Is it possible to make Opennebula and selinux friends with each other?
Virtual machines failed to boot/migrate/… after enforsing selinux and relabeling fs on the kvm nodes:
Tue Aug 13 09:09:48 2019 [Z0][VM][I]: New LCM state is BOOT
Tue Aug 13 09:09:48 2019 [Z0][VMM][I]: Generating deployment file: /var/lib/one/vms/260/deployment.0
Tue Aug 13 09:09:49 2019 [Z0][VMM][I]: Successfully execute transfer manager driver operation: tm_context.
Tue Aug 13 09:09:50 2019 [Z0][VMM][I]: ExitCode: 0
Tue Aug 13 09:09:50 2019 [Z0][VMM][I]: Successfully execute network driver operation: pre.
Tue Aug 13 09:09:51 2019 [Z0][VMM][I]: Command execution fail: cat << EOT | /var/tmp/one/vmm/kvm/deploy '/var/lib/one//datastores/101/260/deployment.0' 'one-kvm-node-03-int' 260 one-kvm-node-03-int
Tue Aug 13 09:09:51 2019 [Z0][VMM][I]: error: Failed to create domain from /var/lib/one//datastores/101/260/deployment.0
Tue Aug 13 09:09:51 2019 [Z0][VMM][I]: error: internal error: qemu unexpectedly closed the monitor: 2019-08-13T06:09:50.794535Z qemu-kvm: -drive file=/var/lib/one//datastores/101/260/disk.0,format=qcow2,if=none,id=drive-virtio-disk0,cache=none: Could not open '/var/lib/one//datastores/101/260/disk.0': Permission denied
Tue Aug 13 09:09:51 2019 [Z0][VMM][E]: Could not create domain from /var/lib/one//datastores/101/260/deployment.0
Tue Aug 13 09:09:51 2019 [Z0][VMM][I]: ExitCode: 255
Tue Aug 13 09:09:51 2019 [Z0][VMM][I]: Failed to execute virtualization driver operation: deploy.
Tue Aug 13 09:09:51 2019 [Z0][VMM][E]: Error deploying virtual machine: Could not create domain from /var/lib/one//datastores/101/260/deployment.0
Tue Aug 13 09:09:51 2019 [Z0][VM][I]: New LCM state is BOOT_FAILURE
grep one-260 /var/log/audit/audit.log | grep fail
type=VIRT_CONTROL msg=audit(1565676335.173:1603): pid=2303 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm op=start reason=booted vm="one-260" uuid=45e72a89-302e-49b5-98be-ab59494bde01 vm-pid=-1 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=failed'
type=VIRT_CONTROL msg=audit(1565676591.013:1731): pid=2303 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm op=start reason=booted vm="one-260" uuid=df20a2b8-9bdd-43b6-8d6d-ec1965779a1c vm-pid=-1 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=failed'
DS is an NFS share.
# getsebool virt_use_nfs
virt_use_nfs --> on
FS Permissions seems to be okay:
ls -lZ /var/lib/one//datastores/101/260/disk.0
lrwxrwxrwx. oneadmin oneadmin system_u:object_r:nfs_t:s0 /var/lib/one//datastores/101/260/disk.0 -> disk.0.snap/0
If the administrator isn’t experienced in the SELinux configuration, it’s recommended to disable this functionality to avoid unexpected failures. You can enable SELinux anytime later when you have the installation working.
I believed that someone has more positive experience.
In any case thanks for your time.