Re: QEMU/KVM startup error in F27

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 11/15/17 20:20, Patrick O'Callaghan wrote:
> On Tue, 2017-11-14 at 14:50 -0800, Rick Stevens wrote:
>> On 11/14/2017 02:31 PM, Patrick O'Callaghan wrote:
>>> On trying to fire up a VM using virt-manager, I get "unable to map
>>> backing store for guest RAM: Permission denied".
>>>
>>> I use hugepages to lock down memory for the VM, which may be relevant
>>> for the error. This worked correctly on F26 just before the upgrade to
>>> F27. I have changed nothing in my VM configuration, nor in the config
>>> file for QEMU. However, temporarily turning off SElinux allows the
>>> startup to proceed, after which I can re-enable SElinux with no ill
>>> effects, i.e. the VM runs correctly.
>>>
>>> A complete relabel of my system (touch /.autolabel and reboot) has made
>>> no difference.
>> Have you checked the AVC reports from selinux? It smells like a bad
>> policy re: hugepages for KVMs. It's difficult to say without the actual
>> AVC denials.
> Not seeing anything. The only AVC reports in journalctl are about some
> dbus stuff unrelated to libvirtd. Interestingly the libvirtd startup
> lines in journalctl show:
>
> ... error : virAuditOpen:62 : Unable to initialise audit layer: Protocol not supported
>
> but it's not clear whether that has any relevance. As I say, toggling
> setenforce lets libvirtd start and from then on everything works.
>
>
I added a comment to your BZ but thought it would be worth mentioning here as well.

If you find your problem going away by disabling selinux but you're not getting an
AVC then it may be due to "donotaudit" in the policy.  So, you should have selinux
enabled and run "semodule -D" to turn off donotaudit and then run your test and see
if you get an AVC.

-- 
Fedora Users List - The place to go to speculate endlessly

Attachment: signature.asc
Description: OpenPGP digital signature

_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [EPEL Devel]     [Fedora Magazine]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Desktop]     [Fedora Fonts]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Fedora Sparc]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux