Bug 2057310 - qemu-guest-agent does not report information due to selinux denials
Summary: qemu-guest-agent does not report information due to selinux denials
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Container Native Virtualization (CNV)
Classification: Red Hat
Component: Documentation
Version: 4.10.0
Hardware: Unspecified
OS: Linux
high
high
Target Milestone: ---
: 4.11.0
Assignee: Shikha Jhala
QA Contact: Roni Kishner
URL:
Whiteboard: docscope 4.10 or 4.11
Depends On: 2028762
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-02-23 07:54 UTC by Roni Kishner
Modified: 2022-09-14 19:29 UTC (History)
23 users (show)

Fixed In Version:
Doc Type: Known Issue
Doc Text:
The qemu-guest-agent on a Fedora 35 virtual machine is blocked by SELinux and does not report data. Other Fedora versions might be affected. As a workaround, disable SELinux on the virtual machine, run the qemu-guest-agent commands, and then renable SELinux.
Clone Of: 2028762
Environment:
Last Closed: 2022-09-14 19:28:43 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker CNV-16585 0 None None None 2022-05-04 04:30:26 UTC
Red Hat Product Errata RHSA-2022:6526 0 None None None 2022-09-14 19:29:07 UTC

Description Roni Kishner 2022-02-23 07:54:40 UTC 
+++ This bug was initially created as a clone of Bug #2028762 +++

Reason of cloning: we would like to follow this bug from CNV side since CNV should support fedora 35 fully.
 
Description of problem:


Version-Release number of selected component (if applicable):

> qemu-guest-agent.x86_64                       2:6.1.0-5.fc35                 @anaconda


How reproducible:

Create a fedora 35 VM and query through qemu for information

Query the guest-agent through libvirt/qemu.

Steps to Reproduce:
1. Create a fedora 35 VM
2. Execute on virt_launcher_pod "virsh qemu-agent-command <vm_namespace>_<pod_name> guest-get-fsinfo

Actual results:


The guest agent is missing data due to selinux issues: https://github.com/kubevirt/kubevirt/issues/6857#issuecomment-985109786

Disabling selinux makes it work again.



Expected results:

qemu-guest-agent should be able to report all data by default without getting denies by selinux.
Comment 1 Geetika Kapoor 2022-02-23 12:57:34 UTC 
There is a flow that QE used to test : https://polarion.engineering.redhat.com/polarion/#/project/CNV/workitem?id=CNV-3574 but this is now broken if selinux is enabled. 
It would be good to document it so that we can avoid future support cases or customer/internal queries related to it.
Comment 10 Shikha Jhala 2022-07-27 19:51:18 UTC 
@rkishner Can you please review this release note PR: https://github.com/openshift/openshift-docs/pull/48328. Thank you.
Comment 11 Roni Kishner 2022-07-28 06:15:29 UTC 
Seems good. Thanks
Comment 12 Shikha Jhala 2022-07-28 13:17:54 UTC 
Thanks @rkishner. Can you please move this bug to Verified status?
Comment 15 errata-xmlrpc 2022-09-14 19:28:43 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: OpenShift Virtualization 4.11.0 Images security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:6526
Note You need to log in before you can comment on or make changes to this bug.