RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 825068 - Start a guest with assigned usb device which is used by another guest will reset the label
Summary: Start a guest with assigned usb device which is used by another guest will re...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libvirt
Version: 6.3
Hardware: x86_64
OS: Linux
low
low
Target Milestone: rc
: ---
Assignee: Michal Privoznik
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-05-25 02:07 UTC by weizhang
Modified: 2013-02-21 07:15 UTC (History)
9 users (show)

Fixed In Version: libvirt-0.9.13-3.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-02-21 07:15:25 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
log for starting 2 guest with assigned same usb (40.04 KB, text/plain)
2012-05-25 02:07 UTC, weizhang 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0276 0 normal SHIPPED_LIVE Moderate: libvirt security, bug fix, and enhancement update 2013-02-20 21:18:26 UTC

Description weizhang 2012-05-25 02:07:03 UTC 
Created attachment 586744 [details]
log for starting 2 guest with assigned same usb

Description of problem:
When start the guest with assigned usb device which is used by other guest will cause the label of use changed back to
system_u:object_r:usb_device_t:s0

Version-Release number of selected component (if applicable):
kernel-2.6.32-269.el6.x86_64
qemu-kvm-0.12.1.2-2.292.el6.x86_64
libvirt-0.9.10-21.el6.x86_64


How reproducible:
100%

Steps to Reproduce:
1. Start a guest with assigned usb device, check the label of usb
# cat usb.xml
    <hostdev mode='subsystem' type='usb' managed='yes'>
      <source>
        <address bus='2' device='7'/>
      </source>
    </hostdev>
# virsh attach-device kvm-rhel6u3-x86_64 usb.xml --persistent
# virsh start kvm-rhel6u3-x86_64
Domain kvm-rhel6u3-x86_64 started

# ll /dev/bus/usb/002/ -Z
crw-rw-r--. root root system_u:object_r:usb_device_t:s0 001
crw-rw-r--. qemu qemu system_u:object_r:svirt_image_t:s0:c402,c919 007

2. Start second guest with assigned same usb device, check the label of usb
# virsh attach-device kvm-rhel6u3-i386 usb.xml --persistent
# virsh start kvm-rhel6u3-i386
error: Failed to start domain kvm-rhel6u3-i386
error: Requested operation is not valid: USB device 002:007 is in use by domain kvm-rhel6u3-x86_64

# ll /dev/bus/usb/002/ -Z
crw-rw-r--. root root system_u:object_r:usb_device_t:s0 001
crw-rw-r--. root root system_u:object_r:usb_device_t:s0 007

  
Actual results:
The label changed back to system_u:object_r:usb_device_t:s0

Expected results:
The label should keep after first guest started

Additional info:
Comment 1 Michal Privoznik 2012-06-12 09:32:21 UTC 
Moving to POST:

commit 86032b2276ace5a7977aad2bbae73b4c33e31914
Author:     Michal Privoznik <mprivozn>
AuthorDate: Mon Jun 11 15:57:19 2012 +0200
Commit:     Michal Privoznik <mprivozn>
CommitDate: Tue Jun 12 11:14:38 2012 +0200

    qemu: Don't overwrite security labels
    
    Currently, if qemuProcessStart fail at some point, e.g. because
    domain being started wants a PCI/USB device already assigned to
    a different domain, we jump to cleanup label where qemuProcessStop
    is performed. This unconditionally calls virSecurityManagerRestoreAllLabel
    which is wrong because the other domain is still using those devices.
    
    However, once we successfully label all devices/paths in
    qemuProcessStart() from that point on, we have to perform a rollback
    on failure - that is - we have to virSecurityManagerRestoreAllLabel.

commit 69dd77149cacc6b12740bd70b729b6cb7506f4e0
Author:     Michal Privoznik <mprivozn>
AuthorDate: Mon Jun 11 15:20:44 2012 +0200
Commit:     Michal Privoznik <mprivozn>
CommitDate: Tue Jun 12 09:57:02 2012 +0200

    qemuProcessStop: Switch to flags
    
    Currently, we are passing only one boolean (migrated) so there is
    no real profit in this. But it creates starting position for
    next patch.

v0.9.12-180-g86032b2
v0.9.12-179-g69dd771
Comment 4 Alex Jia 2012-07-24 08:46:45 UTC 
I can reproduce this issue on libvirt-0.9.10-21.el6.x86_64 with qemu-img-rhev-0.12.1.2-2.295.el6.x86_64, and it's fine on libvirt-0.9.13-3.el6.x86_64 with qemu-img-rhev-0.12.1.2-2.295.el6.x86_64, so move the bug to VERIFIED status.
Comment 5 errata-xmlrpc 2013-02-21 07:15:25 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0276.html
Note You need to log in before you can comment on or make changes to this bug.