Bug 969510 - libvirtd fails when security_require_confined=1 even when no LXC is used at all
libvirtd fails when security_require_confined=1 even when no LXC is used at all
Status: CLOSED DEFERRED
Product: Virtualization Tools
Classification: Community
Component: libvirt (Show other bugs)
unspecified
All All
unspecified Severity medium
: ---
: ---
Assigned To: Libvirt Maintainers
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-05-31 11:41 EDT by Christoph Anton Mitterer
Modified: 2016-04-09 19:33 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-04-09 19:33:31 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Christoph Anton Mitterer 2013-05-31 11:41:34 EDT
Hi.

With 1.0.5, when having the following lxc.conf:
security_default_confined = 1
security_require_confined = 1
everything else at defaults.

SElinux being disabled.

Starting libvirtd fails with:
2013-05-31 15:36:51.722+0000: 10040: info : libvirt version: 1.0.5
2013-05-31 15:36:51.722+0000: 10040: warning : ebiptablesDriverInitCLITools:4225 : Could not find 'ebtables' executable
2013-05-31 15:36:53.823+0000: 10040: error : virSecurityManagerNew:172 : unsupported configuration: Security driver "none" cannot create confined guests
2013-05-31 15:36:53.823+0000: 10040: error : lxcSecurityInit:1373 : Failed to initialize security drivers
2013-05-31 15:36:53.823+0000: 10040: error : virStateInitialize:837 : Initialization of LXC state driver failed
2013-05-31 15:36:53.823+0000: 10040: error : daemonRunStateInit:879 : Driver state initialization failed

Shouldn't this only fail, when there are actually any VMs using LXC (which I have not)?

Cheers,
Chris.
Comment 1 Cole Robinson 2016-04-09 19:33:31 EDT
The security manager is initialized at driver time, and your host isn't in a state to honor your explicit config request. I think failing here is fine

Note You need to log in before you can comment on or make changes to this bug.