<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div></div><div><br></div><div><br>On 25 May 2016, at 19:29, Cam Mac <<a href="mailto:iucounu@gmail.com">iucounu@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr">Hi Michal,<div><br></div><div>Ran restorecon -r on '/' (and restarted vdsmd and other services): it is still getting selinux errors. I'd like to keep selinux running, especially as it is officially supported </div></div></div></blockquote><div><br></div>Yeah. Hm, dunno why it didn't work, perhaps the config is not set up correctly. I thought redeploy would fix it but I don't really know the deployment code so maybe I'm wrong<div><br><blockquote type="cite"><div><div dir="ltr"><div>(and works on the other node), so I guess the best option is to reinstall the OS and then install ovirt again perhaps.</div></div></div></blockquote><div><br></div>That's the most easy way out, yes:)</div><div><br></div><div>Thanks,</div><div>michal<br><blockquote type="cite"><div><div dir="ltr"><div><br></div><div>Thanks,</div><div><br></div><div>Campbell</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 25, 2016 at 6:15 PM, Michal Skrivanek <span dir="ltr"><<a href="mailto:mskrivan@redhat.com" target="_blank">mskrivan@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><span class=""><div></div><div><br></div><div><br>On 25 May 2016, at 19:12, Cam Mac <<a href="mailto:iucounu@gmail.com" target="_blank">iucounu@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr">I'll try that - presumably on the paths it is complaining about, and the qemu binarys?</div></div></blockquote><div><br></div></span>It shouldn't hurt on /, it should only help:)<div>And if it complains e.g. on attached nfs, the i suppose you need to run it there too<div><div class="h5"><br><div><br><blockquote type="cite"><div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 25, 2016 at 4:59 PM, Michal Skrivanek <span dir="ltr"><<a href="mailto:michal.skrivanek@redhat.com" target="_blank">michal.skrivanek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><br><div><span><blockquote type="cite"><div>On 25 May 2016, at 17:35, Cam Mac <<a href="mailto:iucounu@gmail.com" target="_blank">iucounu@gmail.com</a>> wrote:</div><br><div><div dir="ltr">Hi Michal,<div><br></div><div>I chose the 'reinstall node' option from the GUI menu, which appeared to go ok, however, I still cannot create or migrate a VM on that node. I can see selinux 'denied' messages relating to qemu-kvm, e.g.:</div><div><div><br></div><div>type=AVC msg=audit(1464189232.136:251): avc: denied { read } for pid=4019 comm="qemu-kvm" name="650000ab-b33a-483a-af46-76f7305e2ae5" dev="sda2" ino=35401 scontext=system_</div><div>u:system_r:svirt_t:s0:c720,c927 tcontext=system_u:object_r:unlabeled_t:s0 tclass=lnk_file</div></div><div><br></div><div>There are a number of errors in the vdsm log but I assume that relates to selinux blocking it. So perhaps I need to remove all the ovirt packages manually, or perhaps re-install the OS as well? I guess either of those options involves complications with certificates and WWIDs for the attached SAN. </div><div><br></div><div>Or could I somehow generate selinux labels?</div></div></div></blockquote><div><br></div></span>yeah, I think it didn’t happen. I though we do relabelling as part of deploy</div><div>How about running "restorecon -r” now?</div><div><div><div><br><blockquote type="cite"><div><div dir="ltr"><div><br></div><div>These nodes + engine are not yet production, though I'd prefer to fix than restart entirely from scratch.</div><div><br></div><div>Thanks for any help.</div><div><br></div><div>regards,</div><div><br>Campbell</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 11, 2016 at 3:13 PM, Cam Mac <span dir="ltr"><<a href="mailto:iucounu@gmail.com" target="_blank">iucounu@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Ah, ok that makes sense. For the node, is it enough to use the 'reinstall node' option from the GUI, or is it better to reinstall the OS and then deploy it again?<div><br></div><div>Thanks,</div><div><br>Cam</div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 11, 2016 at 2:40 PM, Michal Skrivanek <span dir="ltr"><<a href="mailto:michal.skrivanek@redhat.com" target="_blank">michal.skrivanek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><br><div><span><blockquote type="cite"><div>On 11 May 2016, at 15:24, Cam Mac <<a href="mailto:iucounu@gmail.com" target="_blank">iucounu@gmail.com</a>> wrote:</div><br><div><div dir="ltr">Thanks Michal, if reinstalling the engine, (which also had SELinux disabled at install), would the best way be to backup the engine and then restore just the ovirt config?</div></div></blockquote><div><br></div></span>for engine..well, VM security is not related to that, those are running on hypervisors, not the engine. So for any functionality/security it’s irrelevant what SELinux state it’s in</div><div>I’m not sure if relabeling with restorecon is not enough (it sould work also on nodes, but as I said, it’s likely more safe to reinstall just to be really really sure:)</div><div>Simone, am I right about the restorecon for engine?</div><span><div><br></div><div><blockquote type="cite"><div><div dir="ltr"><div><br></div><div>Cheers,</div><div><br></div><div>Cam</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek <span dir="ltr"><<a href="mailto:michal.skrivanek@redhat.com" target="_blank">michal.skrivanek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span><br>
> On 11 May 2016, at 15:02, Cam Mac <<a href="mailto:iucounu@gmail.com" target="_blank">iucounu@gmail.com</a>> wrote:<br>
><br>
> Hi,<br>
><br>
> In the oVirt guide, it says that "SELinux is being used by default on oVirt Node", but then goes on to say that if you have problems you should set it to permissive mode. I have had a few things fail due to being blocked by SELinux on a node I later enabled SELinux on, as it was off at install time. The other node which has had SELinux on from the start and so far has not had any oVirt operations blocked. I am guessing that the oVirt install process creates the necessary rules to allow vdsm to run under SELinux. So if you want to set SELinux to enforcing after installation, is there a script to do this, or is it better to just reinstall the node or engine, rather than trying to work out the individual exceptions?<br>
<br>
</span>For oVirt node it’s easier to reinstall it, it doesn’t persist much and it’s the easies way how to get the labelling right<br>
<br>
Thanks,<br>
michal<br>
<br>
><br>
> Thanks,<br>
><br>
> Cam<br>
> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br>
> <a href="http://lists.ovirt.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.ovirt.org/mailman/listinfo/users</a><br>
<br>
</blockquote></div><br></div>
_______________________________________________<br>Users mailing list<br><a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br><a href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/mailman/listinfo/users</a><br></div></blockquote></div><br></span></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></blockquote></div><br></div></div></div></blockquote></div><br></div>
</div></blockquote></div></div></div></div></div></blockquote></div><br></div>
</div></blockquote></div></body></html>