Bug 969510 - libvirtd fails when security_require_confined=1 even when no LXC is used at all
Summary: libvirtd fails when security_require_confined=1 even when no LXC is used at all
Keywords:
Status: CLOSED DEFERRED
Alias: None
Product: Virtualization Tools
Classification: Community
Component: libvirt
Version: unspecified
Hardware: All
OS: All
unspecified
medium
Target Milestone: ---
Assignee: Libvirt Maintainers
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-05-31 15:41 UTC by Christoph Anton Mitterer
Modified: 2016-04-09 23:33 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-04-09 23:33:31 UTC
Embargoed:


Attachments (Terms of Use)

Description Christoph Anton Mitterer 2013-05-31 15:41:34 UTC
Hi.

With 1.0.5, when having the following lxc.conf:
security_default_confined = 1
security_require_confined = 1
everything else at defaults.

SElinux being disabled.

Starting libvirtd fails with:
2013-05-31 15:36:51.722+0000: 10040: info : libvirt version: 1.0.5
2013-05-31 15:36:51.722+0000: 10040: warning : ebiptablesDriverInitCLITools:4225 : Could not find 'ebtables' executable
2013-05-31 15:36:53.823+0000: 10040: error : virSecurityManagerNew:172 : unsupported configuration: Security driver "none" cannot create confined guests
2013-05-31 15:36:53.823+0000: 10040: error : lxcSecurityInit:1373 : Failed to initialize security drivers
2013-05-31 15:36:53.823+0000: 10040: error : virStateInitialize:837 : Initialization of LXC state driver failed
2013-05-31 15:36:53.823+0000: 10040: error : daemonRunStateInit:879 : Driver state initialization failed

Shouldn't this only fail, when there are actually any VMs using LXC (which I have not)?

Cheers,
Chris.

Comment 1 Cole Robinson 2016-04-09 23:33:31 UTC
The security manager is initialized at driver time, and your host isn't in a state to honor your explicit config request. I think failing here is fine


Note You need to log in before you can comment on or make changes to this bug.