Bug 582030 - QEMU live migration with selinux and libvirt throws an error
QEMU live migration with selinux and libvirt throws an error
Status: CLOSED INSUFFICIENT_DATA
Product: Fedora
Classification: Fedora
Component: libvirt (Show other bugs)
13
All Linux
low Severity medium
: ---
: ---
Assigned To: Daniel Veillard
Fedora Extras Quality Assurance
:
Depends On:
Blocks: 600279
  Show dependency treegraph
 
Reported: 2010-04-13 17:28 EDT by Chris Lalancette
Modified: 2011-06-02 12:11 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 600279 (view as bug list)
Environment:
Last Closed: 2011-06-02 12:11:21 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Chris Lalancette 2010-04-13 17:28:41 EDT
Description of problem:
I'm testing out live migration of KVM guests as per the Fedora Test Day.  I have two identical Intel x86_64 machines, both running the Fedora Test Day image.  When trying to live migrate an F-13 x86_64 guest between them with SELinux in enforcing mode, I'm getting:


[root@localhost ~]# virsh migrate --live f13x86_64 qemu+ssh://10.16.18.131/system
error: unable to set security context '0:0' on '/var/lib/libvirt/images/f13x86_64.dsk': Permission denied

/var/log/audit/audit.log says:

type=AVC msg=audit(1271207734.988:34909): avc:  denied  { read } for  pid=2978 comm="nfsd" name="f13x86_64.dsk" dev=dm-0 ino=148940 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:svirt_image_t:s0:c399,c952 tclass=file
type=AVC msg=audit(1271207734.991:34910): avc:  denied  { read } for  pid=2978 comm="nfsd" name="f13x86_64.dsk" dev=dm-0 ino=148940 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:svirt_image_t:s0:c399,c952 tclass=file
type=AVC msg=audit(1271207734.993:34911): avc:  denied  { setattr } for  pid=2979 comm="nfsd" name="f13x86_64.dsk" dev=dm-0 ino=148940 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:svirt_image_t:s0:c399,c952 tclass=file

If I set SELinux to permissive mode, then the live migration succeeds.
Comment 1 Chris Lalancette 2010-04-13 17:30:08 EDT
Oh, I should also mention that my disk image is shared from this machine via nfs with /etc/exports that looks like:

/var/lib/libvirt/images	*(rw,no_root_squash)

Also, the versions of my packages are:

kernel-2.6.33.1-19.fc13.x86_64
libvirt-0.7.7-1.fc13.x86_64
qemu-kvm-0.12.3-6.fc13.x86_64
Comment 2 Chris Lalancette 2010-04-13 17:53:22 EDT
I should also clarify my statement about setting SELinux to permissive mode.  If I set SELinux to permissive mode on the *source* of the migration, then I get a little bit further, but then I run into another issue:

[root@localhost ~]# virsh migrate --live f13x86_64 qemu+ssh://locutus.usersys.redhat.com/system
error: internal error Process exited while reading console log output: char device redirected to /dev/pts/2
qemu: could not open disk image /var/lib/libvirt/images/f13x86_64.dsk: Permission denied

If I then set SELinux to permissive on the destination, things succeed.
Comment 3 Daniel Berrange 2010-06-08 06:29:43 EDT
This appears to show that the NFS server is unable to read the files labelled svirt_image_t which I think is probably a selinuxpolicy bug ?
Comment 4 Daniel Walsh 2010-06-08 08:11:58 EDT
Miroslav,  Need to add

mcs_file_read_all(kernel_t)
mcs_file_write_all(kernel_t)
Comment 5 Miroslav Grepl 2010-06-08 08:16:52 EDT
Added to selinux-policy-3.7.19-25.fc13
Comment 6 Bug Zapper 2011-06-02 11:25:36 EDT
This message is a reminder that Fedora 13 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 13.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '13'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 13's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 13 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 7 Chris Lalancette 2011-06-02 12:11:21 EDT
I don't really have the time to follow up on this.  Given that there have been substantial changes in qemu/libvirt, especially in the migration area, I'm just going to close this bug out.

Chris Lalancette

Note You need to log in before you can comment on or make changes to this bug.