Bug 1305582 - Unable to create any guest as root: "process exited while connecting to monitor:" + blank
Summary: Unable to create any guest as root: "process exited while connecting to monit...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 24
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1303971 1315058 (view as bug list)
Depends On:
Blocks: TRACKER-bugs-affecting-libguestfs
TreeView+ depends on / blocked
 
Reported: 2016-02-08 15:58 UTC by Richard W.M. Jones
Modified: 2016-08-25 13:53 UTC (History)
18 users (show)

Fixed In Version: selinux-policy-3.13.1-191.13.fc24
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-08-25 13:53:01 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
Complete output of libguestfs-test-tool (7.53 KB, text/plain)
2016-02-08 15:58 UTC, Richard W.M. Jones
no flags Details
guestfs-3t3idfnz9volfwqq.log (5.73 KB, text/plain)
2016-02-08 15:59 UTC, Richard W.M. Jones
no flags Details
libvirtd.log (1.78 MB, text/plain)
2016-02-08 16:31 UTC, Richard W.M. Jones
no flags Details
guestfs-ema5t5i89adarl2k.log (5.73 KB, text/plain)
2016-02-08 16:32 UTC, Richard W.M. Jones
no flags Details
system logs (36.20 KB, text/plain)
2016-02-08 16:40 UTC, Richard W.M. Jones
no flags Details

Description Richard W.M. Jones 2016-02-08 15:58:03 UTC
Description of problem:

$ sudo libguestfs-test-tool
[...]
libguestfs: [00107ms] launch libvirt guest
libguestfs: error: could not create appliance through libvirt.

Try running qemu directly without libvirt using this environment variable:
export LIBGUESTFS_BACKEND=direct

Original error from libvirt: internal error: process exited while connecting to monitor:  [code=1 int1=-1]

Notice that the libvirt error message is missing completely.

Version-Release number of selected component (if applicable):

libvirt-1.3.1-1.fc24.x86_64

How reproducible:

100%

Steps to Reproduce:
1. sudo libguestfs-test-tool

Comment 1 Richard W.M. Jones 2016-02-08 15:58:54 UTC
Created attachment 1122189 [details]
Complete output of libguestfs-test-tool

Comment 2 Richard W.M. Jones 2016-02-08 15:59:42 UTC
Created attachment 1122190 [details]
guestfs-3t3idfnz9volfwqq.log

qemu debug log

Comment 3 Richard W.M. Jones 2016-02-08 16:01:59 UTC
This is the code where libguestfs fetches the error message from
libvirt for display.  Note that err->message seems to be an empty string.

https://github.com/libguestfs/libguestfs/blob/master/src/launch-libvirt.c#L2115-L2119

Comment 4 Richard W.M. Jones 2016-02-08 16:05:15 UTC
(In reply to Richard W.M. Jones from comment #3)
> Note that err->message seems to be an empty string.

That's not quite correct.

err->message contains "internal error: process exited while connecting to monitor: "

Comment 5 Richard W.M. Jones 2016-02-08 16:08:05 UTC
selinux-policy was recently updated from 3.13.1-168.fc24 to 3.13.1-169.fc24

Note this WORKS as non-root.  It's only failing as root.  So it
seems unlikely to be a problem with qemu or the kernel.

Comment 6 Richard W.M. Jones 2016-02-08 16:11:33 UTC
selinux-policy -168 fails in the same way.

Comment 7 Richard W.M. Jones 2016-02-08 16:26:01 UTC
I did a full filesystem relabel, and it's still failing in the same way.

Comment 8 Richard W.M. Jones 2016-02-08 16:31:05 UTC
Created attachment 1122196 [details]
libvirtd.log

The actual error seems to be "No such process".

2016-02-08 16:29:26.787+0000: 2631: debug : qemuProcessLaunch:4954 : Waiting for monitor to show up
2016-02-08 16:29:26.787+0000: 2631: debug : qemuProcessWaitForMonitor:1927 : Connect monitor to 0x7f0368004c50 'guestfs-ema5t5i89adarl2k'
2016-02-08 16:29:26.787+0000: 2631: debug : virSecuritySELinuxSetDaemonSocketLabel:2221 : Setting VM guestfs-ema5t5i89adarl2k socket context system_u:system_r:virtd_t:s0:c689,c817
2016-02-08 16:29:26.787+0000: 2631: info : virObjectRef:296 : OBJECT_REF: obj=0x7f0368004c50
2016-02-08 16:29:26.988+0000: 2631: error : qemuMonitorOpenUnix:361 : failed to connect to monitor socket: No such process
2016-02-08 16:29:26.988+0000: 2631: debug : virFileClose:103 : Closed fd 26
2016-02-08 16:29:26.988+0000: 2631: info : virObjectUnref:259 : OBJECT_UNREF: obj=0x7f0368004c50
2016-02-08 16:29:26.988+0000: 2631: info : qemuConnectMonitor:1612 : Failed to connect monitor for guestfs-ema5t5i89adarl2k

Comment 9 Richard W.M. Jones 2016-02-08 16:32:45 UTC
Created attachment 1122198 [details]
guestfs-ema5t5i89adarl2k.log

qemu log file corresponding to previous comment.

Comment 10 Richard W.M. Jones 2016-02-08 16:40:40 UTC
Created attachment 1122199 [details]
system logs

These are the system logs from around the time of the failed launch.
Various AVCs in there.

Comment 11 Richard W.M. Jones 2016-02-08 16:54:55 UTC
audit2allow suggested:

  allow svirt_t virtd_t:fifo_file write;

I loaded this rule, which allowed me to continue past this error.
There is a further problem, but I will file a different BZ about that.

Comment 13 Lukas Vrabec 2016-02-09 10:19:56 UTC
*** Bug 1303971 has been marked as a duplicate of this bug. ***

Comment 14 Jakub Filak 2016-02-12 10:22:53 UTC
Description of problem:
I ran "$ virsh -c qemu:///system start $vm"

Version-Release number of selected component:
selinux-policy-3.13.1-169.fc24.noarch

Additional info:
reporter:       libreport-2.6.4.2.g18a1
hashmarkername: setroubleshoot
kernel:         4.5.0-0.rc3.git1.2.fc24.x86_64
type:           libreport

Comment 15 Jan Kurik 2016-02-24 15:47:09 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 24 development cycle.
Changing version to '24'.

More information and reason for this action is here:
https://fedoraproject.org/wiki/Fedora_Program_Management/HouseKeeping/Fedora24#Rawhide_Rebase

Comment 16 Lukas Vrabec 2016-03-07 09:22:47 UTC
*** Bug 1315058 has been marked as a duplicate of this bug. ***

Comment 17 Stephen Gallagher 2016-03-15 00:06:08 UTC
Description of problem:
I launched a VM with virt-manager.

Version-Release number of selected component:
selinux-policy-3.13.1-178.fc24.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.5.0-0.rc7.git0.2.fc24.x86_64
type:           libreport

Comment 18 Lukas Vrabec 2016-08-18 12:52:41 UTC
I add some fixes related to this issue.

Comment 19 Fedora Update System 2016-08-23 10:37:33 UTC
selinux-policy-3.13.1-191.13.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-6164469d14

Comment 20 Fedora Update System 2016-08-24 17:26:00 UTC
selinux-policy-3.13.1-191.13.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-6164469d14

Comment 21 Fedora Update System 2016-08-25 13:52:17 UTC
selinux-policy-3.13.1-191.13.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.