Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1600867

Summary:	Allow libvirt to pass chardev FD for vhostuser
Product:	Red Hat Enterprise Linux 7	Reporter:	Michal Privoznik <mprivozn>
Component:	qemu-kvm-rhev	Assignee:	Marc-Andre Lureau <marcandre.lureau>
Status:	CLOSED DUPLICATE	QA Contact:	Pei Zhang <pezhang>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.5	CC:	chayang, jdenemar, juzhang, lgoldber, libvirt-maint, marcandre.lureau, michen, pezhang, rbalakri, siliu, virt-maint, xfu
Target Milestone:	rc
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1597285	Environment:
Last Closed:	2018-07-17 09:17:03 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1597285

Description Michal Privoznik 2018-07-13 08:39:31 UTC

+++ This bug was initially created as a clone of Bug #1597285 +++

Description of problem:

VM fails to run/vhostuser server socket creation fails due to selinux:

VM nari-vm-1 is down with error. Exit message: internal error: process exited while connecting to monitor: 2018-07-01T15:48:00.679391Z qemu-kvm: -chardev socket,id=charnet0,path=/var/run/vdsm/vhostuser/dpdk-vhostuser-01560e59-bceb-476d-9210-057b75d208ef,server: Failed to bind socket to /var/run/vdsm/vhostuser/dpdk-vhostuser-01560e59-bceb-476d-9210-057b75d208ef: Permission denied. 

AVC's snippet:

type=AVC msg=audit(1530452995.805:318): avc:  denied  { write } for  pid=5160 comm="qemu-kvm" name="vhostuser" dev="tmpfs" ino=17292 scontext=system_u:system_r:svirt_t:s0:c285,c817 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir
type=USER_AVC msg=audit(1530460080.361:618): pid=777 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.login1.Manager member=Inhibit dest=org.freedesktop.login1 spid=5155 tpid=817 scontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:systemd_logind_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=AVC msg=audit(1530460080.677:634): avc:  denied  { write } for  pid=23049 comm="qemu-kvm" name="vhostuser" dev="tmpfs" ino=17292 scontext=system_u:system_r:svirt_t:s0:c216,c1000 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir
type=USER_AVC msg=audit(1530460209.600:686): pid=777 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.login1.Manager member=Inhibit dest=org.freedesktop.login1 spid=5155 tpid=817 scontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:systemd_logind_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1530460209.602:687): pid=777 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.56 spid=817 tpid=5155 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=AVC msg=audit(1530460209.602:688): avc:  denied  { write } for  pid=5155 comm="virtlogd" path="/run/systemd/inhibit/7.ref" dev="tmpfs" ino=674634 scontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_logind_inhibit_var_run_t:s0 tclass=fifo_file
type=AVC msg=audit(1530460209.891:703): avc:  denied  { write } for  pid=23376 comm="qemu-kvm" name="vhostuser" dev="tmpfs" ino=17292 scontext=system_u:system_r:svirt_t:s0:c837,c1004 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir
type=AVC msg=audit(1530460209.891:703): avc:  denied  { add_name } for  pid=23376 comm="qemu-kvm" name="dpdk-vhostuser-01560e59-bceb-476d-9210-057b75d208ef" scontext=system_u:system_r:svirt_t:s0:c837,c1004 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir
type=AVC msg=audit(1530460209.891:703): avc:  denied  { create } for  pid=23376 comm="qemu-kvm" name="dpdk-vhostuser-01560e59-bceb-476d-9210-057b75d208ef" scontext=system_u:system_r:svirt_t:s0:c837,c1004 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=sock_file
type=AVC msg=audit(1530531523.928:1831): avc:  denied  { write } for  pid=23376 comm="qemu-kvm" name="vhostuser" dev="tmpfs" ino=17292 scontext=system_u:system_r:svirt_t:s0:c837,c1004 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir
type=AVC msg=audit(1530531523.928:1831): avc:  denied  { remove_name } for  pid=23376 comm="qemu-kvm" name="dpdk-vhostuser-01560e59-bceb-476d-9210-057b75d208ef" dev="tmpfs" ino=698774 scontext=system_u:system_r:svirt_t:s0:c837,c1004 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir
type=AVC msg=audit(1530531523.928:1831): avc:  denied  { unlink } for  pid=23376 comm="qemu-kvm" name="dpdk-vhostuser-01560e59-bceb-476d-9210-057b75d208ef" dev="tmpfs" ino=698774 scontext=system_u:system_r:svirt_t:s0:c837,c1004 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=sock_file
type=USER_AVC msg=audit(1530531539.544:1866): pid=777 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.login1.Manager member=Inhibit dest=org.freedesktop.login1 spid=5155 tpid=817 scontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:systemd_logind_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=AVC msg=audit(1530531539.792:1879): avc:  denied  { write } for  pid=30701 comm="qemu-kvm" name="vhostuser" dev="tmpfs" ino=17292 scontext=system_u:system_r:svirt_t:s0:c623,c664 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir


Version-Release number of selected component (if applicable):
libvirt-3.9.0-14.el7_5.5.x86_64


How reproducible:
100%

Steps to Reproduce:
Create a VM with vhostuser in server mode.

Actual results:
VM fails to run.

Expected results:
VM runs.

--- Additional comment from Michal Privoznik on 2018-07-13 10:33:24 CEST ---

This problem was discussed in bug 1478791.

The solution is to let libvirt create the socket and then pass its FD to qemu. This is what 30fb2276d88 (v4.5.0-rc1~251) does. However, we had to turn the feature off because qemu has a bug when it comes to FD passing for vhostuser related chardev (ed5aa85f371aebb v4.5.0-47-ged5aa85f37). Once qemu fixes the bug we can turn the feature back on.

I'll clone this bug over to qemu for them to fix it.

Comment 1 Ademar Reis 2018-07-13 18:41:11 UTC

From libvirt:

commit ed5aa85f371aebb0103e712f9a103d011ab9ae43
Author: Daniel P. Berrangé <berrange>
Date:   Wed Jul 4 14:28:14 2018 +0100

    qemu: don't use chardev FD passing for vhostuser backend
    
    QEMU chardevs have a bug which makes the vhostuser backend complain
    about lack of support for FD passing when validating the chardev.
    While this is ultimately QEMU's responsibility to fix, libvirt needs to
    avoid tickling the bug.
    
    Simply disabling chardev FD passing just for vhostuser's chardev is
    the most prudent approach, avoiding need for a QEMU version number
    check.

Comment 2 Pei Zhang 2018-07-17 08:45:30 UTC

Hello Marc-Andre,

Is this same issue with bug[1]? The patch[2] has been sent by Daniel to fix this issue. 

[1]Bug 1598269 - vhost-user socket path is not recognized by libvirt - [QEMU side]  

[2]https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg01147.html


Best Regards,
Pei

Comment 3 Marc-Andre Lureau 2018-07-17 08:56:17 UTC

(In reply to Pei Zhang from comment #2)
> Hello Marc-Andre,
> 
> Is this same issue with bug[1]? The patch[2] has been sent by Daniel to fix
> this issue. 
> 
> [1]Bug 1598269 - vhost-user socket path is not recognized by libvirt - [QEMU
> side]  
> 
> [2]https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg01147.html

Yes, the patch is still being discussed on the mailing list.

Comment 4 Pei Zhang 2018-07-17 09:17:03 UTC

(In reply to Marc-Andre Lureau from comment #3)
> (In reply to Pei Zhang from comment #2)
> > Hello Marc-Andre,
> > 
> > Is this same issue with bug[1]? The patch[2] has been sent by Daniel to fix
> > this issue. 
> > 
> > [1]Bug 1598269 - vhost-user socket path is not recognized by libvirt - [QEMU
> > side]  
> > 
> > [2]https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg01147.html
> 
> Yes, the patch is still being discussed on the mailing list.

OK, get it. As Bug 1598269 is already tracking this issue. So close this one as duplicate. Please correct me if anything wrong. 


Thanks,
Pei

*** This bug has been marked as a duplicate of bug 1598269 ***