+++ This bug was initially created as a clone of Bug #1599289 +++ --- Additional comment from Martin Schuppert on 2018-07-06 08:02:50 EDT --- With patches applied to an osp13 test env: parameter_defaults: NovaNfsEnabled: True NovaNfsShare: '192.168.24.1:/var/nfs' [root@compute-0 ~]# mount |grep nfs4 192.168.24.1:/var/nfs on /var/lib/nova/instances type nfs4 (rw,relatime,context=system_u:object_r:nova_var_lib_t:s0,vers=4.1,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=sys,clientaddr=192.168.24.14,local_lock=none,addr=192.168.24.1,_netdev) [root@compute-1 ~]# mount |grep nfs4 192.168.24.1:/var/nfs on /var/lib/nova/instances type nfs4 (rw,relatime,context=system_u:object_r:nova_var_lib_t:s0,vers=4.1,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=sys,clientaddr=192.168.24.16,local_lock=none,addr=192.168.24.1,_netdev) (overcloud) [stack@undercloud-0 ~]$ openstack server create --flavor m1.small --image cirros --nic net-id=ec392c10-f897-493b-941b-a3f6a0084122 test-nfs (overcloud) [stack@undercloud-0 ~]$ openstack server list --long +--------------------------------------+----------+--------+------------+-------------+---------------------+------------+--------------------------------------+-------------+--------------------------------------+-------------------+--------------------------------+------------+ | ID | Name | Status | Task State | Power State | Networks | Image Name | Image ID | Flavor Name | Flavor ID | Availability Zone | Host | Properties | +--------------------------------------+----------+--------+------------+-------------+---------------------+------------+--------------------------------------+-------------+--------------------------------------+-------------------+--------------------------------+------------+ | 22659aca-22ea-4e79-a761-a36e2953da28 | test-nfs | ACTIVE | None | Running | private=192.168.0.5 | cirros | 4d956919-6e5d-4968-9040-1c0fc4b15401 | m1.small | c681e5a6-23c9-4de0-bc99-3b21afb87c9a | nova | compute-1.external.localdomain | | +--------------------------------------+----------+--------+------------+-------------+---------------------+------------+--------------------------------------+-------------+--------------------------------------+-------------------+--------------------------------+------------+ (overcloud) [stack@undercloud-0 ~]$ nova live-migration 22659aca-22ea-4e79-a761-a36e2953da28 (overcloud) [stack@undercloud-0 ~]$ openstack server list --long +--------------------------------------+----------+--------+------------+-------------+---------------------+------------+--------------------------------------+-------------+--------------------------------------+-------------------+--------------------------------+------------+ | ID | Name | Status | Task State | Power State | Networks | Image Name | Image ID | Flavor Name | Flavor ID | Availability Zone | Host | Properties | +--------------------------------------+----------+--------+------------+-------------+---------------------+------------+--------------------------------------+-------------+--------------------------------------+-------------------+--------------------------------+------------+ | 22659aca-22ea-4e79-a761-a36e2953da28 | test-nfs | ACTIVE | None | Running | private=192.168.0.5 | cirros | 4d956919-6e5d-4968-9040-1c0fc4b15401 | m1.small | c681e5a6-23c9-4de0-bc99-3b21afb87c9a | nova | compute-0.external.localdomain | | +--------------------------------------+----------+--------+------------+-------------+---------------------+------------+--------------------------------------+-------------+--------------------------------------+-------------------+--------------------------------+------------+ Note: I had to add the following selinux module as otherwise instance start failed with permission errors. ~~~ module my-nova-nfs 1.0; require { type nova_var_lib_t; type svirt_t; class file { getattr ioctl lock open read }; } #============= svirt_t ============== allow svirt_t nova_var_lib_t:file { getattr ioctl lock open read }; ~~~ [root@compute-0 ~]# checkmodule -M -m -o my-nova-nfs.mod my-nova-nfs.te [root@compute-0 ~]# semodule_package -o my-nova-nfs.pp -m my-nova-nfs.mod [root@compute-0 ~]# semodule -i my-nova-nfs.pp --- Additional comment from Martin Schuppert on 2018-07-09 08:23:41 EDT --- With patches applied to an osp13 test env: parameter_defaults: NovaNfsEnabled: True NovaNfsShare: '192.168.24.1:/var/nfs' [root@compute-0 ~]# mount |grep nfs4 192.168.24.1:/var/nfs on /var/lib/nova/instances type nfs4 (rw,relatime,context=system_u:object_r:nova_var_lib_t:s0,vers=4.1,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=sys,clientaddr=192.168.24.14,local_lock=none,addr=192.168.24.1,_netdev) [root@compute-1 ~]# mount |grep nfs4 192.168.24.1:/var/nfs on /var/lib/nova/instances type nfs4 (rw,relatime,context=system_u:object_r:nova_var_lib_t:s0,vers=4.1,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=sys,clientaddr=192.168.24.16,local_lock=none,addr=192.168.24.1,_netdev) (overcloud) [stack@undercloud-0 ~]$ openstack server create --flavor m1.small --image cirros --nic net-id=ec392c10-f897-493b-941b-a3f6a0084122 test-nfs (overcloud) [stack@undercloud-0 ~]$ openstack server list --long +--------------------------------------+----------+--------+------------+-------------+---------------------+------------+--------------------------------------+-------------+--------------------------------------+-------------------+--------------------------------+------------+ | ID | Name | Status | Task State | Power State | Networks | Image Name | Image ID | Flavor Name | Flavor ID | Availability Zone | Host | Properties | +--------------------------------------+----------+--------+------------+-------------+---------------------+------------+--------------------------------------+-------------+--------------------------------------+-------------------+--------------------------------+------------+ | 22659aca-22ea-4e79-a761-a36e2953da28 | test-nfs | ACTIVE | None | Running | private=192.168.0.5 | cirros | 4d956919-6e5d-4968-9040-1c0fc4b15401 | m1.small | c681e5a6-23c9-4de0-bc99-3b21afb87c9a | nova | compute-1.external.localdomain | | +--------------------------------------+----------+--------+------------+-------------+---------------------+------------+--------------------------------------+-------------+--------------------------------------+-------------------+--------------------------------+------------+ (overcloud) [stack@undercloud-0 ~]$ nova live-migration 22659aca-22ea-4e79-a761-a36e2953da28 (overcloud) [stack@undercloud-0 ~]$ openstack server list --long +--------------------------------------+----------+--------+------------+-------------+---------------------+------------+--------------------------------------+-------------+--------------------------------------+-------------------+--------------------------------+------------+ | ID | Name | Status | Task State | Power State | Networks | Image Name | Image ID | Flavor Name | Flavor ID | Availability Zone | Host | Properties | +--------------------------------------+----------+--------+------------+-------------+---------------------+------------+--------------------------------------+-------------+--------------------------------------+-------------------+--------------------------------+------------+ | 22659aca-22ea-4e79-a761-a36e2953da28 | test-nfs | ACTIVE | None | Running | private=192.168.0.5 | cirros | 4d956919-6e5d-4968-9040-1c0fc4b15401 | m1.small | c681e5a6-23c9-4de0-bc99-3b21afb87c9a | nova | compute-0.external.localdomain | | +--------------------------------------+----------+--------+------------+-------------+---------------------+------------+--------------------------------------+-------------+--------------------------------------+-------------------+--------------------------------+------------+ Note: I had to add the following selinux module as otherwise instance start failed with permission errors. ~~~ module my-nova-nfs 1.0; require { type nova_var_lib_t; type svirt_t; class file { getattr ioctl lock open read }; } #============= svirt_t ============== allow svirt_t nova_var_lib_t:file { getattr ioctl lock open read }; ~~~ [root@compute-0 ~]# checkmodule -M -m -o my-nova-nfs.mod my-nova-nfs.te [root@compute-0 ~]# semodule_package -o my-nova-nfs.pp -m my-nova-nfs.mod [root@compute-0 ~]# semodule -i my-nova-nfs.pp => affects OSP13 (openstack-selinux-0.8.14-12.el7ost.noarch) + OSP14 (openstack-selinux-0.8.15-0.20180524134826.b63283a.el7ost.noarch) --- Additional comment from Lon Hohberger on 2018-07-13 15:21:00 EDT --- It sounds like the wrong label is being used for the NFS mount: system_u:object_r:nfs_t:s0 should have access. My guess is that the mountpoint is mounted with a -ocontext=... that breaks things. So, the virt_use_nfs boolean, which is turned on by openstack-selinux, should cover this use case. Granting svirt_t generic access to write over nova_var_lib_t isn't ideal. --- Additional comment from Martin Schuppert on 2018-07-16 06:00:37 EDT --- (In reply to Lon Hohberger from comment #2) > It sounds like the wrong label is being used for the NFS mount: > > system_u:object_r:nfs_t:s0 should have access. My guess is that the > mountpoint is mounted with a -ocontext=... that breaks things. > > So, the virt_use_nfs boolean, which is turned on by openstack-selinux, > should cover this use case. Granting svirt_t generic access to write over > nova_var_lib_t isn't ideal. yes, right the default in THT is set to nova_var_lib_t in [1]. I'll move this to THT and submit a patch to have nfs_t as the default. [1] https://github.com/openstack/tripleo-heat-templates/blob/master/puppet/services/nova-compute.yaml#L68
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2019:0045