Hide Forgot
Description of problem: Stopped libvirtd service, then executed the /usr/sbin/libvirtd to start the libvirtd as the foreground process. it failed to reload iptables rules. In the libvirtd.log it showed error as the follows. 21:51:55.634: 11972: debug : virCommandRunAsync:1310 : About to run /sbin/iptables --table nat --delete POSTROUTING --source 192.168.122.0/24 -p tcp ! --destination 192.168.122.0/24 --jump MASQUERADE --to-ports 1024-65535 21:51:55.634: 11972: debug : virExecWithHook:488 : /sbin/iptables --table nat --delete POSTROUTING --source 192.168.122.0/24 -p tcp ! --destination 192.168.122.0/24 --jump MASQUERADE --to-ports 1024-65535 21:51:55.634: 11972: debug : virCommandRunAsync:1326 : Command result 0, with PID 11979 21:51:55.638: 11972: error : virCommandWait:1393 : internal error Child process (/sbin/iptables --table nat --delete POSTROUTING --source 192.168.122.0/24 -p tcp ! --destination 192.168.122.0/24 --jump MASQUERADE --to-ports 1024-65535) status unexpected: exit status 1 21:51:55.638: 11972: debug : virCommandRun:1147 : Result status 0, stdout: '' stderr: '21:51:55.635: 11979: info : libvirt version: 0.9.2, package: 1.el6 (Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>, 2011-06-20-09:08:08, hs20-bc2-5.build.redhat.com) 21:51:55.635: 11979: debug : virCommandHook:1244 : Hook is done 0 libvir: error : cannot execute binary /sbin/iptables: Permission denied I tried to set selinux to "Permissive", then checking out the log again, it showed information without errors. Version-Release number of selected component (if applicable): libvirt-0.9.2-1.el6.x86_64.rpm How reproducible: always Steps to Reproduce: 1. service libvirtd stop 2. /usr/sbin/libvirtd 3. checkout the libvirtd log Actual results: Reloading iptables rules failed with permission denied. Expected results: success to reload Additional info:
Created attachment 509895 [details] libvirtd.log
Created attachment 509896 [details] audit.log
Dan - is this expected behavior (libvirtd run from a shell prompt failing to exec iptables, while libvirtd run with /etc/init.d/libvirtd start succeeds)?
If you run libvirtd directly it will not transition to the proper domain (virtd_t) and will stay in unconfined_t, Thus when libvirt attempts to transition to other domains, it blows up with these errors. We always recommend confined services be run from the init scripts to mimic what happens in the real world. http://danwalsh.livejournal.com/20210.html
Based on Dan's explanation, I'm closing this as NOTABUG - this is expected behavior.