+++ This bug was initially created as a clone of Bug #1771500 +++ --- Additional comment from yafu on 2019-12-04 04:22:04 CET --- Hi Michal, The xattr was cleared when trying to start the second vm using same disk with libvirt-5.6.0-6.2.x86_64. And it works well with libvirt-5.6.0-6.1.x86_64. Could you help to check the issue please? Thanks. Test steps: 1.# virsh start vm1 Domain vm1 started 2.# getfattr -m trusted.libvirt.security -d /var/lib/libvirt/images/test.qcow2 getfattr: Removing leading '/' from absolute path names # file: var/lib/libvirt/images/test.qcow2 trusted.libvirt.security.dac="+0:+0" trusted.libvirt.security.ref_dac="1" trusted.libvirt.security.ref_selinux="1" trusted.libvirt.security.selinux="system_u:object_r:virt_image_t:s0" trusted.libvirt.security.timestamp_dac="1574640796" trusted.libvirt.security.timestamp_selinux="1574640796" 3.Start another guest using /var/lib/libvirt/images/test.qcow2: # virsh start vm2 error: Failed to start domain vm2 error: internal error: child reported (status=125): Requested operation is not valid: Setting different SELinux label on /var/lib/libvirt/images/test.qcow2 which is already in use 4.The xattr was cleared after step3: # getfattr -m trusted.libvirt.security -d /var/lib/libvirt/images/test.qcow2 no output --- Additional comment from Michal Privoznik on 2019-12-04 17:42:14 CET --- Yes, this is a bug in the patch I've pushed. Proposing the fix here: https://www.redhat.com/archives/libvir-list/2019-December/msg00246.html --- Additional comment from Michal Privoznik on 2019-12-05 15:03:33 CET --- Actually, I've talked to lmen and we agreed that the fix from comment 10 will be in a separate bug. So I'm moving this bug over to QA and will clone this one shortly.
I've merged the fix: 516b867685 qemuProcessStop: Remove image metadata only when allowed v5.10.0-64-g516b867685
Verified with libvirt-daemon-6.0.0-1.module+el8.2.0+5453+31b2b136.x86_64. Test steps: 1.# virsh start vm1 Domain vm1 started 2.#getfattr -m trusted.libvirt.security -d /var/lib/libvirt/images/test1.qcow2 getfattr: Removing leading '/' from absolute path names # file: var/lib/libvirt/images/test1.qcow2 trusted.libvirt.security.dac="+0:+0" trusted.libvirt.security.ref_dac="1" trusted.libvirt.security.ref_selinux="1" trusted.libvirt.security.selinux="unconfined_u:object_r:virt_image_t:s0" trusted.libvirt.security.timestamp_dac="1578622766" trusted.libvirt.security.timestamp_selinux="1578622766" 3.Start another guest using /var/lib/libvirt/images/test1.qcow2: # virsh start vm2 error: Failed to start domain vm2 error: internal error: child reported (status=125): Requested operation is not valid: Setting different SELinux label on /var/lib/libvirt/images/test1.qcow2 which is already in use 4.# getfattr -m trusted.libvirt.security -d /var/lib/libvirt/images/test1.qcow2 getfattr: Removing leading '/' from absolute path names # file: var/lib/libvirt/images/test1.qcow2 trusted.libvirt.security.dac="+0:+0" trusted.libvirt.security.ref_dac="1" trusted.libvirt.security.ref_selinux="1" trusted.libvirt.security.selinux="unconfined_u:object_r:virt_image_t:s0" trusted.libvirt.security.timestamp_dac="1578622766" trusted.libvirt.security.timestamp_selinux="1578622766" 5.Destroy guest vm1: #virsh destroy vm1 6.Start guest vm1: #virsh start vm1 7.# getfattr -m trusted.libvirt.security -d /var/lib/libvirt/images/test1.qcow2 getfattr: Removing leading '/' from absolute path names # file: var/lib/libvirt/images/test1.qcow2 trusted.libvirt.security.dac="+0:+0" trusted.libvirt.security.ref_dac="1" trusted.libvirt.security.ref_selinux="1" trusted.libvirt.security.selinux="unconfined_u:object_r:virt_image_t:s0" trusted.libvirt.security.timestamp_dac="1578622766" trusted.libvirt.security.timestamp_selinux="1578622766"
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:2017