Bug 1149669
| Summary: | libvirt drops cdrom attached to local ISO in case of uid mismatch | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Francesco Romani <fromani> | |
| Component: | libvirt | Assignee: | Michal Privoznik <mprivozn> | |
| Status: | CLOSED NOTABUG | QA Contact: | Virtualization Bugs <virt-bugs> | |
| Severity: | urgent | Docs Contact: | ||
| Priority: | high | |||
| Version: | 6.6 | CC: | alitke, bazulay, danken, ddumas, dyuan, ecohen, fromani, gklein, iheim, istein, jkurik, jsuchane, lpeer, lsurette, mavital, michal.skrivanek, mjenner, mprivozn, mtessun, ofrenkel, pablo.iranzo, rbalakri, Rhev-m-bugs, sherold, shyu, tdosek, xuzhang, yeylon | |
| Target Milestone: | rc | Keywords: | AutomationBlocker, Regression, ZStream | |
| Target Release: | 6.6 | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | 1145636 | |||
| : | 1150611 (view as bug list) | Environment: | ||
| Last Closed: | 2014-10-20 11:37:04 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1002699, 1150611 | |||
|
Description
Francesco Romani
2014-10-06 12:41:05 UTC
the provided RPM works for me, but even thepast snapshot (6.6.RC5) did, so to be 100% we need to test it on the boxes which made the issue manifest. I want to try the issue in libvirt side, I try serveral ways to let libvirt drop the iso abnormally, however every time the guest can drop the iso correctly, I doubt that what's situationw will cause the guest drop the iso abnormally, can you give me some advise? The following steps were my reproduce steps , my reproduce steps was little different with the original bug, maybe i miss something important, please help point out it , thanks
steps
Scenario 1
1.Two hosts registered in rhevm: host1(source)/host2(target)
2.The configuration in qemu.conf in two rhevm hosts like following
#cat /etc/libvirt/qemu.conf
auto_dump_path="/var/log/core"
dynamic_ownership = 0
lock_manager="sanlock"
remote_display_port_max=6923
remote_display_port_min=5900
save_image_format="lzop"
spice_tls=1
spice_tls_x509_cert_dir="/etc/pki/vdsm/libvirt-spice"
3.Prepare a nfs server, put the guest os into the share directoy, and set its permisson to vdsm:kvm, then mount the nfs server on the two rhevm hosts
#mount $nfs_ip:/export /mnt
# ll /mnt/rhel6.img
-rw-rw----. 1 vdsm kvm 3809017856 Oct 17 00:35 /mnt/rhel6.img
4.Create a guest in the source host1 with shareable os in nfs server
and two cdroms with unshareable iso which located in the host1
#virsh dumpxml rhel6
--
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='none'/>
<source file='/mnt/zhwang/img/rhel6.img' startupPolicy='optional'>
<seclabel model='selinux' relabel='no'/>
</source>
<target dev='vda' bus='virtio'/>
<alias name='virtio-disk0'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
</disk>
<disk type='file' device='cdrom'>
<driver name='qemu' type='raw'/>
<source file='/var/lib/libvirt/images/cd1.iso' startupPolicy='optional'/>
<target dev='hdc' bus='ide'/>
<readonly/>
<serial></serial>
<alias name='ide0-1-0'/>
<address type='drive' controller='0' bus='1' target='0' unit='0'/>
</disk>
<disk type='file' device='cdrom'>
<driver name='qemu' type='raw'/>
<source file='/var/lib/libvirt/images/cd2.iso' startupPolicy='optional'/>
<target dev='hdd' bus='ide'/>
<readonly/>
<serial></serial>
<alias name='ide0-1-1'/>
<address type='drive' controller='0' bus='1' target='0' unit='1'/>
</disk>
5.check the iso's label
# ll /var/lib/libvirt/images/ -Z
-rw-r-----. vdsm qemu system_u:object_r:virt_content_t:s0 cd1.iso
-rw-r-----. vdsm qemu system_u:object_r:virt_content_t:s0 cd2.iso
6.Migrate the guest to the target
#virsh migrate --live rhel6 qemu+ssh://$host2/system
7.After migrated ,check the iso in host2, found the two isos in the cdrom has been dropped
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='none'/>
<source file='/mnt/zhwang/img/rhel6.img' startupPolicy='optional'>
<seclabel model='selinux' relabel='no'/>
</source>
<target dev='vda' bus='virtio'/>
<alias name='virtio-disk0'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
</disk>
<disk type='file' device='cdrom'>
<driver name='qemu' type='raw'/>
<source startupPolicy='optional'/>
<target dev='hdc' bus='ide'/>
<readonly/>
<serial></serial>
<alias name='ide0-1-0'/>
<address type='drive' controller='0' bus='1' target='0' unit='0'/>
</disk>
<disk type='file' device='cdrom'>
<driver name='qemu' type='raw'/>
<source startupPolicy='optional'/>
<target dev='hdd' bus='ide'/>
<readonly/>
<serial></serial>
<alias name='ide0-1-1'/>
<address type='drive' controller='0' bus='1' target='0' unit='1'/>
</disk>
8.Migrate the guest back to the source, the guest migrate successfully
Scenario 2
The scenario2 was same with scenario1 except the following steps
1.pre-create the cd1.iso cd2.iso in the corresponding directory in the target host before do the migration from the source to
the target
Results: the guest can migrate successfully to the target host, and the guest won't drop the iso, even the label on cd1.iso cd2.iso
on target host2 were different with the label on the source host1
2.Then change the label for cd1.iso cd2.iso in source host1, then migrate the guest from the target back to the source
host1# chcon unconfined_u:object_r:virt_image_t:s0 cd1.iso
host1# chcon unconfined_u:object_r:virt_image_t:s0 cd2.iso
Results: the guest can migrate back successfuly to the source host, and the guest won't drop the iso, after migration the label on cd1.iso
cd2.iso on the source host was likely following
# ll -Z
-rw-r-----. vdsm qemu system_u:object_r:virt_content_t:s0 cd1.iso
-rw-r-----. vdsm qemu system_u:object_r:virt_content_t:s0 cd2.iso
3.Re-migrate the guest to the target host2, migrate successfully, and the guest won't drop the iso
4.Re-migrate the guest back to the source host1 , migrate successfully, and the guest won't drop the iso
I saw you add the per-image on the patch, how does it work ? I do the following research about it, but not sure how to use it, will it use the per-image user's permission to open disk if the
qemu process didn't have the perssion open it or will the libvirt relabel the disk with the per-image setting ?
1.Set dynamic_ownership=0 in qemu.conf
user=qemu
group=qemu
dynamic_ownership=0
#service libvirtd retart
2.Edit guest's xml, add the following content
#virsh dumpxml rhel6
--
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='none'/>
<source file='/var/lib/libvirt/images/rhel6.img'>
<seclabel model='dac' relabel='yes'>
<label>test1:test1</label>
</seclabel>
</source>
<target dev='vda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
</disk>
<disk type='file' device='disk'>
<driver name='qemu' type='raw'/>
<source file='/var/lib/libvirt/images/test.img'>
<seclabel model='dac' relabel='yes'>
<label>test1:test1</label>
</seclabel>
</source>
<target dev='vdb' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x09' function='0x0'/>
</disk>
3.Change the image's owner/group to test1/test1
# ll /var/lib/libvirt/images
total 6833492
-rw-r-----. 1 test1 test1 3804430336 Oct 17 01:11 rhel6.img
-rw-r--r--. 1 test1 test1 1073741824 Oct 15 04:01 test.img
4.Start the guest, the guest will fail to start
# virsh start rhel6
error: Failed to start domain rhel6
error: internal error Process exited while reading console log output: char device redirected to /dev/pts/1
2014-10-17T05:15:57.586405Z qemu-kvm: -drive file=/var/lib/libvirt/images/rhel6.img,if=none,id=drive-virtio-disk0,format=qcow2,cache=none: could not open disk image /var/lib/libvirt/images/rhel6.img: Permission denied
Closing per https://bugzilla.redhat.com/show_bug.cgi?id=1145636#c35 comment |