On trying to fire up a VM using virt-manager, I get "unable to map backing store for guest RAM: Permission denied".
I use hugepages to lock down memory for the VM, which may be relevant for the error. This worked correctly on F26 just before the upgrade to F27. I have changed nothing in my VM configuration, nor in the config file for QEMU. However, temporarily turning off SElinux allows the startup to proceed, after which I can re-enable SElinux with no ill effects, i.e. the VM runs correctly.
A complete relabel of my system (touch /.autolabel and reboot) has made no difference.
poc
On 11/14/2017 02:31 PM, Patrick O'Callaghan wrote:
On trying to fire up a VM using virt-manager, I get "unable to map backing store for guest RAM: Permission denied".
I use hugepages to lock down memory for the VM, which may be relevant for the error. This worked correctly on F26 just before the upgrade to F27. I have changed nothing in my VM configuration, nor in the config file for QEMU. However, temporarily turning off SElinux allows the startup to proceed, after which I can re-enable SElinux with no ill effects, i.e. the VM runs correctly.
A complete relabel of my system (touch /.autolabel and reboot) has made no difference.
Have you checked the AVC reports from selinux? It smells like a bad policy re: hugepages for KVMs. It's difficult to say without the actual AVC denials. ---------------------------------------------------------------------- - Rick Stevens, Systems Engineer, AllDigital ricks@alldigital.com - - AIM/Skype: therps2 ICQ: 226437340 Yahoo: origrps2 - - - - "Hello. My PID is Inigo Montoya. You `kill -9'-ed my parent - - process. Prepare to vi." - ----------------------------------------------------------------------
On Tue, 2017-11-14 at 14:50 -0800, Rick Stevens wrote:
On 11/14/2017 02:31 PM, Patrick O'Callaghan wrote:
On trying to fire up a VM using virt-manager, I get "unable to map backing store for guest RAM: Permission denied".
I use hugepages to lock down memory for the VM, which may be relevant for the error. This worked correctly on F26 just before the upgrade to F27. I have changed nothing in my VM configuration, nor in the config file for QEMU. However, temporarily turning off SElinux allows the startup to proceed, after which I can re-enable SElinux with no ill effects, i.e. the VM runs correctly.
A complete relabel of my system (touch /.autolabel and reboot) has made no difference.
Have you checked the AVC reports from selinux? It smells like a bad policy re: hugepages for KVMs. It's difficult to say without the actual AVC denials.
Not seeing anything. The only AVC reports in journalctl are about some dbus stuff unrelated to libvirtd. Interestingly the libvirtd startup lines in journalctl show:
... error : virAuditOpen:62 : Unable to initialise audit layer: Protocol not supported
but it's not clear whether that has any relevance. As I say, toggling setenforce lets libvirtd start and from then on everything works.
poc
On 11/15/17 20:20, Patrick O'Callaghan wrote:
On Tue, 2017-11-14 at 14:50 -0800, Rick Stevens wrote:
On 11/14/2017 02:31 PM, Patrick O'Callaghan wrote:
On trying to fire up a VM using virt-manager, I get "unable to map backing store for guest RAM: Permission denied".
I use hugepages to lock down memory for the VM, which may be relevant for the error. This worked correctly on F26 just before the upgrade to F27. I have changed nothing in my VM configuration, nor in the config file for QEMU. However, temporarily turning off SElinux allows the startup to proceed, after which I can re-enable SElinux with no ill effects, i.e. the VM runs correctly.
A complete relabel of my system (touch /.autolabel and reboot) has made no difference.
Have you checked the AVC reports from selinux? It smells like a bad policy re: hugepages for KVMs. It's difficult to say without the actual AVC denials.
Not seeing anything. The only AVC reports in journalctl are about some dbus stuff unrelated to libvirtd. Interestingly the libvirtd startup lines in journalctl show:
... error : virAuditOpen:62 : Unable to initialise audit layer: Protocol not supported
but it's not clear whether that has any relevance. As I say, toggling setenforce lets libvirtd start and from then on everything works.
I added a comment to your BZ but thought it would be worth mentioning here as well.
If you find your problem going away by disabling selinux but you're not getting an AVC then it may be due to "donotaudit" in the policy. So, you should have selinux enabled and run "semodule -D" to turn off donotaudit and then run your test and see if you get an AVC.
On Wed, 2017-11-22 at 12:12 +0800, Ed Greshko wrote:
On 11/15/17 20:20, Patrick O'Callaghan wrote:
On Tue, 2017-11-14 at 14:50 -0800, Rick Stevens wrote:
On 11/14/2017 02:31 PM, Patrick O'Callaghan wrote:
On trying to fire up a VM using virt-manager, I get "unable to map backing store for guest RAM: Permission denied".
I use hugepages to lock down memory for the VM, which may be relevant for the error. This worked correctly on F26 just before the upgrade to F27. I have changed nothing in my VM configuration, nor in the config file for QEMU. However, temporarily turning off SElinux allows the startup to proceed, after which I can re-enable SElinux with no ill effects, i.e. the VM runs correctly.
A complete relabel of my system (touch /.autolabel and reboot) has made no difference.
Have you checked the AVC reports from selinux? It smells like a bad policy re: hugepages for KVMs. It's difficult to say without the actual AVC denials.
Not seeing anything. The only AVC reports in journalctl are about some dbus stuff unrelated to libvirtd. Interestingly the libvirtd startup lines in journalctl show:
... error : virAuditOpen:62 : Unable to initialise audit layer: Protocol not supported
but it's not clear whether that has any relevance. As I say, toggling setenforce lets libvirtd start and from then on everything works.
I added a comment to your BZ but thought it would be worth mentioning here as well.
If you find your problem going away by disabling selinux but you're not getting an AVC then it may be due to "donotaudit" in the policy. So, you should have selinux enabled and run "semodule -D" to turn off donotaudit and then run your test and see if you get an AVC.
I think you mean "semodule -DB" as that's what the manpage gives as an example (BTW the page is phenomenally hard to understand, not least because at one point it uses MODE, at another it says "module" and at a third it says KIND, and it isn't clear if these are supposed to be the same thing).
Anyway, it had no effect. The error persists of course, but there is still no AVC report.
Thanks all the same.
poc
On 11/22/17 20:01, Patrick O'Callaghan wrote:
I think you mean "semodule -DB" as that's what the manpage gives as an example (BTW the page is phenomenally hard to understand, not least because at one point it uses MODE, at another it says "module" and at a third it says KIND, and it isn't clear if these are supposed to be the same thing).
Yes, -DB is what I meant to type.
Anyway, it had no effect. The error persists of course, but there is still no AVC report.
Thanks all the same.
I suppose I've never encountered a situation where an AVC wasn't produced. Wonder how that is then diagnosed. Oh, well.
On 11/14/2017 05:31 PM, Patrick O'Callaghan wrote:
On trying to fire up a VM using virt-manager, I get "unable to map backing store for guest RAM: Permission denied".
I use hugepages to lock down memory for the VM, which may be relevant for the error. This worked correctly on F26 just before the upgrade to F27. I have changed nothing in my VM configuration, nor in the config file for QEMU. However, temporarily turning off SElinux allows the startup to proceed, after which I can re-enable SElinux with no ill effects, i.e. the VM runs correctly.
A complete relabel of my system (touch /.autolabel and reboot) has made no difference.
If you're still hitting this, please file a libvirt bug and we can follow up from there, certainly sounds like something weird is going on
- Cooe
On 11/21/2017 12:31 PM, Cole Robinson wrote:
On 11/14/2017 05:31 PM, Patrick O'Callaghan wrote:
On trying to fire up a VM using virt-manager, I get "unable to map backing store for guest RAM: Permission denied".
I use hugepages to lock down memory for the VM, which may be relevant for the error. This worked correctly on F26 just before the upgrade to F27. I have changed nothing in my VM configuration, nor in the config file for QEMU. However, temporarily turning off SElinux allows the startup to proceed, after which I can re-enable SElinux with no ill effects, i.e. the VM runs correctly.
A complete relabel of my system (touch /.autolabel and reboot) has made no difference.
If you're still hitting this, please file a libvirt bug and we can follow up from there, certainly sounds like something weird is going on
I doubt it's a file context issue so a relabel wouldn't help. It's more of a kernel thing. It's probably controllable via one of the SELinux virt_* booleans. An AVC denial message would sure help to sort it out. ---------------------------------------------------------------------- - Rick Stevens, Systems Engineer, AllDigital ricks@alldigital.com - - AIM/Skype: therps2 ICQ: 226437340 Yahoo: origrps2 - - - - Consciousness: that annoying time between naps. - ----------------------------------------------------------------------
On Tue, 2017-11-21 at 13:04 -0800, Rick Stevens wrote:
On 11/21/2017 12:31 PM, Cole Robinson wrote:
On 11/14/2017 05:31 PM, Patrick O'Callaghan wrote:
On trying to fire up a VM using virt-manager, I get "unable to map backing store for guest RAM: Permission denied".
I use hugepages to lock down memory for the VM, which may be relevant for the error. This worked correctly on F26 just before the upgrade to F27. I have changed nothing in my VM configuration, nor in the config file for QEMU. However, temporarily turning off SElinux allows the startup to proceed, after which I can re-enable SElinux with no ill effects, i.e. the VM runs correctly.
A complete relabel of my system (touch /.autolabel and reboot) has made no difference.
If you're still hitting this, please file a libvirt bug and we can follow up from there, certainly sounds like something weird is going on
I doubt it's a file context issue so a relabel wouldn't help. It's more of a kernel thing. It's probably controllable via one of the SELinux virt_* booleans. An AVC denial message would sure help to sort it out.
See my reply to Cole. The BZ report has all the information I can find. Other than refiling it against libvirtd rather than SElinux I don't know what else I can do.
poc
On Tue, 2017-11-21 at 15:31 -0500, Cole Robinson wrote:
On 11/14/2017 05:31 PM, Patrick O'Callaghan wrote:
On trying to fire up a VM using virt-manager, I get "unable to map backing store for guest RAM: Permission denied".
I use hugepages to lock down memory for the VM, which may be relevant for the error. This worked correctly on F26 just before the upgrade to F27. I have changed nothing in my VM configuration, nor in the config file for QEMU. However, temporarily turning off SElinux allows the startup to proceed, after which I can re-enable SElinux with no ill effects, i.e. the VM runs correctly.
A complete relabel of my system (touch /.autolabel and reboot) has made no difference.
If you're still hitting this, please file a libvirt bug and we can follow up from there, certainly sounds like something weird is going on
Undoubtedly. I reported it to BZ a couple of days ago (under a different user):
https://bugzilla.redhat.com/show_bug.cgi?id=1514538
but no joy so far, and I see someone has marked it CLOSED/NOTABUG. Well that's all right then, must be my imagination. I wish I could convince Fedora that it isn't a bug.
poc
On 11/14/2017 02:31 PM, Patrick O'Callaghan wrote:
On trying to fire up a VM using virt-manager, I get "unable to map backing store for guest RAM: Permission denied".
I use hugepages to lock down memory for the VM, which may be relevant for the error. This worked correctly on F26 just before the upgrade to F27. I have changed nothing in my VM configuration, nor in the config file for QEMU. However, temporarily turning off SElinux allows the startup to proceed, after which I can re-enable SElinux with no ill effects, i.e. the VM runs correctly.
A complete relabel of my system (touch /.autolabel and reboot) has made no difference.
Possibly https://bugzilla.redhat.com/show_bug.cgi?id=1481454
On Tue, 2017-11-21 at 16:03 -0800, Samuel Sieb wrote:
On 11/14/2017 02:31 PM, Patrick O'Callaghan wrote:
On trying to fire up a VM using virt-manager, I get "unable to map backing store for guest RAM: Permission denied".
I use hugepages to lock down memory for the VM, which may be relevant for the error. This worked correctly on F26 just before the upgrade to F27. I have changed nothing in my VM configuration, nor in the config file for QEMU. However, temporarily turning off SElinux allows the startup to proceed, after which I can re-enable SElinux with no ill effects, i.e. the VM runs correctly.
A complete relabel of my system (touch /.autolabel and reboot) has made no difference.
Possibly https://bugzilla.redhat.com/show_bug.cgi?id=1481454
Certainly looks like it might be. I'll try adding a pointer to my BZ to see if anyone takes any notice.
poc
-
Cole Robinson -
Ed Greshko -
Patrick O'Callaghan -
Rick Stevens -
Samuel Sieb