Description of problem: Not clear xattr of image file on target host when storage migration failed after image have created on target host Version-Release number of selected component (if applicable): libvirt-daemon-7.6.0-2.el9.x86_64 How reproducible: 100% Steps to Reproduce: 1.Prepare a running guest with acpi setting: #virsh dumpxml avocado-vt-vm2 <domain> ... <os> <type arch='x86_64' machine='pc-q35-rhel8.5.0'>hvm</type> <acpi> <table type='slic'>/var/lib/libvirt/images/slic.dat</table> </acpi> </os> ... <devices> ... <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/var/lib/libvirt/images/rhel.qcow2'/> <backingStore/> <target dev='vda' bus='virtio'/> <boot order='1'/> <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/> </disk> ... </devices> ... </domain> 2.Do storage migration: # virsh migrate avocado-vt-vm2 --live --verbose --copy-storage-all qemu+ssh://X.X.X.X/system root.X.X's password: error: unable to stat: /var/lib/libvirt/images/slic.dat: No such file or directory 3.Do storage migration again: # virsh migrate avocado-vt-vm2 --live --verbose --copy-storage-all qemu+ssh://X.X.X.X/system root.X.X's password: error: Requested operation is not valid: Setting different SELinux label on /var/lib/libvirt/images/rhel.qcow2 which is already in use 4.Check the xattr of image file on target host: [target_host]## getfattr -m trusted.libvirt.security -d rhel.qcow2 # file: rhel.qcow2 trusted.libvirt.security.ref_selinux="1" trusted.libvirt.security.selinux="system_u:object_r:virt_image_t:s0" trusted.libvirt.security.timestamp_selinux="1629966171" Actual results: Libvirt should clear xattr of image file when operation finished or failed. Expected results: Not clear xattr of image file on target host when storage migration failed after image have created on target host Additional info:
I can't reproduce with libvirt-7.6.0-3.module+el8.5.0+12510+80564ecf.x86_64. Will try on RHEL9
I can't reproduce with libvirt-7.6.0-2.el9.x86_64
I can reproduce with libvirt-7.6.0-2.el9.x86_64 only when selinux is set to Permissive on target host.
Patches posted upstream: https://listman.redhat.com/archives/libvir-list/2021-September/msg00553.html
This bug can be reproduced with simpler steps: 1. Set selinux to permissive mode 2. Prepare vm xml with acpi table(but the acpi table doesn't exist on host) and local storage: <domain> ... <os> <type arch='x86_64' machine='pc-q35-rhel8.5.0'>hvm</type> <acpi> <table type='slic'>/var/lib/libvirt/images/slic.dat</table> </acpi> </os> <devices> <emulator>/usr/libexec/qemu-kvm</emulator> <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/var/lib/avocado/data/avocado-vt/images/jeos-27-x86_64.qcow2'/> <target dev='vda' bus='virtio'/> <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/> </disk> 3. Try to start vm # virsh start avocado-vt-vm1 error: Failed to start domain 'avocado-vt-vm1' error: unable to stat: /var/lib/libvirt/images/slic.dat: No such file or directory # virsh start avocado-vt-vm1 error: Failed to start domain 'avocado-vt-vm1' error: Requested operation is not valid: Setting different SELinux label on /var/lib/avocado/data/avocado-vt/images/jeos-27-x86_64.qcow2 which is already in use # virsh start avocado-vt-vm1 error: Failed to start domain 'avocado-vt-vm1' error: Requested operation is not valid: Setting different SELinux label on /var/lib/avocado/data/avocado-vt/images/jeos-27-x86_64.qcow2 which is already in use
(In reply to Michal Privoznik from comment #4) > Patches posted upstream: > > https://listman.redhat.com/archives/libvir-list/2021-September/msg00553.html Test this patch with steps in comment 5, passed.
Besides slic table, we can also use other configuration to reproduce this bug. e.g. Prepare vm with unix type serial device, while the unix path to connect doesn't exist on host. <serial type='unix'> <source mode='connect' path='/tmp/foo'/> <target type='isa-serial' port='0'> <model name='isa-serial'/> </target> </serial> # virsh start avocado-vt-vm1 error: Failed to start domain 'avocado-vt-vm1' error: unable to stat: /tmp/foo: No such file or directory # virsh start avocado-vt-vm1 error: Failed to start domain 'avocado-vt-vm1' error: Requested operation is not valid: Setting different SELinux label on /var/lib/avocado/data/avocado-vt/images/jeos-27-x86_64.qcow2.backup which is already in use
v2: https://listman.redhat.com/archives/libvir-list/2021-October/msg00738.html
Resend patches: https://listman.redhat.com/archives/libvir-list/2023-February/237947.html
Merged upstream as: fbd36ae01b selinux: Don't ignore ENOENT in Permissive mode 466920ea1d selinux: Swap two blocks handling setfilecon_raw() failure v9.0.0-229-gfbd36ae01b
Reproduced with libvirt-9.0.0-8.el9_2.x86_64. Pre-verified with libvirt-9.1.0-1.el9.x86_64. Test steps: 1.Set selinux to permissive mode: #setenforce 0 2.Prepare a vm with unix type serial device, while the unix path to connect doesn't exist on host. <serial type='unix'> <source mode='connect' path='/tmp/foo'/> <target type='isa-serial' port='0'> <model name='isa-serial'/> </target> </serial> 3.Start the vm: virsh start avocado-vt-vm1 error: Failed to start domain 'avocado-vt-vm1' error: unable to set security context 'system_u:object_r:svirt_image_t:s0:c27,c224' on '/tmp/foo': No such file or directory 4.Try to start the vm again: virsh start avocado-vt-vm1 error: Failed to start domain 'avocado-vt-vm1' error: unable to set security context 'system_u:object_r:svirt_image_t:s0:c27,c224' on '/tmp/foo': No such file or directory 5.Check the xattr of the disk image file: # getfattr -m trusted.libvirt.security -d /var/lib/libvirt/images/93-ovmf.qcow2 no output
Verified with libvirt-9.3.0-2.el9.x86_64.