libvirt daemon fails to start when security driver changed in qemu.conf

[bugproxy]

== Comment: #0 - Satheesh Rajendran <email address hidden> - 2016-08-29 05:28:08 ==
---Problem Description---
libvirt daemon fails to start when security driver changed in qemu.conf

Contact Information = <email address hidden>

---uname output---
Linux ltc-test-ci1 4.4.0-9134-generic #53-Ubuntu SMP Thu Aug 18 05:21:43 UTC 2016 ppc64le ppc64le ppc64le GNU/Linux

Machine Type = power 8 ppc64le

---Debugger---
A debugger is not configured

---Steps to Reproduce---
 1. Change "security_driver" in /etc/libvirt/qemu.conf into any of the value(none, apparmor, selinux) libvirt daemon fails to start

# grep ^security_driver /etc/libvirt/qemu.conf
security_driver = ["none"]

#service libvirtd restart
# service libvirtd status
? libvirtd.service - Virtualization daemon
   Loaded: loaded (/lib/systemd/system/libvirtd.service; enabled; vendor preset: enabled)
   Active: inactive (dead) since Mon 2016-08-29 04:06:15 CDT; 6s ago
     Docs: man:libvirtd(8)
           http://libvirt.org
  Process: 61097 ExecStart=/usr/sbin/libvirtd $libvirtd_opts (code=exited, status=0/SUCCESS)
 Main PID: 61097 (code=exited, status=0/SUCCESS)
    Tasks: 2
   Memory: 57.5M
      CPU: 702ms
   CGroup: /system.slice/libvirtd.service
           ??4070 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
           ??4071 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper

Aug 29 04:06:14 ltc-test-ci1 systemd[1]: Starting Virtualization daemon...
Aug 29 04:06:14 ltc-test-ci1 systemd[1]: Started Virtualization daemon.
Aug 29 04:06:15 ltc-test-ci1 dnsmasq[4070]: read /etc/hosts - 5 addresses
Aug 29 04:06:15 ltc-test-ci1 dnsmasq[4070]: read /var/lib/libvirt/dnsmasq/default.addnhosts - 0 addresses
Aug 29 04:06:15 ltc-test-ci1 dnsmasq-dhcp[4070]: read /var/lib/libvirt/dnsmasq/default.hostsfile
Aug 29 04:06:15 ltc-test-ci1 libvirtd[61097]: libvirt version: 2.1.0, package: 1ubuntu3 (Stefan Bader <email address hidden> Wed, 17 Aug 2016 18:31:01 +0200)
Aug 29 04:06:15 ltc-test-ci1 libvirtd[61097]: hostname: ltc-test-ci1.aus.stglabs.ibm.com
Aug 29 04:06:15 ltc-test-ci1 libvirtd[61097]: configuration file syntax error: Duplicate security driver none---------------------------------------------------------------------------------------------------------------------------------------------NOK
Aug 29 04:06:15 ltc-test-ci1 libvirtd[61097]: Initialization of QEMU state driver failed: configuration file syntax error: Duplicate security driver none
Aug 29 04:06:15 ltc-test-ci1 libvirtd[61097]: Driver state initialization failed

# grep ^security_driver /etc/libvirt/qemu.conf
security_driver = ["apparmor"]

#service libvirtd restart
# service libvirtd status
...
Aug 29 04:02:34 ltc-test-ci1 libvirtd[61015]: configuration file syntax error: Duplicate security driver apparmor

grep ^security_driver /etc/libvirt/qemu.conf
security_driver = ["selinux"]

#service libvirtd restart
# service libvirtd status
...
Aug 29 04:08:30 ltc-test-ci1 libvirtd[61171]: configuration file syntax error: Duplicate security driver selinux

# grep ^security_driver /etc/libvirt/qemu.conf
security_driver = "selinux"

#service libvirtd restart
# service libvirtd status
...
Aug 29 04:09:30 ltc-test-ci1 libvirtd[61241]: configuration file syntax error: Duplicate security driver selinux

# grep ^security_driver /etc/libvirt/qemu.conf
security_driver = "apparmor"

#service libvirtd restart
# service libvirtd status
...
Aug 29 04:11:46 ltc-test-ci1 libvirtd[61309]: configuration file syntax error: Duplicate security driver apparmor

LIbvirt daemon only starts if the security_driver option is disabled in config file

# grep ^#security_driver /etc/libvirt/qemu.conf
#security_driver = "none"
# service libvirtd restart
# service libvirtd status
? libvirtd.service - Virtualization daemon
   Loaded: loaded (/lib/systemd/system/libvirtd.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2016-08-29 04:26:26 CDT; 7s ago

Userspace tool common name: ii libvirt-bin 2.1.0-1ubuntu3 ppc64el programs for the libvirt library

The userspace tool has the following bit modes: both

Userspace rpm: ii libvirt-bin 2.1.0-1ubuntu3 ppc64el programs for the libvirt library

Userspace tool obtained from project website: na

*Additional Instructions for <email address hidden>:
-Post a private note with access information to the machine that the bug is occuring on.
-Attach ltrace and strace of userspace application.

== Comment: #2 - Gary M. Gaydos <email address hidden> - 2016-08-29 10:01:17 ==
It looks like this known bug: https://<email address hidden>/msg133931.html

[bugproxy (bugproxy)]

Default Comment by Bridge

[bugproxy (bugproxy)]

Default Comment by Bridge

[Jon Grimm (jgrimm)]

Duplicated on amd64 so not arch specific. Was not able to duplicate on xenial.

[Jon Grimm (jgrimm)]

I've tested that the pointed to upstream patch fixes the issue on an amd64.

IBM can you kindly test that it works for you on your ppc64el system?

sudo add-apt-repository ppa:jgrimm/libvirt-1618592-2
sudo apt-get update
sudo apt-get dist-upgrade

should get you the fixed up version for you to verify the fix. Thanks!

[Jon Grimm (jgrimm)]

Attaching debdiff in anticipaation of verification.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "Debdiff with fix for 1618592" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[bugproxy (bugproxy)]

Default Comment by Bridge

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2016-08-31 15:13 EDT-------
Hi Sateesh (IBM),
Please see comments 10 from Canonical. It describes how you can get a patched version of libvirt to test. Please test the patched libvirt and update this bug with your results.
Thanks, Gary

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2016-09-01 01:50 EDT-------
(In reply to comment #10)
> I've tested that the pointed to upstream patch fixes the issue on an amd64.
>
> IBM can you kindly test that it works for you on your ppc64el system?
>
> sudo add-apt-repository ppa:jgrimm/libvirt-1618592-2
> sudo apt-get update
> sudo apt-get dist-upgrade
>
> should get you the fixed up version for you to verify the fix. Thanks!

Tested witth above patched package and found it is working as expected,

# grep ^security /etc/libvirt/qemu.conf
security_driver = [ "apparmor" ]
# service libvirtd restart
# service libvirtd status
? libvirtd.service - Virtualization daemon
Loaded: loaded (/lib/systemd/system/libvirtd.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2016-09-01 00:47:11 CDT; 4s ago
Docs: man:libvirtd(8)
http://libvirt.org
Main PID: 2955 (libvirtd)
Tasks: 18
Memory: 103.1M
CPU: 792ms
CGroup: /system.slice/libvirtd.service
??2219 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
??2220 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
??2955 /usr/sbin/libvirtd

#grep ^security /etc/libvirt/qemu.conf
security_driver = [ "none" ]

#service libvirtd restart
# service libvirtd status
? libvirtd.service - Virtualization daemon
Loaded: loaded (/lib/systemd/system/libvirtd.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2016-09-01 00:40:36 CDT; 2s ago
Docs: man:libvirtd(8)
http://libvirt.org
Main PID: 2799 (libvirtd)
Tasks: 18
Memory: 100.8M
CPU: 773ms
CGroup: /system.slice/libvirtd.service
??2219 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
??2220 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
??2799 /usr/sbin/libvirtd

[Jon Grimm (jgrimm)]

Thank you for testing. Ready for Sponsor.

[Stefan Bader (smb)]

Looks sensible, preparing an upload.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libvirt - 2.1.0-1ubuntu5

---------------
libvirt (2.1.0-1ubuntu5) yakkety; urgency=medium

  [ Jon Grimm ]

  * Fix libvirt start failure when security_driver set (LP: #1618592)
    - qemu: fix qemu.conf security_driver

 -- Stefan Bader <email address hidden> Thu, 08 Sep 2016 14:11:47 +0200