Bug 490209 - Unable to install VM: preventing libvirtd (virtd_t) "ioctl" kvm_device_t.
Unable to install VM: preventing libvirtd (virtd_t) "ioctl" kvm_device_t.
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
rawhide
All Linux
low Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-03-13 16:20 EDT by Michael Monreal
Modified: 2009-03-18 09:05 EDT (History)
8 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-03-18 09:05:20 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Logs (9.90 KB, application/zip)
2009-03-13 17:15 EDT, Michael Monreal
no flags Details
SELinux alert (2.44 KB, text/plain)
2009-03-15 07:13 EDT, Michael Monreal
no flags Details
Alert #2 (2.46 KB, text/plain)
2009-03-16 16:31 EDT, Michael Monreal
no flags Details
Alert #3 (2.69 KB, text/plain)
2009-03-16 16:32 EDT, Michael Monreal
no flags Details

  None (edit)
Description Michael Monreal 2009-03-13 16:20:16 EDT
I wanted to test the installation of a VM from CD. I used the Ubuntu 8.10 CD and set everything up using VMM's wizard.

I needed to manually "connect" the CD, but even after that the VM does not boot.
Comment 1 Cole Robinson 2009-03-13 16:26:12 EDT
What virt-manager version are you using?

So you attached the CDROM to an existing guest? You then also need to change the VM boot device to launch off the cdrom under the Details->Boot Options.
Comment 2 Michael Monreal 2009-03-13 16:43:44 EDT
(In reply to comment #1)
> What virt-manager version are you using?
The latest in rawhide (0.7-something)

> So you attached the CDROM to an existing guest? You then also need to change
> the VM boot device to launch off the cdrom under the Details->Boot Options. 
I configured a new guest to be installed from CD. I connected the CD and also changed the boot option. The default config seems to be a VNC display but I also tried changing it to SDL.
Comment 3 Cole Robinson 2009-03-13 16:50:45 EDT
Hmm, and none of that worked? Interesting.

Can you provide:

/var/log/libvirt/qemu/VMNAME.log
~/.virt-manager/virt-manager.log
virsh dumpxml vmname (as root)

Thanks
Comment 4 Michael Monreal 2009-03-13 17:15:14 EDT
Created attachment 335164 [details]
Logs

Here's a .zip collecting all the logs.

try1: normal VM setup with disk prealocation ON => crash
try2: same, but with disk prealocation OFF => wizard finishes, connect cd, change boot, run. The text on the VM "screen" flashes to something else (like "Console not ready") for a second or two and then returns to the old look. Nothing happens.
Comment 5 Cole Robinson 2009-03-13 17:30:21 EDT
Hmm, strange. I can't really tell what's going wrong from the logs.

After the screen flashes from 'Console not ready', is the VM still running? Details->Overview should show as much.

If so, can you try 'sudo virt-viewer --connect qemu:///system VMNAME' from the command line, and see if that actually connects?

The weird thing is, disk preallocation actually isn't hooked up at the moment due to performance reasons, so whether it's selected or not shouldn't make a difference.

Are you getting any selinux warning messages through all this?
Comment 6 Michael Monreal 2009-03-13 18:17:51 EDT
(In reply to comment #5)
> Hmm, strange. I can't really tell what's going wrong from the logs.
> 
> After the screen flashes from 'Console not ready', 
It actually says "Console is not yet active for guest.", then changes back to "Guest not running"

> is the VM still running?
> Details->Overview should show as much.
Status is "Shut off"

> The weird thing is, disk preallocation actually isn't hooked up at the moment
> due to performance reasons, so whether it's selected or not shouldn't make a
> difference.
I think this is a different problem. The same problem also occurs if I don't select a harddrive at all (the VM sould be able to boot into the live CD without a hdd I think?)

> Are you getting any selinux warning messages through all this?  
No, nothing.
Comment 7 Michael Monreal 2009-03-15 07:12:04 EDT
(In reply to comment #6)
> > Are you getting any selinux warning messages through all this?  
> No, nothing.  

UPDATE!

I re-installed my test system and now I see a SELinux warning for virtd.
Comment 8 Michael Monreal 2009-03-15 07:13:12 EDT
Created attachment 335251 [details]
SELinux alert

Here's the alert message.
Comment 9 Michael Monreal 2009-03-15 09:23:07 EDT
Also, virtd shows this while starting up, which is maybe related?

libnuma: Warning: /sys not mounted or no numa system. Assuming one node
Comment 10 Cole Robinson 2009-03-16 10:25:50 EDT
After reinstalling your system, does the VM still fail to install? Does turning off selinux with 'setenforce 0' make any difference?
Comment 11 Michael Monreal 2009-03-16 16:26:13 EDT
(In reply to comment #10)
> After reinstalling your system, does the VM still fail to install? 
Yes.

> Does turning off selinux with 'setenforce 0' make any difference?  
Yes, seems to work fine then.

I have two more SElinux warnings. I'll attach those here, I think we can re-assign the bug to selinux-policy or something like that.
Comment 12 Michael Monreal 2009-03-16 16:31:39 EDT
Created attachment 335422 [details]
Alert #2
Comment 13 Michael Monreal 2009-03-16 16:32:04 EDT
Created attachment 335423 [details]
Alert #3
Comment 14 Cole Robinson 2009-03-16 16:44:39 EDT
Okay, reassigning to selinux-policy. Please see comment #12 and comment #13 for more info.
Comment 15 Daniel Berrange 2009-03-17 05:34:49 EDT
I'm wondering if this is due to fact that libvirt in rawhide does not yet have this patch included for sVirt

http://www.redhat.com/archives/libvir-list/2009-March/msg00244.html
Comment 16 Daniel Walsh 2009-03-17 13:49:23 EDT
Well none of these avc error messages are actually blocking any action.  Currently libvirt is running in permissive mode rather then unconfined. but both should be able to do everything as if SELinux was disabled.

Permissive allows us to collect avc messages during the beta and rawhide, without blocking any activity.

Michael do you see any pulseaudio failures in /var/log/audit/audit.log?

I would figure the pulseaudio is the problem.  If you remove the sound card from your image, does it work in enforcing mode?

BTW the reported AVC's will be fixed in 
selinux-policy-3.6.9-3.fc11
Comment 17 Michael Monreal 2009-03-18 08:47:55 EDT
Looks like I'm getting different results all the time...

Well, I upgraded to the lastest selinux* packages from koji and tried again. If the machine has no sound card added, it now works flawlessly (also selinux doesn't seem to mind anymore...).

I then re-added a sound card to the VM. In this case, I now get this:

---
Error starting domain: internal error unable to start guest: char device redirected to /dev/pts/0
Failed to create secure directory: Permission denied

Traceback (most recent call last):
  File "/usr/share/virt-manager/virtManager/engine.py", line 493, in run_domain
    vm.startup()
  File "/usr/share/virt-manager/virtManager/domain.py", line 558, in startup
    self.vm.create()
  File "/usr/lib/python2.6/site-packages/libvirt.py", line 287, in create
    if ret == -1: raise libvirtError ('virDomainCreate() failed', dom=self)
libvirtError: internal error unable to start guest: char device redirected to /dev/pts/0
Failed to create secure directory: Permission denied
---
Comment 18 Daniel Berrange 2009-03-18 08:55:55 EDT
That problem is solved by latest libvirt RPMs, libvirt-0.6.1-5.fc11.

NB, by 'solved', I mean that libvirt will never enable any soundcards for guests run with 'qemu:///system', when the SELinux security driver is active.
Comment 19 Daniel Walsh 2009-03-18 09:05:20 EDT
Well I am closing this bug,  since SELinux policy will handle the case where libvirt is not using a soundcard and the latest libvirt does not use pulseaudio when selinux is enforcing.  I think we still need to work with the pulseaudio people to get a common solution so virtual images can provide sound in a svirt environment.

Note You need to log in before you can comment on or make changes to this bug.