MicroStack

[Strict Confinement] libvirt/qemu fails to start

Bug #1866185 reported by Pen Gale
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
MicroStack
Confirmed
Critical
Unassigned

Bug Description

This is an issue w/ strict confinement:

libvirtd fails to run under strict mode because qemu is trying to run setgroup, and being denied. There are also various denials on accessing devices (though these may be checks that qemu can survive, albeit running with a reduced feature set).

Logs here: https://paste.ubuntu.com/p/tQmkkHF33p/

I'm puzzled as to why qemu is trying to run setgroup. We're compiling it with what I thought were all the "just run as root" flags ...

See original description
Tags: strict
Pen Gale (pengale)
Changed in microstack:
status: New → Confirmed
importance: Undecided → High
tags: added: strict
Revision history for this message
Pen Gale (pengale) wrote :

Notes on hugepages and kvm here: https://help.ubuntu.com/community/KVM%20-%20Using%20Hugepages

description: updated
Pen Gale (pengale)
Changed in microstack:
importance: High → Critical
Revision history for this message
Pen Gale (pengale) wrote :

I've fixed this on a local branch by just turning off SETGROUP at compile time.

qemu is now failing when trying to access hugepages. I need to turn that feature off, or move the hugepages mount inside the snap (not sure if the last is possible).

summary: - [Strict Confinement] qemu running setgroup, and device access errors
+ [Strict Confinement] qemu fails to start
summary: - [Strict Confinement] qemu fails to start
+ [Strict Confinement] libvirt/qemu fails to start
Revision history for this message
Pen Gale (pengale) wrote :

WIP PR here. Contains setgroup fix. Still has issue w/ hugepages: https://review.opendev.org/#/c/713883

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.