Hide Forgot
+++ This bug was initially created as a clone of Bug #1177309 +++ Description of problem: Guest using rbd based image as disk failed to start when sandbox was enabled Version-Release number of selected component (if applicable): libvirt-1.2.8-11.el7.x86_64 qemu-kvm-1.5.3-84.el7.x86_64 3.10.0-219.el7.x86_64 librados2-0.80.7-2.el7.x86_64 librbd1-0.80.7-2.el7.x86_64 How reproducible: 100% Steps to Reproduce: 1.try to start vm with sandbox enabled # /usr/libexec/qemu-kvm -drive file=rbd:libvirt-pool/yy1.img:auth_supported=none:mon_host=$ip,if=none,id=drive-virtio-disk1,rerror=stop,format=raw,werror=stop -device virtio-blk-pci,drive=drive-virtio-disk1,id=sys-img -monitor stdio -spice port=5931,disable-ticketing -boot menu=on -m 2G -sandbox on Actual results: qemu hang Expected results: Additional info: from audit.log: type=SECCOMP msg=audit(1419517736.701:315758): auid=0 uid=0 gid=0 ses=1227 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=19319 comm="qemu-kvm" sig=31 arch=c000003e syscall=99 compat=0 ip=0x7ffff0a7bae7 code=0x0 lhuang found that qemu uses seccomp_sandbox and set white system call list in qemu-seccomp.c. and when qemu call rados_connect(not a qemu func) in qemu_rbd_open, and after a loooot of func, GiveSystemInfo use sysinfo which is not in seccomp_whitelist[]. so qemu-kvm have been killed because use a syscall out of whitelist. --- Additional comment from RHEL Product and Program Management on 2014-12-25 22:58:13 EST --- Since this bug report was entered in bugzilla, the release flag has been set to ? to ensure that it is properly evaluated for this release.
FYI, could ref https://bugzilla.redhat.com/show_bug.cgi?id=1177309#c3
For reference, syscall 99 on x86_64 is sysinfo(2): # scmp_sys_resolver -a x86_64 99 sysinfo
We have to whitelist sysinit call to be able to use rbd in sandbox mode. Moving to 7.3 as we won't be able to fix this in 7.2 timeframe.
Fix included in qemu-kvm-1.5.3-112.el7
reproduced this bug with qemu-kvm-1.5.3-110.el7.x86_64 /usr/libexec/qemu-kvm -drive file=rbd:libvirt-pool/rhel.raw:mon_host=10.66.144.26,if=none,id=drive-virtio-disk1,rerror=stop,format=raw,werror=stop -device virtio-blk-pci,drive=drive-virtio-disk1,id=sys-img -monitor stdio -boot menu=on -m 2G -vnc :1 -sandbox on result: qemu-kvm hang. #tail -f /var/log/audit/audit.log type=SECCOMP msg=audit(1473171908.568:9688): auid=0 uid=0 gid=0 ses=1286 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=32848 comm="qemu-kvm" sig=31 arch=c000003e syscall=99 compat=0 ip=0x7f2b32bf8077 code=0x0 verified the bug with qemu-kvm-1.5.3-122.el7.x86_64. guest works well.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2016-2585.html