Description of problem: Hosted engine setup fails on start of bootstrap VM with umask 077. How reproducible: 100% Steps to Reproduce: 1. umask 077 2. hosted-engine --deploy Actual results: [ ERROR ] fatal: [localhost]: FAILED! => {"changed": true, "cmd": ["virt-install", "-n", "HostedEngineLocal", "--os-variant", "rhel8.0", "--virt-type", "kvm", "--memory", "3171", "--vcpus", "2", "--network", "network=default,mac=54:52:43:41:b1:87,model=virtio", "--disk", "/var/tmp/localvmjeby32g8/images/ca1a3e6e-5f56-4453-9582-7dfda2057cb5/41500a62-6559-4b9e-baa5-29e2bc5d5c0d", "--import", "--disk", "path=/var/tmp/localvmjeby32g8/seed.iso,device=cdrom", "--noautoconsole", "--rng", "/dev/random", "--graphics", "vnc", "--video", "vga", "--sound", "none", "--controller", "usb,model=none", "--memballoon", "none", "--boot", "hd,menu=off", "--clock", "kvmclock_present=yes"], "delta": "0:00:04.124228", "end": "2021-11-05 13:11:38.316439", "msg": "non-zero return code", "rc": 1, "start": "2021-11-05 13:11:34.192211", "stderr": "WARNING /var/tmp/localvmjeby32g8/images/ca1a3e6e-5f56-4453-9582-7dfda2057cb5/41500a62-6559-4b9e-baa5-29e2bc5d5c0d may not be accessible by the hypervisor. You will need to grant the 'qemu' user search permissions for the following directories: ['/var/tmp/localvmjeby32g8/images', '/var/tmp/localvmjeby32g8/images/ca1a3e6e-5f56-4453-9582-7dfda2057cb5']\nERROR Cannot access storage file '/var/tmp/localvmjeby32g8/images/ca1a3e6e-5f56-4453-9582-7dfda2057cb5/41500a62-6559-4b9e-baa5-29e2bc5d5c0d' (as uid:107, gid:107): Permission denied\nDomain installation does not appear to have been successful.\nIf it was, you can restart your domain by running:\n virsh --connect qemu:///system start HostedEngineLocal\notherwise, please restart your installation.", "stderr_lines": ["WARNING /var/tmp/localvmjeby32g8/images/ca1a3e6e-5f56-4453-9582-7dfda2057cb5/41500a62-6559-4b9e-baa5-29e2bc5d5c0d may not be accessible by the hypervisor. You will need to grant the 'qemu' user search permissions for the following directories: ['/var/tmp/localvmjeby32g8/images', '/var/tmp/localvmjeby32g8/images/ca1a3e6e-5f56-4453-9582-7dfda2057cb5']", "ERROR Cannot access storage file '/var/tmp/localvmjeby32g8/images/ca1a3e6e-5f56-4453-9582-7dfda2057cb5/41500a62-6559-4b9e-baa5-29e2bc5d5c0d' (as uid:107, gid:107): Permission denied", "Domain installation does not appear to have been successful.", "If it was, you can restart your domain by running:", " virsh --connect qemu:///system start HostedEngineLocal", "otherwise, please restart your installation."], "stdout": "\nStarting install...", "stdout_lines": ["", "Starting install..."]} Expected results: Should pass
umask 077 is the default value for DISA STIG host, so we need to adapt our code
Just to clarify, the host should be setup with DISA STIG profile, instead of setting the umask 077 directly before setup.
Following comment 3 we need to adapt the code to support disa stig profile - moving to post Steps to Reproduce: 1. Install the latest Rhel-h 8 with DISA STIG. 2. Run hosted-engine deployment
Test Version: ovirt-hosted-engine-ha-2.5.0-1.el8ev.noarch ovirt-ansible-collection-2.0.0-0.6.BETA.el8ev.noarch Test Steps: 1. Install RHEL8.5 iso with STIG profile 2. Remove fapolicyd 3. Upgrade to RHEL8.6 4. Install fapolicyd 5. Install rhv 6. hosted engine deploy Test Result: Hosted engine deploy successfully. Bug is fixed, move it to "VERIFIED"
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: RHV Engine and Host Common Packages security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:4712