Bug 630625 - Tunnelled migration doesn't work in RHEL 6.0 without increasing security risk
Summary: Tunnelled migration doesn't work in RHEL 6.0 without increasing security risk
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: libvirt
Version: 5.6
Hardware: All
OS: Linux
medium
low
Target Milestone: rc
: ---
Assignee: Jiri Denemark
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On: 643842
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-09-06 12:45 UTC by Jiri Denemark
Modified: 2011-04-27 06:32 UTC (History)
10 users (show)

Fixed In Version: libvirt-0.8.2-4.el5
Doc Type: Bug Fix
Doc Text:
Clone Of: 624062
: 643842 (view as bug list)
Environment:
Last Closed: 2010-11-24 18:32:04 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Jiri Denemark 2010-09-06 12:45:40 UTC
+++ This bug was initially created as a clone of Bug #624062 +++

Description of problem:

Clone of a corresponding bug fixed in RHEL-6...

Due a bug in the location of a socket file with libvirt, tunnelled migration to move a virtual machine from one host server to another doesn't work in RHEL 6.0.

There *is* a workaround, of changing the process ownership of QEMU from the default qemu:qemu:, to root:root, however this introduces potential security risk.

Chris Lalancette has created (very simple) working patches upstream, which allow tunnelled migration to work properly out of the box.  (No change to root:root ownership needed)

Comment 1 Jiri Denemark 2010-09-13 21:55:24 UTC
Fix built into libvirt-0.8.2-4.el5

Comment 3 dyuan 2010-10-12 03:13:17 UTC
The default ownership of QEMU is root:root on RHEL5.6, it's different from rhel6.

When I change the user & group to qemu in /etc/libvirt/qemu.conf manually, the libvirtd start failed with the following error in /var/log/messages:

Oct 12 11:11:35 dhcp-93-197 libvirtd: 11:11:35.264: warning : qemudStartup:1656 : Unable to create cgroup for driver: No such device or address 
Oct 12 11:11:35 dhcp-93-197 libvirtd: 11:11:35.265: error : virGetUserID:2692 : Failed to find user record for name 'qemu': Success 
Oct 12 11:11:35 dhcp-93-197 libvirtd: 11:11:35.265: error : virStateInitialize:980 : Initialization of QEMU state driver failed 
Oct 12 11:11:35 dhcp-93-197 libvirtd: 11:11:35.265: error : main:3242 : Driver state initialization failed 
Oct 12 11:11:35 dhcp-93-197 libvirtd: 11:11:35.266: warning : qemudDispatchSignalEvent:396 : Shutting down on signal 3 

We can only test the tunnelled migration with root:root on rhel5.6 now.

Comment 4 Jiri Denemark 2010-10-12 08:07:19 UTC
Can you confirm user 'qemu' exists on your system? The error message there is not very helpful in this case :-)

Comment 6 wangyimiao 2010-10-18 02:59:14 UTC
Hi 'JD',

 I use "libvirt-0.8.2-7.el5.x86_64" to test again ,I can not migrate successfully with '--tunnelled'.

It very strange ,in a new enviroment with "libvirt-0.8.2-6.el5",I can not migrate successfully as the result of comment 5 .

Issue:At source host,after a long time command will not exits and give a error message .At target host domain "mig" will keep “paused” statu

Steps:
host A:
1.vim /etc/exports
/var/lib/libvirt/images 10.66.93.197/16(rw,no_root_squash)
2. service nfs restart
3. mount 10.66.93.197:/var/lib/libvirt/images/ /mnt

host B:
4. mount 10.66.93.197:/var/lib/libvirt/images/ /mnt
5. cd /mnt
6. virt-install -n mig -r 1024 -f rhel55.img --import
the guest should boot completely.
7. ssh-keygen -t rsa
8. ssh-copy-id -i ~/.ssh/id_rsa.pub root.93.197
9. virsh migrate --live mig qemu+ssh://10.66.93.197/system --tunnelled --p2p

Issue:At source host,after a long time command will not exits and give a error message .At target host domain "mig" will keep “paused” status.

Comment 7 Jiri Denemark 2010-10-18 09:52:37 UTC
Hmm, this is another and more serious bug, the tunnelled migration doesn't work at all on 5.6. I made a new bug 643842 to track that issue. Changing this bz back to ON_QA since it should be fixed, it's just untestable before 643842 is fixed.

Comment 8 Jiri Denemark 2010-11-24 18:32:04 UTC
This is untestable with current state of qemu-kvm but the fix is included in libvirt package anyway so I'm closing this as NEXTRELEASE


Note You need to log in before you can comment on or make changes to this bug.