Bug 1465788 - /virt/install with qemu-kvm-2.9.0 fails due to AVC from virtlogd
Summary: /virt/install with qemu-kvm-2.9.0 fails due to AVC from virtlogd
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Beaker
Classification: Community
Component: tests
Version: 24
Hardware: Unspecified
OS: Unspecified
high
high vote
Target Milestone: 24.4
Assignee: Dan Callaghan
QA Contact: tools-bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-06-28 08:14 UTC by Jan Stancek
Modified: 2017-07-07 06:35 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-07-07 06:22:22 UTC


Attachments (Terms of Use)

Description Jan Stancek 2017-06-28 08:14:33 UTC
Description of problem:
e59595f01362 "virt/install: don't use virtlogd" introduced a change which disabled virtlogd for virt jobs in the config. But on recent distros a restart of 'libvirtd' is also required, otherwise libvirt still tries to use virtlogd.

The problem starts after rebase from qemu-kvm-1.5.3 to qemu-kvm-2.9.0, which now has new capability "QEMU_CAPS_CHARDEV_FILE_APPEND":

qemuBuildChrChardevStr():
        if (qemuBuildChrChardevFileStr(virQEMUCapsGet(qemuCaps, QEMU_CAPS_CHARDEV_FILE_APPEND) ?
                                       logManager : NULL, cmd, def, &buf,
                                       "path", dev->data.file.path,
                                       "append", dev->data.file.append) < 0) {

/virt/install creates empty console log file ahead of installing guest, so that logguestconsoles can set up a inotify watch on it. With new qemu-kvm however, the label doesn't get reset by libvirt and stays as tmp_t. When virtlogd tries to remove that file (because after Bug 1420205 default action is truncate) it fails and that stops guest installation.

See also:

Bug 1437501 - avc: denied { unlink } for pid=11477 comm="virtlogd" scontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0

Bug 1464525 - [kernel-alt][RHEL-ALT-7.4-20170620.n.0] avc: denied { unlink } for pid=12110 comm="virtlogd" name="x86_64_kvm_1cpu_console.log"

Bug 1420205 comment 3 - For console device, default value of append attribute is not consistent with the document


Version-Release number of selected component (if applicable):
distribution-virt-install-4_0-94

How reproducible:
100%

Steps to Reproduce:
1. run virt/install on recent RHEL-ALT distro

Actual results:
guest installation fails

Expected results:
guests can be installed

Additional info:

Comment 1 Jan Stancek 2017-06-28 08:19:41 UTC
Posted:
  https://gerrit.beaker-project.org/5717

Comment 3 Dan Callaghan 2017-07-07 04:19:38 UTC
Tagged /distribution/virt/install 4.0-95 and /distribution/virt/image-install 1.0-9.


Note You need to log in before you can comment on or make changes to this bug.