
commit 36cc189a46b642d202100efddfcefa7cf7bdd08b
Author: Michal Privoznik <mprivozn>
AuthorDate: Wed Sep 3 19:06:55 2014 +0200
Commit: Michal Privoznik <mprivozn>
CommitDate: Fri Sep 5 08:35:34 2014 +0200
tests: Add test cases for previous commit
This commit is rather big. Firstly, the in memory config
representation is adjusted like if security_driver was set to "none".
The rest is then just adaptation to the new code that will generate
different seclabels.
Signed-off-by: Michal Privoznik <mprivozn>
commit d869a6ea03eca6cffe8913a541161bb9bbedc8a1
Author: Michal Privoznik <mprivozn>
AuthorDate: Wed Sep 3 18:07:45 2014 +0200
Commit: Michal Privoznik <mprivozn>
CommitDate: Fri Sep 5 08:35:34 2014 +0200
conf: Fix even implicit labels
https://bugzilla.redhat.com/show_bug.cgi?id=1027096#c8
There are two ways in which security model can make it way into
<seclabel/>. One is as the @model attribute, the second one is
via security_driver knob in qemu.conf. Then, while parsing
<seclabel/> several checks and fix ups of old, stale combinations
are performed. However, iff @model is specified. They are not
done in the latter case. So it's still possible to feed libvirt
with senseless combinations (if qemu.conf is adjusted correctly).
One example of a seclabel that needs some adjustment (in case
security_driver=none in qemu.conf) is:
<seclabel type='dynamic' relabel='yes'/>
The fixup code is copied from virSecurityLabelDefParseXML
(covering the former case) into virSecurityLabelDefsParseXML
(which handles the latter case).
Signed-off-by: Michal Privoznik <mprivozn>
Moving to POST: http://post-office.corp.redhat.com/archives/rhvirt-patches/2014-December/msg00052.html Verify this bug with libvirt-0.10.2-47.el6.x86_64: 1.set security_driver = "none" in /etc/libvirt/qemu.conf 2.# service libvirtd restart Stopping libvirtd daemon: [ OK ] Starting libvirtd daemon: [ OK ] 3.add <seclabel type='dynamic' relabel='yes'/> in guest XML and save: # virsh edit r6.5 ... <seclabel type='dynamic' relabel='yes'/> ... Domain r6.5 XML configuration edited. 4.check XML via dumpxml # virsh dumpxml r6.5|grep selabel <seclabel type='none' model='none'/> 5.start the guest # virsh start r6.5 Domain r6.5 started 6. # virsh dumpxml r6.5 <seclabel type='none' model='none'/> 7.restart libvirtd # service libvirtd restart Stopping libvirtd daemon: [ OK ] Starting libvirtd daemon: [ OK ] 8.check guest status # virsh list --all Id Name State ---------------------------------------------------- 11 r6.5 running Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-1252.html |