Bug 2004850
| Summary: | Not clear xattr of image file on target host when storage migration failed after image have created on target host if vm uses slic table but slic table doesn't exist on target host and target host is in permissive mode | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | yafu <yafu> |
| Component: | libvirt | Assignee: | Michal Privoznik <mprivozn> |
| libvirt sub component: | General | QA Contact: | yafu <yafu> |
| Status: | CLOSED ERRATA | Docs Contact: | |
| Severity: | unspecified | ||
| Priority: | unspecified | CC: | fjin, jdenemar, lmen, meili, mprivozn, virt-maint, xuzhang, yalzhang |
| Version: | 9.0 | Keywords: | Triaged, Upstream |
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | libvirt-9.1.0-1.el9 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-11-07 08:30:47 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | 9.1.0 |
| Embargoed: | |||
I can't reproduce with libvirt-7.6.0-3.module+el8.5.0+12510+80564ecf.x86_64. Will try on RHEL9 I can't reproduce with libvirt-7.6.0-2.el9.x86_64 I can reproduce with libvirt-7.6.0-2.el9.x86_64 only when selinux is set to Permissive on target host. Patches posted upstream: https://listman.redhat.com/archives/libvir-list/2021-September/msg00553.html This bug can be reproduced with simpler steps:
1. Set selinux to permissive mode
2. Prepare vm xml with acpi table(but the acpi table doesn't exist on host) and local storage:
<domain>
...
<os>
<type arch='x86_64' machine='pc-q35-rhel8.5.0'>hvm</type>
<acpi>
<table type='slic'>/var/lib/libvirt/images/slic.dat</table>
</acpi>
</os>
<devices>
<emulator>/usr/libexec/qemu-kvm</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2'/>
<source file='/var/lib/avocado/data/avocado-vt/images/jeos-27-x86_64.qcow2'/>
<target dev='vda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
</disk>
3. Try to start vm
# virsh start avocado-vt-vm1
error: Failed to start domain 'avocado-vt-vm1'
error: unable to stat: /var/lib/libvirt/images/slic.dat: No such file or directory
# virsh start avocado-vt-vm1
error: Failed to start domain 'avocado-vt-vm1'
error: Requested operation is not valid: Setting different SELinux label on /var/lib/avocado/data/avocado-vt/images/jeos-27-x86_64.qcow2 which is already in use
# virsh start avocado-vt-vm1
error: Failed to start domain 'avocado-vt-vm1'
error: Requested operation is not valid: Setting different SELinux label on /var/lib/avocado/data/avocado-vt/images/jeos-27-x86_64.qcow2 which is already in use
(In reply to Michal Privoznik from comment #4) > Patches posted upstream: > > https://listman.redhat.com/archives/libvir-list/2021-September/msg00553.html Test this patch with steps in comment 5, passed. Besides slic table, we can also use other configuration to reproduce this bug.
e.g. Prepare vm with unix type serial device, while the unix path to connect doesn't exist on host.
<serial type='unix'>
<source mode='connect' path='/tmp/foo'/>
<target type='isa-serial' port='0'>
<model name='isa-serial'/>
</target>
</serial>
# virsh start avocado-vt-vm1
error: Failed to start domain 'avocado-vt-vm1'
error: unable to stat: /tmp/foo: No such file or directory
# virsh start avocado-vt-vm1
error: Failed to start domain 'avocado-vt-vm1'
error: Requested operation is not valid: Setting different SELinux label on /var/lib/avocado/data/avocado-vt/images/jeos-27-x86_64.qcow2.backup which is already in use
Merged upstream as: fbd36ae01b selinux: Don't ignore ENOENT in Permissive mode 466920ea1d selinux: Swap two blocks handling setfilecon_raw() failure v9.0.0-229-gfbd36ae01b Reproduced with libvirt-9.0.0-8.el9_2.x86_64.
Pre-verified with libvirt-9.1.0-1.el9.x86_64.
Test steps:
1.Set selinux to permissive mode:
#setenforce 0
2.Prepare a vm with unix type serial device, while the unix path to connect doesn't exist on host.
<serial type='unix'>
<source mode='connect' path='/tmp/foo'/>
<target type='isa-serial' port='0'>
<model name='isa-serial'/>
</target>
</serial>
3.Start the vm:
virsh start avocado-vt-vm1
error: Failed to start domain 'avocado-vt-vm1'
error: unable to set security context 'system_u:object_r:svirt_image_t:s0:c27,c224' on '/tmp/foo': No such file or directory
4.Try to start the vm again:
virsh start avocado-vt-vm1
error: Failed to start domain 'avocado-vt-vm1'
error: unable to set security context 'system_u:object_r:svirt_image_t:s0:c27,c224' on '/tmp/foo': No such file or directory
5.Check the xattr of the disk image file:
# getfattr -m trusted.libvirt.security -d /var/lib/libvirt/images/93-ovmf.qcow2
no output
Verified with libvirt-9.3.0-2.el9.x86_64. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: libvirt security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2023:6409 |
Description of problem: Not clear xattr of image file on target host when storage migration failed after image have created on target host Version-Release number of selected component (if applicable): libvirt-daemon-7.6.0-2.el9.x86_64 How reproducible: 100% Steps to Reproduce: 1.Prepare a running guest with acpi setting: #virsh dumpxml avocado-vt-vm2 <domain> ... <os> <type arch='x86_64' machine='pc-q35-rhel8.5.0'>hvm</type> <acpi> <table type='slic'>/var/lib/libvirt/images/slic.dat</table> </acpi> </os> ... <devices> ... <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/var/lib/libvirt/images/rhel.qcow2'/> <backingStore/> <target dev='vda' bus='virtio'/> <boot order='1'/> <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/> </disk> ... </devices> ... </domain> 2.Do storage migration: # virsh migrate avocado-vt-vm2 --live --verbose --copy-storage-all qemu+ssh://X.X.X.X/system root.X.X's password: error: unable to stat: /var/lib/libvirt/images/slic.dat: No such file or directory 3.Do storage migration again: # virsh migrate avocado-vt-vm2 --live --verbose --copy-storage-all qemu+ssh://X.X.X.X/system root.X.X's password: error: Requested operation is not valid: Setting different SELinux label on /var/lib/libvirt/images/rhel.qcow2 which is already in use 4.Check the xattr of image file on target host: [target_host]## getfattr -m trusted.libvirt.security -d rhel.qcow2 # file: rhel.qcow2 trusted.libvirt.security.ref_selinux="1" trusted.libvirt.security.selinux="system_u:object_r:virt_image_t:s0" trusted.libvirt.security.timestamp_selinux="1629966171" Actual results: Libvirt should clear xattr of image file when operation finished or failed. Expected results: Not clear xattr of image file on target host when storage migration failed after image have created on target host Additional info: