Sorry

         “There is avc error messages in dmesg ……”

——should be “There is no avc error……”

发件人: Huang,Chaochang
发送时间: 2013年4月25日 15:41
收件人: 'libvir-list@redhat.com'; 'libvirt-users@redhat.com'
主题: libvirt_lxc start problem when selinux enbale

Hi，all：

         the problem came out when selinux was enforced in targeted+MCS

         I start lxc through virsh——“virsh -c lxc:/// start  instance-00004bd6”

1. When selinux is Permissive，lxc start is ok

The result of “Ps auxZ” is：

system_u:system_r:virtd_lxc_t:s0-s0:c0.c1023 root 19218 0.0  0.0 47624 1244 ?  Ss   15:26   0:00 /usr/libexec/libvirt_lxc --name

system_u:system_r:svirt_lxc_net_t:s0:c192,c392 root 19219 0.3  0.0 19276 1532 ? Ss  15:26   0:00 /sbin/init

system_u:system_r:svirt_lxc_net_t:s0:c192,c392 root 19406 0.0  0.0 177444 1332 ? Sl 15:26   0:00 /sbin/rsyslogd -i /var/run/sysl

system_u:system_r:svirt_lxc_net_t:s0:c192,c392 root 19420 0.0  0.0 64120 1144 ? Ss  15:26   0:00 /usr/sbin/sshd

system_u:system_r:svirt_lxc_net_t:s0:c192,c392 root 19427 0.0  0.0 22136 956 ? Ss   15:26   0:00 xinetd -stayalive -pidfile /var

system_u:system_r:svirt_lxc_net_t:s0:c192,c392 root 19434 0.0  0.0 64316 832 ? Ss   15:26   0:00 /usr/sbin/saslauthd -m /var/run

system_u:system_r:svirt_lxc_net_t:s0:c192,c392 root 19435 0.0  0.0 64316 600 ? S    15:26   0:00 /usr/sbin/saslauthd -m /var/run

system_u:system_r:svirt_lxc_net_t:s0:c192,c392 root 19450 0.0  0.0 82388 2392 ? Ss  15:26   0:00 sendmail: rejecting new message

system_u:system_r:svirt_lxc_net_t:s0:c192,c392 51 19459 0.0  0.0 78116 2016 ?  Ss   15:26   0:00 sendmail: Queue runner@01:00:00

system_u:system_r:svirt_lxc_net_t:s0:c192,c392 root 19467 0.0  0.0 175528 3672 ? Ss 15:26   0:00 /usr/sbin/httpd

system_u:system_r:svirt_lxc_net_t:s0:c192,c392 48 19470 0.0  0.0 175528 2204 ? S    15:26   0:00 /usr/sbin/httpd

system_u:system_r:svirt_lxc_net_t:s0:c192,c392 root 19475 0.0  0.0 117212 1348 ? Ss 15:26   0:00 crond

system_u:system_r:svirt_lxc_net_t:s0:c192,c392 root 19491 0.0  0.0 4108 600 pts/0 Ss+ 15:26   0:00 /sbin/mingetty /dev/tty1

We can get into the lxc through “ssh”

2. When selinux is Enforcing，lxc start bad

Th result of “ps auxZ” is:

system_u:system_r:virtd_lxc_t:s0-s0:c0.c1023 root 20624 0.0  0.0 47624 1244 ?  Ss   15:29   0:00 /usr/libexec/libvirt_lxc --name

system_u:system_r:svirt_lxc_net_t:s0:c192,c392 root 20625 0.0  0.0 17172 1036 pts/0 Ss+ 15:29   0:00 /sbin/init

                   Only /sbin/init process started, no else. This is the real problem

                   There is avc error messages in dmesg、/var/log/messages、/var/log/secure, and the same with selinux is Permissive

         Can anybody give some hints?

Here are some system information:

Kernel version	3.3.4
Libvirt version	0.9.13
Lxc guest image	Centos 6.3

Lxc xml info is:

<!--

WARNING: THIS IS AN AUTO-GENERATED FILE. CHANGES TO IT ARE LIKELY TO BE

OVERWRITTEN AND LOST. Changes to this xml configuration should be made using:

  virsh edit instance-00004bd6

or other application using the libvirt API.

-->

<domain type='lxc'>

  <name>instance-00004bd6</name>

  <uuid>96eada0e-7ea0-4865-8271-3565811c8eb0</uuid>

  <memory unit='KiB'>524288</memory>

  <currentMemory unit='KiB'>524288</currentMemory>

  <vcpu placement='static'>1</vcpu>

  <os>

    <type arch='x86_64'>exe</type>

    <init>/sbin/init</init>

    <cmdline>console=ttyS0</cmdline>

  </os>

  <clock offset='utc'/>

  <on_poweroff>destroy</on_poweroff>

  <on_reboot>restart</on_reboot>

  <on_crash>destroy</on_crash>

  <devices>

    <emulator>/usr/libexec/libvirt_lxc</emulator>

    <filesystem type='mount' accessmode='passthrough'>

      <source dir='/home/stack/nova_state/instances/instance-00004bd6/rootfs'/>

      <target dir='/'/>

    </filesystem>

    <interface type='bridge'>

      <mac address='fa:16:3e:09:00:a2'/>

      <source bridge='br100'/>

      <filterref filter='nova-instance-instance-00004bd6-fa163e0900a2'>

        <parameter name='DHCPSERVER' value='10.0.0.1'/>

        <parameter name='IP' value='10.0.0.11'/>

        <parameter name='PROJMASK' value='255.255.254.0'/>

        <parameter name='PROJNET' value='10.0.0.0'/>

      </filterref>

    </interface>

    <console type='pty'>

      <target type='lxc' port='0'/>

    </console>

  </devices>

  <seclabel type='static' model='selinux' relabel='yes'>

     <label>system_u:system_r:svirt_lxc_net_t:s0:c192,c392</label>

  </seclabel>

</domain>

Best Regard

Huangchaochang