RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1177318 - Guest using rbd based image as disk failed to start when sandbox was enabled
Summary: Guest using rbd based image as disk failed to start when sandbox was enabled
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm
Version: 7.1
Hardware: x86_64
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Miroslav Rezanina
QA Contact: FuXiangChun
URL:
Whiteboard:
Depends On: 1177309
Blocks: 1288337
TreeView+ depends on / blocked
 
Reported: 2014-12-26 05:31 UTC by Yang Yang
Modified: 2016-11-03 19:59 UTC (History)
12 users (show)

Fixed In Version: qemu-kvm-1.5.3-112.el7
Doc Type: Bug Fix
Doc Text:
Clone Of: 1177309
Environment:
Last Closed: 2016-11-03 19:59:49 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2585 0 normal SHIPPED_LIVE Moderate: qemu-kvm security, bug fix, and enhancement update 2016-11-03 12:09:03 UTC

Description Yang Yang 2014-12-26 05:31:26 UTC 
+++ This bug was initially created as a clone of Bug #1177309 +++

Description of problem:
Guest using rbd based image as disk failed to start when sandbox was enabled

Version-Release number of selected component (if applicable):
libvirt-1.2.8-11.el7.x86_64
qemu-kvm-1.5.3-84.el7.x86_64
3.10.0-219.el7.x86_64
librados2-0.80.7-2.el7.x86_64
librbd1-0.80.7-2.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
1.try to start vm with sandbox enabled
# /usr/libexec/qemu-kvm -drive file=rbd:libvirt-pool/yy1.img:auth_supported=none:mon_host=$ip,if=none,id=drive-virtio-disk1,rerror=stop,format=raw,werror=stop -device virtio-blk-pci,drive=drive-virtio-disk1,id=sys-img -monitor stdio -spice port=5931,disable-ticketing -boot menu=on -m 2G -sandbox on 


Actual results:
qemu hang 

Expected results:


Additional info:
from audit.log:

type=SECCOMP msg=audit(1419517736.701:315758): auid=0 uid=0 gid=0 ses=1227 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=19319 comm="qemu-kvm" sig=31 arch=c000003e syscall=99 compat=0 ip=0x7ffff0a7bae7 code=0x0

lhuang found that qemu uses seccomp_sandbox and set white system call list in qemu-seccomp.c.

and when qemu call rados_connect(not a qemu func) in qemu_rbd_open, and after a loooot of func,
GiveSystemInfo use sysinfo which is not in seccomp_whitelist[].
so qemu-kvm have been killed because use a syscall out of whitelist.

--- Additional comment from RHEL Product and Program Management on 2014-12-25 22:58:13 EST ---

Since this bug report was entered in bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.
Comment 3 Jun Li 2015-01-05 02:33:37 UTC 
FYI, could ref https://bugzilla.redhat.com/show_bug.cgi?id=1177309#c3
Comment 4 Paul Moore 2015-01-05 20:29:06 UTC 
For reference, syscall 99 on x86_64 is sysinfo(2):

 # scmp_sys_resolver -a x86_64 99
 sysinfo
Comment 7 Miroslav Rezanina 2015-09-08 08:41:09 UTC 
We have to whitelist sysinit call to be able to use rbd in sandbox mode. Moving to 7.3 as we won't be able to fix this in 7.2 timeframe.
Comment 9 Miroslav Rezanina 2016-05-16 08:06:32 UTC 
Fix included in qemu-kvm-1.5.3-112.el7
Comment 11 FuXiangChun 2016-09-06 14:27:44 UTC 
reproduced this bug with qemu-kvm-1.5.3-110.el7.x86_64

/usr/libexec/qemu-kvm -drive file=rbd:libvirt-pool/rhel.raw:mon_host=10.66.144.26,if=none,id=drive-virtio-disk1,rerror=stop,format=raw,werror=stop -device virtio-blk-pci,drive=drive-virtio-disk1,id=sys-img -monitor stdio -boot menu=on -m 2G -vnc :1 -sandbox on

result:
qemu-kvm hang.

#tail -f /var/log/audit/audit.log

type=SECCOMP msg=audit(1473171908.568:9688): auid=0 uid=0 gid=0 ses=1286 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=32848 comm="qemu-kvm" sig=31 arch=c000003e syscall=99 compat=0 ip=0x7f2b32bf8077 code=0x0

verified the bug with qemu-kvm-1.5.3-122.el7.x86_64. 

guest works well.
Comment 13 errata-xmlrpc 2016-11-03 19:59:49 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2585.html
Note You need to log in before you can comment on or make changes to this bug.