1138500 – guest will be shutoff after libvirtd is restarted when selinux security driver is disabled and didn't enable the model='selinux' in guest's xml

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1138500 - guest will be shutoff after libvirtd is restarted when selinux security driver is disabled and didn't enable the model='selinux' in guest's xml

Summary: guest will be shutoff after libvirtd is restarted when selinux security driv...

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	libvirt
Sub Component:
Version:	6.6
Hardware:	x86_64
OS:	All
Priority:	medium
Severity:	medium
Target Milestone:	rc
Target Release:	---
Assignee:	Michal Privoznik
QA Contact:	Virtualization Bugs
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2014-09-05 02:46 UTC by Luyao Huang
Modified:	2015-07-22 05:47 UTC (History)
CC List:	6 users (show)
Fixed In Version:	libvirt-0.10.2-47.el6
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2015-07-22 05:47:09 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2015:1252	0	normal	SHIPPED_LIVE	libvirt bug fix update	2015-07-20 17:50:06 UTC

Description Luyao Huang 2014-09-05 02:46:58 UTC

Description of problem:

guest will be shutoff  after libvirtd is restarted when selinux security driver is disabled and didn't enable the model='selinux' in guest's xml

Version-Release number of selected component (if applicable):
libvirt-0.10.2-45.el6.x86_64


How reproducible:
100%

Steps to Reproduce:
1. set security_driver = "none" in /etc/libvirt/qemu.conf

2. restart libvirtd service

3. start a domain which contains <seclabel type='dynamic' relabel='yes'/> in its XML configuration,
   here we didn't configure the model='selinux' in guest's xml

#virsh dumpxml r6
--
<seclabel type='dynamic' model='none' relabel='yes'/>
--
4. restart libvirtd

5. check the domain status, the domain was in shutoff status, also the seclabel in guest's xml changed

# virsh list --all
 Id    Name                           State
----------------------------------------------------
 -     r6                             shut off


#virsh dumpxml r6
  <seclabel type='none' model='none'/>

6.but can find it use ps aux
#ps aux|grep r6
qemu      3339 28.4  3.3 1405648 269900 ?      Sl   10:37   1:08 /usr/libexec/qemu-kvm -name r6 -S -M rhel6.6.0 -enable-kvm -m 1024 -realtime mlock=off -smp 1,sockets=1,cores=1,threads=1 -uuid 996c6fd7-e34e-1323-6801-439741c1a7c9 -nodefconfig -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/r6.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown -device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x5.0x7 -device ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x5 -device ich9-usb-uhci2,masterbus=usb.0,firstport=2,bus=pci.0,addr=0x5.0x1 -device ich9-usb-uhci3,masterbus=usb.0,firstport=4,bus=pci.0,addr=0x5.0x2 -drive file=/var/lib/libvirt/images/r6.img,if=none,id=drive-ide0-0-0,format=raw,cache=none -device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0,bootindex=1 -netdev tap,fd=25,id=hostnet0 -device rtl8139,netdev=hostnet0,id=net0,mac=52:54:00:a1:2e:6f,bus=pci.0,addr=0x3 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -vnc 127.0.0.1:0 -vga cirrus -device intel-hda,id=sound0,bus=pci.0,addr=0x4 -device hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x6 -msg timestamp=on


Actual results:
guest status change to shut off after libvirtd restart 

Expected results:
guest running

Additional info:
log from /var/log/libvirt/libvirtd.log

2014-09-05 02:43:59.377+0000: 4141: info : libvirt version: 0.10.2, package: 45.el6 (Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>, 2014-09-02-09:54:39, x86-027.build.eng.bos.redhat.com)
2014-09-05 02:43:59.377+0000: 4141: warning : virSecurityManagerNew:148 : Configured security driver "none" disables default policy to create confined guests
2014-09-05 02:43:59.677+0000: 4141: error : virSecurityLabelDefParseXML:3319 : unsupported configuration: unsupported type='dynamic' to model 'none'

Comment 2 Michal Privoznik 2014-09-05 06:03:47 UTC

Patches proposed upstream:

https://www.redhat.com/archives/libvir-list/2014-September/msg00201.html

Comment 3 Michal Privoznik 2014-09-05 07:36:40 UTC

And I've just pushed patches upstream:

commit 36cc189a46b642d202100efddfcefa7cf7bdd08b
Author:     Michal Privoznik <mprivozn>
AuthorDate: Wed Sep 3 19:06:55 2014 +0200
Commit:     Michal Privoznik <mprivozn>
CommitDate: Fri Sep 5 08:35:34 2014 +0200

    tests: Add test cases for previous commit
    
    This commit is rather big. Firstly, the in memory config
    representation is adjusted like if security_driver was set to "none".
    The rest is then just adaptation to the new code that will generate
    different seclabels.
    
    Signed-off-by: Michal Privoznik <mprivozn>

commit d869a6ea03eca6cffe8913a541161bb9bbedc8a1
Author:     Michal Privoznik <mprivozn>
AuthorDate: Wed Sep 3 18:07:45 2014 +0200
Commit:     Michal Privoznik <mprivozn>
CommitDate: Fri Sep 5 08:35:34 2014 +0200

    conf: Fix even implicit labels
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1027096#c8
    
    There are two ways in which security model can make it way into
    <seclabel/>. One is as the @model attribute, the second one is
    via security_driver knob in qemu.conf. Then, while parsing
    <seclabel/> several checks and fix ups of old, stale combinations
    are performed. However, iff @model is specified. They are not
    done in the latter case. So it's still possible to feed libvirt
    with senseless combinations (if qemu.conf is adjusted correctly).
    
    One example of a seclabel that needs some adjustment (in case
    security_driver=none in qemu.conf) is:
    
        <seclabel type='dynamic' relabel='yes'/>
    
    The fixup code is copied from virSecurityLabelDefParseXML
    (covering the former case) into virSecurityLabelDefsParseXML
    (which handles the latter case).
    
    Signed-off-by: Michal Privoznik <mprivozn>

Comment 4 Michal Privoznik 2014-12-03 15:58:50 UTC

Moving to POST:

http://post-office.corp.redhat.com/archives/rhvirt-patches/2014-December/msg00052.html

Comment 6 Luyao Huang 2014-12-15 07:31:03 UTC

Verify this bug with libvirt-0.10.2-47.el6.x86_64:

1.set security_driver = "none" in /etc/libvirt/qemu.conf

2.# service libvirtd restart
Stopping libvirtd daemon:                                  [  OK  ]
Starting libvirtd daemon:                                  [  OK  ]

3.add <seclabel type='dynamic' relabel='yes'/> in guest XML and save:

# virsh edit r6.5
...
<seclabel type='dynamic' relabel='yes'/>
...
Domain r6.5 XML configuration edited.

4.check XML via dumpxml
# virsh dumpxml r6.5|grep selabel 
 <seclabel type='none' model='none'/>

5.start the guest
# virsh start r6.5
Domain r6.5 started

6.
# virsh dumpxml r6.5
<seclabel type='none' model='none'/>

7.restart libvirtd
# service libvirtd restart
Stopping libvirtd daemon:                                  [  OK  ]
Starting libvirtd daemon:                                  [  OK  ]

8.check guest status
# virsh list --all
 Id    Name                           State
----------------------------------------------------
 11    r6.5                           running

Comment 8 errata-xmlrpc 2015-07-22 05:47:09 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1252.html

Note You need to log in before you can comment on or make changes to this bug.