Verify this bug with libvirt-daemon-6.6.0-7.1.module+el8.3.0+8852+b44fca9f.x86_64: S1: Start guest without vcpupin and emulatorpin in a unprivileged env 0. prepare special env: # useradd -u 33 -g 0 libvirt # chown libvirt:root /run/libvirt/qemu/ 1. disable cpuset cgroup and manualy start libvirtd: # vim /etc/libvirt/qemu.conf cgroup_controllers = ["devices", "memory", "blkio" ] stdio_handler = "file" # /usr/sbin/libvirtd 2. there is no vcpupin and emulatorpin in guest xml 3. use gdb to make a similar env: # gdb -p `pidof libvirtd` (gdb) b virProcessSetAffinity 4. start guest # virsh start vm1 (blocking) 5. in gdb terminal change libvirtd permission when set cpu Affinity: (gdb) c (gdb) c (gdb) handle SIG33 nostop Signal Stop Print Pass to program Description SIG33 No Yes Yes Real-time event 33 (gdb) call (int)setuid(33) $1 = 0 (gdb) c 6. guest start without error like "cannot set CPU affinity on process X: Operation not permitted": # virsh start vm1 Domain vm1 started 7. check libvirtd debug log, can find debug log like "cannot set CPU affinity on process 28649: Operation not permitted": 2020-11-26 06:25:59.701+0000: 28520: debug : virProcessSetAffinity:447 : Set process affinity on 28649 2020-11-26 06:25:59.701+0000: 28520: debug : virProcessSetAffinity:486 : cannot set CPU affinity on process 28649: Operation not permitted 2020-11-26 06:25:59.701+0000: 28520: debug : virProcessSetScheduler:1483 : pid=28649, policy=0, priority=0 2020-11-26 06:25:59.701+0000: 28520: debug : virFileClose:135 : Closed fd 36 2020-11-26 06:26:03.871+0000: 28520: debug : virProcessSetAffinity:447 : Set process affinity on 28650 2020-11-26 06:26:03.871+0000: 28520: debug : virProcessSetAffinity:486 : cannot set CPU affinity on process 28650: Operation not permitted S2: Start guest with vcpupin in a unprivileged env 0. prepare special env: # useradd -u 33 -g 0 libvirt # chown libvirt:root /run/libvirt/qemu/ 1. disable cpuset cgroup and manualy start libvirtd: # vim /etc/libvirt/qemu.conf cgroup_controllers = ["devices", "memory", "blkio" ] stdio_handler = "file" # /usr/sbin/libvirtd 2. set vcpupin to vcpu 0 # virsh vcpupin vm1 0 1-20 --config 3. use gdb to make a similar env: # gdb -p `pidof libvirtd` (gdb) b virProcessSetAffinity 4. start guest # virsh start vm1 (blocking) 5. in gdb terminal change libvirtd permission when set cpu Affinity: (gdb) c (gdb) c (gdb) handle SIG33 nostop Signal Stop Print Pass to program Description SIG33 No Yes Yes Real-time event 33 (gdb) call (int)setuid(33) $1 = 0 (gdb) c 6. guest should failed to start since there is vcpupin setting in guest config: # virsh start vm1 error: Failed to start domain vm1 error: cannot set CPU affinity on process 30112: Operation not permitted Also test with emulatorpin and cpuset, get the same expected results.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (virt:8.3 bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:5328