Bug 1177318 - Guest using rbd based image as disk failed to start when sandbox was enabled
Summary: Guest using rbd based image as disk failed to start when sandbox was enabled
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm
Version: 7.1
Hardware: x86_64
OS: Linux
Target Milestone: rc
: ---
Assignee: Miroslav Rezanina
QA Contact: FuXiangChun
Depends On: 1177309
Blocks: 1288337
TreeView+ depends on / blocked
Reported: 2014-12-26 05:31 UTC by Yang Yang
Modified: 2016-11-03 19:59 UTC (History)
12 users (show)

Fixed In Version: qemu-kvm-1.5.3-112.el7
Doc Type: Bug Fix
Doc Text:
Clone Of: 1177309
Last Closed: 2016-11-03 19:59:49 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2585 0 normal SHIPPED_LIVE Moderate: qemu-kvm security, bug fix, and enhancement update 2016-11-03 12:09:03 UTC

Description Yang Yang 2014-12-26 05:31:26 UTC
+++ This bug was initially created as a clone of Bug #1177309 +++

Description of problem:
Guest using rbd based image as disk failed to start when sandbox was enabled

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.try to start vm with sandbox enabled
# /usr/libexec/qemu-kvm -drive file=rbd:libvirt-pool/yy1.img:auth_supported=none:mon_host=$ip,if=none,id=drive-virtio-disk1,rerror=stop,format=raw,werror=stop -device virtio-blk-pci,drive=drive-virtio-disk1,id=sys-img -monitor stdio -spice port=5931,disable-ticketing -boot menu=on -m 2G -sandbox on 

Actual results:
qemu hang 

Expected results:

Additional info:
from audit.log:

type=SECCOMP msg=audit(1419517736.701:315758): auid=0 uid=0 gid=0 ses=1227 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=19319 comm="qemu-kvm" sig=31 arch=c000003e syscall=99 compat=0 ip=0x7ffff0a7bae7 code=0x0

lhuang found that qemu uses seccomp_sandbox and set white system call list in qemu-seccomp.c.

and when qemu call rados_connect(not a qemu func) in qemu_rbd_open, and after a loooot of func,
GiveSystemInfo use sysinfo which is not in seccomp_whitelist[].
so qemu-kvm have been killed because use a syscall out of whitelist.

--- Additional comment from RHEL Product and Program Management on 2014-12-25 22:58:13 EST ---

Since this bug report was entered in bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.

Comment 3 Jun Li 2015-01-05 02:33:37 UTC
FYI, could ref https://bugzilla.redhat.com/show_bug.cgi?id=1177309#c3

Comment 4 Paul Moore 2015-01-05 20:29:06 UTC
For reference, syscall 99 on x86_64 is sysinfo(2):

 # scmp_sys_resolver -a x86_64 99

Comment 7 Miroslav Rezanina 2015-09-08 08:41:09 UTC
We have to whitelist sysinit call to be able to use rbd in sandbox mode. Moving to 7.3 as we won't be able to fix this in 7.2 timeframe.

Comment 9 Miroslav Rezanina 2016-05-16 08:06:32 UTC
Fix included in qemu-kvm-1.5.3-112.el7

Comment 11 FuXiangChun 2016-09-06 14:27:44 UTC
reproduced this bug with qemu-kvm-1.5.3-110.el7.x86_64

/usr/libexec/qemu-kvm -drive file=rbd:libvirt-pool/rhel.raw:mon_host=,if=none,id=drive-virtio-disk1,rerror=stop,format=raw,werror=stop -device virtio-blk-pci,drive=drive-virtio-disk1,id=sys-img -monitor stdio -boot menu=on -m 2G -vnc :1 -sandbox on

qemu-kvm hang.

#tail -f /var/log/audit/audit.log

type=SECCOMP msg=audit(1473171908.568:9688): auid=0 uid=0 gid=0 ses=1286 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=32848 comm="qemu-kvm" sig=31 arch=c000003e syscall=99 compat=0 ip=0x7f2b32bf8077 code=0x0

verified the bug with qemu-kvm-1.5.3-122.el7.x86_64. 

guest works well.

Comment 13 errata-xmlrpc 2016-11-03 19:59:49 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.