4:02 p.m.
Hi,
In the oVirt guide, it says that "SELinux is being used by default on oVirt
Node", but then goes on to say that if you have problems you should set it
to permissive mode. I have had a few things fail due to being blocked by
SELinux on a node I later enabled SELinux on, as it was off at install
time. The other node which has had SELinux on from the start and so far has
not had any oVirt operations blocked. I am guessing that the oVirt install
process creates the necessary rules to allow vdsm to run under SELinux. So
if you want to set SELinux to enforcing after installation, is there a
script to do this, or is it better to just reinstall the node or engine,
rather than trying to work out the individual exceptions?
Thanks,
Cam
4:14 p.m.
On 11 May 2016, at 15:02, Cam Mac <iucounu(a)gmail.com> wrote:
Hi,
In the oVirt guide, it says that "SELinux is being used by default on oVirt
Node", but then goes on to say that if you have problems you should set it to
permissive mode. I have had a few things fail due to being blocked by SELinux on a node I
later enabled SELinux on, as it was off at install time. The other node which has had
SELinux on from the start and so far has not had any oVirt operations blocked. I am
guessing that the oVirt install process creates the necessary rules to allow vdsm to run
under SELinux. So if you want to set SELinux to enforcing after installation, is there a
script to do this, or is it better to just reinstall the node or engine, rather than
trying to work out the individual exceptions?
For oVirt node it’s easier to reinstall it, it doesn’t persist much and it’s the easies
way how to get the labelling right
Thanks,
michal
Thanks,
Cam
_______________________________________________
Users mailing list
Users(a)ovirt.org
http://lists.ovirt.org/mailman/listinfo/users
4:24 p.m.
Thanks Michal, if reinstalling the engine, (which also had SELinux disabled
at install), would the best way be to backup the engine and then restore
just the ovirt config?
Cheers,
Cam
On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek <
michal.skrivanek(a)redhat.com> wrote:
> On 11 May 2016, at 15:02, Cam Mac <iucounu(a)gmail.com> wrote:
>
> Hi,
>
> In the oVirt guide, it says that "SELinux is being used by default on
oVirt Node", but then goes on to say that if you have problems you should
set it to permissive mode. I have had a few things fail due to being
blocked by SELinux on a node I later enabled SELinux on, as it was off at
install time. The other node which has had SELinux on from the start and so
far has not had any oVirt operations blocked. I am guessing that the oVirt
install process creates the necessary rules to allow vdsm to run under
SELinux. So if you want to set SELinux to enforcing after installation, is
there a script to do this, or is it better to just reinstall the node or
engine, rather than trying to work out the individual exceptions?
For oVirt node it’s easier to reinstall it, it doesn’t persist much and
it’s the easies way how to get the labelling right
Thanks,
michal
>
> Thanks,
>
> Cam
> _______________________________________________
> Users mailing list
> Users(a)ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
4:40 p.m.
--Apple-Mail=_CDE436FE-61F8-4137-8BB4-CE456B791151
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
On 11 May 2016, at 15:24, Cam Mac <iucounu(a)gmail.com> wrote:
=20
Thanks Michal, if reinstalling the engine, (which also had SELinux =
disabled at
install), would the best way be to backup the engine and =
then restore just the ovirt config?
for engine..well, VM security is not related to that, those are running =
on hypervisors, not the engine. So for any functionality/security it=E2=80=
=99s irrelevant what SELinux state it=E2=80=99s in
I=E2=80=99m not sure if relabeling with restorecon is not enough (it =
sould work also on nodes, but as I said, it=E2=80=99s likely more safe =
to reinstall just to be really really sure:)
Simone, am I right about the restorecon for engine?
=20
Cheers,
=20
Cam
=20
On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek =
<michal.skrivanek(a)redhat.com
<mailto:michal.skrivanek@redhat.com>> =
wrote:
=20
> On 11 May 2016, at 15:02, Cam Mac <iucounu(a)gmail.com =
<mailto:iucounu@gmail.com>> wrote:
>
> Hi,
>
> In the oVirt guide, it says that "SELinux is being used by default =
on
oVirt Node", but then goes on to say that if you have problems you =
should set it to permissive mode. I have had a few things fail due to =
being blocked by SELinux on a node I later enabled SELinux on, as it was =
off at install time. The other node which has had SELinux on from the =
start and so far has not had any oVirt operations blocked. I am guessing =
that the oVirt install process creates the necessary rules to allow vdsm =
to run under SELinux. So if you want to set SELinux to enforcing after =
installation, is there a script to do this, or is it better to just =
reinstall the node or engine, rather than trying to work out the =
individual exceptions?
=20
For oVirt node it=E2=80=99s easier to reinstall it, it doesn=E2=80=99t =
persist
much and it=E2=80=99s the easies way how to get the labelling =
right
=20
Thanks,
michal
=20
>
> Thanks,
>
> Cam
> _______________________________________________
> Users mailing list
> Users(a)ovirt.org <mailto:Users@ovirt.org>
> http://lists.ovirt.org/mailman/listinfo/users =
<http://lists.ovirt.org/mailman/listinfo/users>
=20
=20
_______________________________________________
Users mailing list
Users(a)ovirt.org
http://lists.ovirt.org/mailman/listinfo/users
--Apple-Mail=_CDE436FE-61F8-4137-8BB4-CE456B791151
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=utf-8
<html><head><meta http-equiv=3D"Content-Type"
content=3D"text/html =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D""><br class=3D""><div><blockquote
type=3D"cite" class=3D""><div =
class=3D"">On 11 May 2016, at 15:24, Cam Mac <<a =
href=3D"mailto:iucounu@gmail.com"
class=3D"">iucounu(a)gmail.com</a>&gt; =
wrote:</div><br class=3D"Apple-interchange-newline"><div
class=3D""><div =
dir=3D"ltr" class=3D"">Thanks Michal, if reinstalling the engine,
(which =
also had SELinux disabled at install), would the best way be to backup =
the engine and then restore just the ovirt =
config?</div></div></blockquote><div><br
class=3D""></div>for =
engine..well, VM security is not related to that, those are running on =
hypervisors, not the engine. So for any functionality/security it=E2=80=99=
s irrelevant what SELinux state it=E2=80=99s in</div><div>I=E2=80=99m =
not sure if relabeling with restorecon is not enough (it sould work also =
on nodes, but as I said, it=E2=80=99s likely more safe to reinstall just =
to be really really sure:)</div><div>Simone, am I right about the =
restorecon for engine?</div><div><br
class=3D""></div><div><blockquote =
type=3D"cite" class=3D""><div class=3D""><div
dir=3D"ltr" class=3D""><div =
class=3D""><br class=3D""></div><div
class=3D"">Cheers,</div><div =
class=3D""><br class=3D""></div><div
class=3D"">Cam</div></div><div =
class=3D"gmail_extra"><br class=3D""><div
class=3D"gmail_quote">On Wed, =
May 11, 2016 at 2:14 PM, Michal Skrivanek <span dir=3D"ltr" =
class=3D""><<a
href=3D"mailto:michal.skrivanek@redhat.com" =
target=3D"_blank"
class=3D"">michal.skrivanek(a)redhat.com</a>&gt;</span> =
wrote:<br class=3D""><blockquote class=3D"gmail_quote"
style=3D"margin:0 =
0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span
class=3D""><br=
class=3D"">
> On 11 May 2016, at 15:02, Cam Mac <<a =
href=3D"mailto:iucounu@gmail.com"
class=3D"">iucounu(a)gmail.com</a>&gt; =
wrote:<br class=3D"">
><br class=3D"">
> Hi,<br class=3D"">
><br class=3D"">
> In the oVirt guide, it says that "SELinux is being used by default =
on oVirt Node", but then goes on to say that if you have problems you =
should set it to permissive mode. I have had a few things fail due to =
being blocked by SELinux on a node I later enabled SELinux on, as it was =
off at install time. The other node which has had SELinux on from the =
start and so far has not had any oVirt operations blocked. I am guessing =
that the oVirt install process creates the necessary rules to allow vdsm =
to run under SELinux. So if you want to set SELinux to enforcing after =
installation, is there a script to do this, or is it better to just =
reinstall the node or engine, rather than trying to work out the =
individual exceptions?<br class=3D"">
<br class=3D"">
</span>For oVirt node it=E2=80=99s easier to reinstall it, it doesn=E2=80=99=
t persist much and it=E2=80=99s the easies way how to get the labelling =
right<br class=3D"">
<br class=3D"">
Thanks,<br class=3D"">
michal<br class=3D"">
<br class=3D"">
><br class=3D"">
> Thanks,<br class=3D"">
><br class=3D"">
> Cam<br class=3D"">
> _______________________________________________<br class=3D"">
> Users mailing list<br class=3D"">
> <a href=3D"mailto:Users@ovirt.org"
class=3D"">Users(a)ovirt.org</a><br =
class=3D"">
> <a href=3D"http://lists.ovirt.org/mailman/listinfo/users" =
rel=3D"noreferrer" target=3D"_blank" =
class=3D"">http://lists.ovirt.org/mailman/listinfo/users<... =
class=3D"">
<br class=3D"">
</blockquote></div><br class=3D""></div>
_______________________________________________<br class=3D"">Users =
mailing list<br class=3D""><a href=3D"mailto:Users@ovirt.org"
=
class=3D"">Users(a)ovirt.org</a><br =
class=3D"">http://lists.ovirt.org/mailman/listinfo/users<br =
class=3D""></div></blockquote></div><br
class=3D""></body></html>=
--Apple-Mail=_CDE436FE-61F8-4137-8BB4-CE456B791151--
5:13 p.m.
Ah, ok that makes sense. For the node, is it enough to use the 'reinstall
node' option from the GUI, or is it better to reinstall the OS and then
deploy it again?
Thanks,
Cam
On Wed, May 11, 2016 at 2:40 PM, Michal Skrivanek <
michal.skrivanek(a)redhat.com> wrote:
On 11 May 2016, at 15:24, Cam Mac <iucounu(a)gmail.com> wrote:
Thanks Michal, if reinstalling the engine, (which also had SELinux
disabled at install), would the best way be to backup the engine and then
restore just the ovirt config?
for engine..well, VM security is not related to that, those are running on
hypervisors, not the engine. So for any functionality/security it’s
irrelevant what SELinux state it’s in
I’m not sure if relabeling with restorecon is not enough (it sould work
also on nodes, but as I said, it’s likely more safe to reinstall just to be
really really sure:)
Simone, am I right about the restorecon for engine?
Cheers,
Cam
On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek <
michal.skrivanek(a)redhat.com> wrote:
>
> > On 11 May 2016, at 15:02, Cam Mac <iucounu(a)gmail.com> wrote:
> >
> > Hi,
> >
> > In the oVirt guide, it says that "SELinux is being used by default on
> oVirt Node", but then goes on to say that if you have problems you should
> set it to permissive mode. I have had a few things fail due to being
> blocked by SELinux on a node I later enabled SELinux on, as it was off at
> install time. The other node which has had SELinux on from the start and so
> far has not had any oVirt operations blocked. I am guessing that the oVirt
> install process creates the necessary rules to allow vdsm to run under
> SELinux. So if you want to set SELinux to enforcing after installation, is
> there a script to do this, or is it better to just reinstall the node or
> engine, rather than trying to work out the individual exceptions?
>
> For oVirt node it’s easier to reinstall it, it doesn’t persist much and
> it’s the easies way how to get the labelling right
>
> Thanks,
> michal
>
> >
> > Thanks,
> >
> > Cam
> > _______________________________________________
> > Users mailing list
> > Users(a)ovirt.org
> > http://lists.ovirt.org/mailman/listinfo/users
>
>
_______________________________________________
Users mailing list
Users(a)ovirt.org
http://lists.ovirt.org/mailman/listinfo/users
6:35 p.m.
Hi Michal,
I chose the 'reinstall node' option from the GUI menu, which appeared to go
ok, however, I still cannot create or migrate a VM on that node. I can see
selinux 'denied' messages relating to qemu-kvm, e.g.:
type=AVC msg=audit(1464189232.136:251): avc: denied { read } for
pid=4019 comm="qemu-kvm" name="650000ab-b33a-483a-af46-76f7305e2ae5"
dev="sda2" ino=35401 scontext=system_
u:system_r:svirt_t:s0:c720,c927 tcontext=system_u:object_r:unlabeled_t:s0
tclass=lnk_file
There are a number of errors in the vdsm log but I assume that relates to
selinux blocking it. So perhaps I need to remove all the ovirt packages
manually, or perhaps re-install the OS as well? I guess either of those
options involves complications with certificates and WWIDs for the attached
SAN.
Or could I somehow generate selinux labels?
These nodes + engine are not yet production, though I'd prefer to fix than
restart entirely from scratch.
Thanks for any help.
regards,
Campbell
On Wed, May 11, 2016 at 3:13 PM, Cam Mac <iucounu(a)gmail.com> wrote:
Ah, ok that makes sense. For the node, is it enough to use the
'reinstall
node' option from the GUI, or is it better to reinstall the OS and then
deploy it again?
Thanks,
Cam
On Wed, May 11, 2016 at 2:40 PM, Michal Skrivanek <
michal.skrivanek(a)redhat.com> wrote:
>
> On 11 May 2016, at 15:24, Cam Mac <iucounu(a)gmail.com> wrote:
>
> Thanks Michal, if reinstalling the engine, (which also had SELinux
> disabled at install), would the best way be to backup the engine and then
> restore just the ovirt config?
>
>
> for engine..well, VM security is not related to that, those are running
> on hypervisors, not the engine. So for any functionality/security it’s
> irrelevant what SELinux state it’s in
> I’m not sure if relabeling with restorecon is not enough (it sould work
> also on nodes, but as I said, it’s likely more safe to reinstall just to be
> really really sure:)
> Simone, am I right about the restorecon for engine?
>
>
> Cheers,
>
> Cam
>
> On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek <
> michal.skrivanek(a)redhat.com> wrote:
>
>>
>> > On 11 May 2016, at 15:02, Cam Mac <iucounu(a)gmail.com> wrote:
>> >
>> > Hi,
>> >
>> > In the oVirt guide, it says that "SELinux is being used by default on
>> oVirt Node", but then goes on to say that if you have problems you should
>> set it to permissive mode. I have had a few things fail due to being
>> blocked by SELinux on a node I later enabled SELinux on, as it was off at
>> install time. The other node which has had SELinux on from the start and so
>> far has not had any oVirt operations blocked. I am guessing that the oVirt
>> install process creates the necessary rules to allow vdsm to run under
>> SELinux. So if you want to set SELinux to enforcing after installation, is
>> there a script to do this, or is it better to just reinstall the node or
>> engine, rather than trying to work out the individual exceptions?
>>
>> For oVirt node it’s easier to reinstall it, it doesn’t persist much and
>> it’s the easies way how to get the labelling right
>>
>> Thanks,
>> michal
>>
>> >
>> > Thanks,
>> >
>> > Cam
>> > _______________________________________________
>> > Users mailing list
>> > Users(a)ovirt.org
>> > http://lists.ovirt.org/mailman/listinfo/users
>>
>>
> _______________________________________________
> Users mailing list
> Users(a)ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
>
>
>
6:59 p.m.
--Apple-Mail=_9687EDFD-A956-44FC-B7A6-ED6E5AA0CA88
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
On 25 May 2016, at 17:35, Cam Mac <iucounu(a)gmail.com> wrote:
=20
Hi Michal,
=20
I chose the 'reinstall node' option from the GUI menu, which appeared =
to
go ok, however, I still cannot create or migrate a VM on that node. I =
can see selinux 'denied' messages relating to qemu-kvm, e.g.:
=20
type=3DAVC msg=3Daudit(1464189232.136:251): avc: denied { read } for =
pid=3D4019 comm=3D"qemu-kvm" =
name=3D"650000ab-b33a-483a-af46-76f7305e2ae5" dev=3D"sda2" ino=3D35401
=
scontext=3Dsystem_
u:system_r:svirt_t:s0:c720,c927 =
tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dlnk_file
=20
There are a number of errors in the vdsm log but I assume that relates =
to selinux
blocking it. So perhaps I need to remove all the ovirt =
packages manually, or perhaps re-install the OS as well? I guess either =
of those options involves complications with certificates and WWIDs for =
the attached SAN.=20
=20
Or could I somehow generate selinux labels?
yeah, I think it didn=E2=80=99t happen. I though we do relabelling as =
part of deploy
How about running "restorecon -r=E2=80=9D now?
=20
These nodes + engine are not yet production, though I'd prefer to fix =
than
restart entirely from scratch.
=20
Thanks for any help.
=20
regards,
=20
Campbell
=20
=20
On Wed, May 11, 2016 at 3:13 PM, Cam Mac <iucounu(a)gmail.com =
<mailto:iucounu@gmail.com>> wrote:
Ah, ok that makes sense. For the node, is it enough to use the =
'reinstall node' option from the GUI, or is it better to reinstall the =
OS and then deploy it again?
=20
Thanks,
=20
Cam
=20
On Wed, May 11, 2016 at 2:40 PM, Michal Skrivanek =
<michal.skrivanek(a)redhat.com
<mailto:michal.skrivanek@redhat.com>> =
wrote:
=20
> On 11 May 2016, at 15:24, Cam Mac <iucounu(a)gmail.com =
<mailto:iucounu@gmail.com>> wrote:
>=20
> Thanks Michal, if reinstalling the engine, (which also had SELinux =
disabled
at install), would the best way be to backup the engine and =
then restore just the ovirt config?
=20
for engine..well, VM security is not related to that, those are =
running on
hypervisors, not the engine. So for any =
functionality/security it=E2=80=99s irrelevant what SELinux state it=E2=80=
=99s in
I=E2=80=99m not sure if relabeling with restorecon is not enough (it
=
sould work also on nodes, but as I said, it=E2=80=99s likely more safe =
to reinstall just to be really really sure:)
Simone, am I right about the restorecon for engine?
=20
>=20
> Cheers,
>=20
> Cam
>=20
> On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek =
<michal.skrivanek(a)redhat.com <mailto:michal.skrivanek@redhat.com>> =
wrote:
>=20
> > On 11 May 2016, at 15:02, Cam Mac <iucounu(a)gmail.com =
<mailto:iucounu@gmail.com>> wrote:
> >
> > Hi,
> >
> > In the oVirt guide, it says that "SELinux is being used by default =
on oVirt Node", but then goes on to say that if you have problems you =
should set it to permissive mode. I have had a few things fail due to =
being blocked by SELinux on a node I later enabled SELinux on, as it was =
off at install time. The other node which has had SELinux on from the =
start and so far has not had any oVirt operations blocked. I am guessing =
that the oVirt install process creates the necessary rules to allow vdsm =
to run under SELinux. So if you want to set SELinux to enforcing after =
installation, is there a script to do this, or is it better to just =
reinstall the node or engine, rather than trying to work out the =
individual exceptions?
>=20
> For oVirt node it=E2=80=99s easier to reinstall it, it doesn=E2=80=99t =
persist much and it=E2=80=99s the easies way how to get the labelling =
right
>=20
> Thanks,
> michal
>=20
> >
> > Thanks,
> >
> > Cam
> > _______________________________________________
> > Users mailing list
> > Users(a)ovirt.org <mailto:Users@ovirt.org>
> > http://lists.ovirt.org/mailman/listinfo/users =
<http://lists.ovirt.org/mailman/listinfo/users>
>=20
>=20
> _______________________________________________
> Users mailing list
> Users(a)ovirt.org <mailto:Users@ovirt.org>
> http://lists.ovirt.org/mailman/listinfo/users =
<http://lists.ovirt.org/mailman/listinfo/users>
=20
=20
=20
--Apple-Mail=_9687EDFD-A956-44FC-B7A6-ED6E5AA0CA88
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=utf-8
<html><head><meta http-equiv=3D"Content-Type"
content=3D"text/html =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D""><br class=3D""><div><blockquote
type=3D"cite" class=3D""><div =
class=3D"">On 25 May 2016, at 17:35, Cam Mac <<a =
href=3D"mailto:iucounu@gmail.com"
class=3D"">iucounu(a)gmail.com</a>&gt; =
wrote:</div><br class=3D"Apple-interchange-newline"><div
class=3D""><div =
dir=3D"ltr" class=3D"">Hi Michal,<div
class=3D""><br class=3D""></div><div=
class=3D"">I chose the 'reinstall node' option from the GUI menu,
which =
appeared to go ok, however, I still cannot create or migrate a VM on =
that node. I can see selinux 'denied' messages relating to qemu-kvm, =
e.g.:</div><div class=3D""><div class=3D""><br
class=3D""></div><div =
class=3D"">type=3DAVC msg=3Daudit(1464189232.136:251): avc: denied
=
{ read } for pid=3D4019 comm=3D"qemu-kvm" =
name=3D"650000ab-b33a-483a-af46-76f7305e2ae5" dev=3D"sda2" ino=3D35401
=
scontext=3Dsystem_</div><div
class=3D"">u:system_r:svirt_t:s0:c720,c927 =
tcontext=3Dsystem_u:object_r:unlabeled_t:s0 =
tclass=3Dlnk_file</div></div><div class=3D""><br
class=3D""></div><div =
class=3D"">There are a number of errors in the vdsm log but I assume =
that relates to selinux blocking it. So perhaps I need to remove all the =
ovirt packages manually, or perhaps re-install the OS as well? I guess =
either of those options involves complications with certificates and =
WWIDs for the attached SAN. </div><div class=3D""><br =
class=3D""></div><div class=3D"">Or could I somehow
generate selinux =
labels?</div></div></div></blockquote><div><br
class=3D""></div>yeah, I =
think it didn=E2=80=99t happen. I though we do relabelling as part of =
deploy</div><div>How about running "restorecon -r=E2=80=9D =
now?</div><div><br class=3D""><blockquote
type=3D"cite" class=3D""><div =
class=3D""><div dir=3D"ltr" class=3D""><div
class=3D""><br =
class=3D""></div><div class=3D"">These nodes + engine
are not yet =
production, though I'd prefer to fix than restart entirely from =
scratch.</div><div class=3D""><br
class=3D""></div><div class=3D"">Thanks =
for any help.</div><div class=3D""><br
class=3D""></div><div =
class=3D"">regards,</div><div class=3D""><br
class=3D"">Campbell</div><div=
class=3D""><br class=3D""></div></div><div
class=3D"gmail_extra"><br =
class=3D""><div class=3D"gmail_quote">On Wed, May 11, 2016 at
3:13 PM, =
Cam Mac <span dir=3D"ltr" class=3D""><<a =
href=3D"mailto:iucounu@gmail.com" target=3D"_blank" =
class=3D"">iucounu(a)gmail.com</a>&gt;</span> wrote:<br =
class=3D""><blockquote class=3D"gmail_quote"
style=3D"margin:0 0 0 =
.8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr" =
class=3D"">Ah, ok that makes sense. For the node, is it enough to use =
the 'reinstall node' option from the GUI, or is it better to reinstall =
the OS and then deploy it again?<div class=3D""><br
class=3D""></div><div =
class=3D"">Thanks,</div><div class=3D""><br
class=3D"">Cam</div></div><div=
class=3D"HOEnZb"><div class=3D"h5"><div
class=3D"gmail_extra"><br =
class=3D""><div class=3D"gmail_quote">On Wed, May 11, 2016 at
2:40 PM, =
Michal Skrivanek <span dir=3D"ltr" class=3D""><<a =
href=3D"mailto:michal.skrivanek@redhat.com" target=3D"_blank" =
class=3D"">michal.skrivanek(a)redhat.com</a>&gt;</span>
wrote:<br =
class=3D""><blockquote class=3D"gmail_quote"
style=3D"margin:0 0 0 =
.8ex;border-left:1px #ccc solid;padding-left:1ex"><div =
style=3D"word-wrap:break-word" class=3D""><br
class=3D""><div =
class=3D""><span class=3D""><blockquote
type=3D"cite" class=3D""><div =
class=3D"">On 11 May 2016, at 15:24, Cam Mac <<a =
href=3D"mailto:iucounu@gmail.com" target=3D"_blank" =
class=3D"">iucounu(a)gmail.com</a>&gt; wrote:</div><br
class=3D""><div =
class=3D""><div dir=3D"ltr" class=3D"">Thanks
Michal, if reinstalling =
the engine, (which also had SELinux disabled at install), would the best =
way be to backup the engine and then restore just the ovirt =
config?</div></div></blockquote><div class=3D""><br
=
class=3D""></div></span>for engine..well, VM security is not
related to =
that, those are running on hypervisors, not the engine. So for any =
functionality/security it=E2=80=99s irrelevant what SELinux state it=E2=80=
=99s in</div><div class=3D"">I=E2=80=99m not sure if relabeling with
=
restorecon is not enough (it sould work also on nodes, but as I said, =
it=E2=80=99s likely more safe to reinstall just to be really really =
sure:)</div><div class=3D"">Simone, am I right about the restorecon
for =
engine?</div><span class=3D""><div class=3D""><br
class=3D""></div><div =
class=3D""><blockquote type=3D"cite"
class=3D""><div class=3D""><div =
dir=3D"ltr" class=3D""><div class=3D""><br
class=3D""></div><div =
class=3D"">Cheers,</div><div class=3D""><br
class=3D""></div><div =
class=3D"">Cam</div></div><div
class=3D"gmail_extra"><br class=3D""><div =
class=3D"gmail_quote">On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek =
<span dir=3D"ltr" class=3D""><<a =
href=3D"mailto:michal.skrivanek@redhat.com" target=3D"_blank" =
class=3D"">michal.skrivanek(a)redhat.com</a>&gt;</span>
wrote:<br =
class=3D""><blockquote class=3D"gmail_quote"
style=3D"margin:0 0 0 =
.8ex;border-left:1px #ccc solid;padding-left:1ex"><span
class=3D""><br =
class=3D"">
> On 11 May 2016, at 15:02, Cam Mac <<a =
href=3D"mailto:iucounu@gmail.com" target=3D"_blank" =
class=3D"">iucounu(a)gmail.com</a>&gt; wrote:<br
class=3D"">
><br class=3D"">
> Hi,<br class=3D"">
><br class=3D"">
> In the oVirt guide, it says that "SELinux is being used by default =
on oVirt Node", but then goes on to say that if you have problems you =
should set it to permissive mode. I have had a few things fail due to =
being blocked by SELinux on a node I later enabled SELinux on, as it was =
off at install time. The other node which has had SELinux on from the =
start and so far has not had any oVirt operations blocked. I am guessing =
that the oVirt install process creates the necessary rules to allow vdsm =
to run under SELinux. So if you want to set SELinux to enforcing after =
installation, is there a script to do this, or is it better to just =
reinstall the node or engine, rather than trying to work out the =
individual exceptions?<br class=3D"">
<br class=3D"">
</span>For oVirt node it=E2=80=99s easier to reinstall it, it doesn=E2=80=99=
t persist much and it=E2=80=99s the easies way how to get the labelling =
right<br class=3D"">
<br class=3D"">
Thanks,<br class=3D"">
michal<br class=3D"">
<br class=3D"">
><br class=3D"">
> Thanks,<br class=3D"">
><br class=3D"">
> Cam<br class=3D"">
> _______________________________________________<br class=3D"">
> Users mailing list<br class=3D"">
> <a href=3D"mailto:Users@ovirt.org" target=3D"_blank" =
class=3D"">Users(a)ovirt.org</a><br class=3D"">
> <a href=3D"http://lists.ovirt.org/mailman/listinfo/users" =
rel=3D"noreferrer" target=3D"_blank" =
class=3D"">http://lists.ovirt.org/mailman/listinfo/users<... =
class=3D"">
<br class=3D"">
</blockquote></div><br class=3D""></div>
_______________________________________________<br class=3D"">Users =
mailing list<br class=3D""><a href=3D"mailto:Users@ovirt.org"
=
target=3D"_blank" class=3D"">Users(a)ovirt.org</a><br
class=3D""><a =
href=3D"http://lists.ovirt.org/mailman/listinfo/users"
target=3D"_blank" =
class=3D"">http://lists.ovirt.org/mailman/listinfo/users<... =
class=3D""></div></blockquote></div><br =
class=3D""></span></div></blockquote></div><br
class=3D""></div>
</div></div></blockquote></div><br
class=3D""></div>
</div></blockquote></div><br
class=3D""></body></html>=
--Apple-Mail=_9687EDFD-A956-44FC-B7A6-ED6E5AA0CA88--
8:12 p.m.
I'll try that - presumably on the paths it is complaining about, and the
qemu binarys?
On Wed, May 25, 2016 at 4:59 PM, Michal Skrivanek <
michal.skrivanek(a)redhat.com> wrote:
On 25 May 2016, at 17:35, Cam Mac <iucounu(a)gmail.com> wrote:
Hi Michal,
I chose the 'reinstall node' option from the GUI menu, which appeared to
go ok, however, I still cannot create or migrate a VM on that node. I can
see selinux 'denied' messages relating to qemu-kvm, e.g.:
type=AVC msg=audit(1464189232.136:251): avc: denied { read } for
pid=4019 comm="qemu-kvm"
name="650000ab-b33a-483a-af46-76f7305e2ae5"
dev="sda2" ino=35401 scontext=system_
u:system_r:svirt_t:s0:c720,c927 tcontext=system_u:object_r:unlabeled_t:s0
tclass=lnk_file
There are a number of errors in the vdsm log but I assume that relates to
selinux blocking it. So perhaps I need to remove all the ovirt packages
manually, or perhaps re-install the OS as well? I guess either of those
options involves complications with certificates and WWIDs for the attached
SAN.
Or could I somehow generate selinux labels?
yeah, I think it didn’t happen. I though we do relabelling as part of
deploy
How about running "restorecon -r” now?
These nodes + engine are not yet production, though I'd prefer to fix than
restart entirely from scratch.
Thanks for any help.
regards,
Campbell
On Wed, May 11, 2016 at 3:13 PM, Cam Mac <iucounu(a)gmail.com> wrote:
> Ah, ok that makes sense. For the node, is it enough to use the 'reinstall
> node' option from the GUI, or is it better to reinstall the OS and then
> deploy it again?
>
> Thanks,
>
> Cam
>
> On Wed, May 11, 2016 at 2:40 PM, Michal Skrivanek <
> michal.skrivanek(a)redhat.com> wrote:
>
>>
>> On 11 May 2016, at 15:24, Cam Mac <iucounu(a)gmail.com> wrote:
>>
>> Thanks Michal, if reinstalling the engine, (which also had SELinux
>> disabled at install), would the best way be to backup the engine and then
>> restore just the ovirt config?
>>
>>
>> for engine..well, VM security is not related to that, those are running
>> on hypervisors, not the engine. So for any functionality/security it’s
>> irrelevant what SELinux state it’s in
>> I’m not sure if relabeling with restorecon is not enough (it sould work
>> also on nodes, but as I said, it’s likely more safe to reinstall just to be
>> really really sure:)
>> Simone, am I right about the restorecon for engine?
>>
>>
>> Cheers,
>>
>> Cam
>>
>> On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek <
>> michal.skrivanek(a)redhat.com> wrote:
>>
>>>
>>> > On 11 May 2016, at 15:02, Cam Mac <iucounu(a)gmail.com> wrote:
>>> >
>>> > Hi,
>>> >
>>> > In the oVirt guide, it says that "SELinux is being used by default
on
>>> oVirt Node", but then goes on to say that if you have problems you
should
>>> set it to permissive mode. I have had a few things fail due to being
>>> blocked by SELinux on a node I later enabled SELinux on, as it was off at
>>> install time. The other node which has had SELinux on from the start and so
>>> far has not had any oVirt operations blocked. I am guessing that the oVirt
>>> install process creates the necessary rules to allow vdsm to run under
>>> SELinux. So if you want to set SELinux to enforcing after installation, is
>>> there a script to do this, or is it better to just reinstall the node or
>>> engine, rather than trying to work out the individual exceptions?
>>>
>>> For oVirt node it’s easier to reinstall it, it doesn’t persist much and
>>> it’s the easies way how to get the labelling right
>>>
>>> Thanks,
>>> michal
>>>
>>> >
>>> > Thanks,
>>> >
>>> > Cam
>>> > _______________________________________________
>>> > Users mailing list
>>> > Users(a)ovirt.org
>>> > http://lists.ovirt.org/mailman/listinfo/users
>>>
>>>
>> _______________________________________________
>> Users mailing list
>> Users(a)ovirt.org
>> http://lists.ovirt.org/mailman/listinfo/users
>>
>>
>>
>
8:15 p.m.
--Apple-Mail-281A4CF8-F162-4110-89CA-1DC2881E579B
Content-Type: text/plain;
charset=utf-8
Content-Transfer-Encoding: base64
DQoNCj4gT24gMjUgTWF5IDIwMTYsIGF0IDE5OjEyLCBDYW0gTWFjIDxpdWNvdW51QGdtYWlsLmNv
bT4gd3JvdGU6DQo+IA0KPiBJJ2xsIHRyeSB0aGF0IC0gcHJlc3VtYWJseSBvbiB0aGUgcGF0aHMg
aXQgaXMgY29tcGxhaW5pbmcgYWJvdXQsIGFuZCB0aGUgcWVtdSBiaW5hcnlzPw0KDQpJdCBzaG91
bGRuJ3QgaHVydCBvbiAvLCBpdCBzaG91bGQgb25seSBoZWxwOikNCkFuZCBpZiBpdCBjb21wbGFp
bnMgZS5nLiBvbiBhdHRhY2hlZCBuZnMsIHRoZSBpIHN1cHBvc2UgeW91IG5lZWQgdG8gcnVuIGl0
IHRoZXJlIHRvbw0KDQo+IA0KPj4gT24gV2VkLCBNYXkgMjUsIDIwMTYgYXQgNDo1OSBQTSwgTWlj
aGFsIFNrcml2YW5layA8bWljaGFsLnNrcml2YW5la0ByZWRoYXQuY29tPiB3cm90ZToNCj4+IA0K
Pj4+IE9uIDI1IE1heSAyMDE2LCBhdCAxNzozNSwgQ2FtIE1hYyA8aXVjb3VudUBnbWFpbC5jb20+
IHdyb3RlOg0KPj4+IA0KPj4+IEhpIE1pY2hhbCwNCj4+PiANCj4+PiBJIGNob3NlIHRoZSAncmVp
bnN0YWxsIG5vZGUnIG9wdGlvbiBmcm9tIHRoZSBHVUkgbWVudSwgd2hpY2ggYXBwZWFyZWQgdG8g
Z28gb2ssIGhvd2V2ZXIsIEkgc3RpbGwgY2Fubm90IGNyZWF0ZSBvciBtaWdyYXRlIGEgVk0gb24g
dGhhdCBub2RlLiBJIGNhbiBzZWUgc2VsaW51eCAnZGVuaWVkJyBtZXNzYWdlcyByZWxhdGluZyB0
byBxZW11LWt2bSwgZS5nLjoNCj4+PiANCj4+PiB0eXBlPUFWQyBtc2c9YXVkaXQoMTQ2NDE4OTIz
Mi4xMzY6MjUxKTogYXZjOiAgZGVuaWVkICB7IHJlYWQgfSBmb3IgIHBpZD00MDE5IGNvbW09InFl
bXUta3ZtIiBuYW1lPSI2NTAwMDBhYi1iMzNhLTQ4M2EtYWY0Ni03NmY3MzA1ZTJhZTUiIGRldj0i
c2RhMiIgaW5vPTM1NDAxIHNjb250ZXh0PXN5c3RlbV8NCj4+PiB1OnN5c3RlbV9yOnN2aXJ0X3Q6
czA6YzcyMCxjOTI3IHRjb250ZXh0PXN5c3RlbV91Om9iamVjdF9yOnVubGFiZWxlZF90OnMwIHRj
bGFzcz1sbmtfZmlsZQ0KPj4+IA0KPj4+IFRoZXJlIGFyZSBhIG51bWJlciBvZiBlcnJvcnMgaW4g
dGhlIHZkc20gbG9nIGJ1dCBJIGFzc3VtZSB0aGF0IHJlbGF0ZXMgdG8gc2VsaW51eCBibG9ja2lu
ZyBpdC4gU28gcGVyaGFwcyBJIG5lZWQgdG8gcmVtb3ZlIGFsbCB0aGUgb3ZpcnQgcGFja2FnZXMg
bWFudWFsbHksIG9yIHBlcmhhcHMgcmUtaW5zdGFsbCB0aGUgT1MgYXMgd2VsbD8gSSBndWVzcyBl
aXRoZXIgb2YgdGhvc2Ugb3B0aW9ucyBpbnZvbHZlcyBjb21wbGljYXRpb25zIHdpdGggY2VydGlm
aWNhdGVzIGFuZCBXV0lEcyBmb3IgdGhlIGF0dGFjaGVkIFNBTi4gDQo+Pj4gDQo+Pj4gT3IgY291
bGQgSSBzb21laG93IGdlbmVyYXRlIHNlbGludXggbGFiZWxzPw0KPj4gDQo+PiB5ZWFoLCBJIHRo
aW5rIGl0IGRpZG7igJl0IGhhcHBlbi4gSSB0aG91Z2ggd2UgZG8gcmVsYWJlbGxpbmcgYXMgcGFy
dCBvZiBkZXBsb3kNCj4+IEhvdyBhYm91dCBydW5uaW5nICJyZXN0b3JlY29uIC1y4oCdIG5vdz8N
Cj4+IA0KPj4+IA0KPj4+IFRoZXNlIG5vZGVzICsgZW5naW5lIGFyZSBub3QgeWV0IHByb2R1Y3Rp
b24sIHRob3VnaCBJJ2QgcHJlZmVyIHRvIGZpeCB0aGFuIHJlc3RhcnQgZW50aXJlbHkgZnJvbSBz
Y3JhdGNoLg0KPj4+IA0KPj4+IFRoYW5rcyBmb3IgYW55IGhlbHAuDQo+Pj4gDQo+Pj4gcmVnYXJk
cywNCj4+PiANCj4+PiBDYW1wYmVsbA0KPj4+IA0KPj4+IA0KPj4+PiBPbiBXZWQsIE1heSAxMSwg
MjAxNiBhdCAzOjEzIFBNLCBDYW0gTWFjIDxpdWNvdW51QGdtYWlsLmNvbT4gd3JvdGU6DQo+Pj4+
IEFoLCBvayB0aGF0IG1ha2VzIHNlbnNlLiBGb3IgdGhlIG5vZGUsIGlzIGl0IGVub3VnaCB0byB1
c2UgdGhlICdyZWluc3RhbGwgbm9kZScgb3B0aW9uIGZyb20gdGhlIEdVSSwgb3IgaXMgaXQgYmV0
dGVyIHRvIHJlaW5zdGFsbCB0aGUgT1MgYW5kIHRoZW4gZGVwbG95IGl0IGFnYWluPw0KPj4+PiAN
Cj4+Pj4gVGhhbmtzLA0KPj4+PiANCj4+Pj4gQ2FtDQo+Pj4+IA0KPj4+Pj4gT24gV2VkLCBNYXkg
MTEsIDIwMTYgYXQgMjo0MCBQTSwgTWljaGFsIFNrcml2YW5layA8bWljaGFsLnNrcml2YW5la0By
ZWRoYXQuY29tPiB3cm90ZToNCj4+Pj4+IA0KPj4+Pj4+IE9uIDExIE1heSAyMDE2LCBhdCAxNToy
NCwgQ2FtIE1hYyA8aXVjb3VudUBnbWFpbC5jb20+IHdyb3RlOg0KPj4+Pj4+IA0KPj4+Pj4+IFRo
YW5rcyBNaWNoYWwsIGlmIHJlaW5zdGFsbGluZyB0aGUgZW5naW5lLCAod2hpY2ggYWxzbyBoYWQg
U0VMaW51eCBkaXNhYmxlZCBhdCBpbnN0YWxsKSwgd291bGQgdGhlIGJlc3Qgd2F5IGJlIHRvIGJh
Y2t1cCB0aGUgZW5naW5lIGFuZCB0aGVuIHJlc3RvcmUganVzdCB0aGUgb3ZpcnQgY29uZmlnPw0K
Pj4+Pj4gDQo+Pj4+PiBmb3IgZW5naW5lLi53ZWxsLCBWTSBzZWN1cml0eSBpcyBub3QgcmVsYXRl
ZCB0byB0aGF0LCB0aG9zZSBhcmUgcnVubmluZyBvbiBoeXBlcnZpc29ycywgbm90IHRoZSBlbmdp
bmUuIFNvIGZvciBhbnkgZnVuY3Rpb25hbGl0eS9zZWN1cml0eSBpdOKAmXMgaXJyZWxldmFudCB3
aGF0IFNFTGludXggc3RhdGUgaXTigJlzIGluDQo+Pj4+PiBJ4oCZbSBub3Qgc3VyZSBpZiByZWxh
YmVsaW5nIHdpdGggcmVzdG9yZWNvbiBpcyBub3QgZW5vdWdoIChpdCBzb3VsZCB3b3JrIGFsc28g
b24gbm9kZXMsIGJ1dCBhcyBJIHNhaWQsIGl04oCZcyBsaWtlbHkgbW9yZSBzYWZlIHRvIHJlaW5z
dGFsbCBqdXN0IHRvIGJlIHJlYWxseSByZWFsbHkgc3VyZTopDQo+Pj4+PiBTaW1vbmUsIGFtIEkg
cmlnaHQgYWJvdXQgdGhlIHJlc3RvcmVjb24gZm9yIGVuZ2luZT8NCj4+Pj4+IA0KPj4+Pj4+IA0K
Pj4+Pj4+IENoZWVycywNCj4+Pj4+PiANCj4+Pj4+PiBDYW0NCj4+Pj4+PiANCj4+Pj4+Pj4gT24g
V2VkLCBNYXkgMTEsIDIwMTYgYXQgMjoxNCBQTSwgTWljaGFsIFNrcml2YW5layA8bWljaGFsLnNr
cml2YW5la0ByZWRoYXQuY29tPiB3cm90ZToNCj4+Pj4+Pj4gDQo+Pj4+Pj4+ID4gT24gMTEgTWF5
IDIwMTYsIGF0IDE1OjAyLCBDYW0gTWFjIDxpdWNvdW51QGdtYWlsLmNvbT4gd3JvdGU6DQo+Pj4+
Pj4+ID4NCj4+Pj4+Pj4gPiBIaSwNCj4+Pj4+Pj4gPg0KPj4+Pj4+PiA+IEluIHRoZSBvVmlydCBn
dWlkZSwgaXQgc2F5cyB0aGF0ICJTRUxpbnV4IGlzIGJlaW5nIHVzZWQgYnkgZGVmYXVsdCBvbiBv
VmlydCBOb2RlIiwgYnV0IHRoZW4gZ29lcyBvbiB0byBzYXkgdGhhdCBpZiB5b3UgaGF2ZSBwcm9i
bGVtcyB5b3Ugc2hvdWxkIHNldCBpdCB0byBwZXJtaXNzaXZlIG1vZGUuIEkgaGF2ZSBoYWQgYSBm
ZXcgdGhpbmdzIGZhaWwgZHVlIHRvIGJlaW5nIGJsb2NrZWQgYnkgU0VMaW51eCBvbiBhIG5vZGUg
SSBsYXRlciBlbmFibGVkIFNFTGludXggb24sIGFzIGl0IHdhcyBvZmYgYXQgaW5zdGFsbCB0aW1l
LiBUaGUgb3RoZXIgbm9kZSB3aGljaCBoYXMgaGFkIFNFTGludXggb24gZnJvbSB0aGUgc3RhcnQg
YW5kIHNvIGZhciBoYXMgbm90IGhhZCBhbnkgb1ZpcnQgb3BlcmF0aW9ucyBibG9ja2VkLiBJIGFt
IGd1ZXNzaW5nIHRoYXQgdGhlIG9WaXJ0IGluc3RhbGwgcHJvY2VzcyBjcmVhdGVzIHRoZSBuZWNl
c3NhcnkgcnVsZXMgdG8gYWxsb3cgdmRzbSB0byBydW4gdW5kZXIgU0VMaW51eC4gU28gaWYgeW91
IHdhbnQgdG8gc2V0IFNFTGludXggdG8gZW5mb3JjaW5nIGFmdGVyIGluc3RhbGxhdGlvbiwgaXMg
dGhlcmUgYSBzY3JpcHQgdG8gZG8gdGhpcywgb3IgaXMgaXQgYmV0dGVyIHRvIGp1c3QgcmVpbnN0
YWxsIHRoZSBub2RlIG9yIGVuZ2luZSwgcmF0aGVyIHRoYW4gdHJ5aW5nIHRvIHdvcmsgb3V0IHRo
ZSBpbmRpdmlkdWFsIGV4Y2VwdGlvbnM/DQo+Pj4+Pj4+IA0KPj4+Pj4+PiBGb3Igb1ZpcnQgbm9k
ZSBpdOKAmXMgZWFzaWVyIHRvIHJlaW5zdGFsbCBpdCwgaXQgZG9lc27igJl0IHBlcnNpc3QgbXVj
aCBhbmQgaXTigJlzIHRoZSBlYXNpZXMgd2F5IGhvdyB0byBnZXQgdGhlIGxhYmVsbGluZyByaWdo
dA0KPj4+Pj4+PiANCj4+Pj4+Pj4gVGhhbmtzLA0KPj4+Pj4+PiBtaWNoYWwNCj4+Pj4+Pj4gDQo+
Pj4+Pj4+ID4NCj4+Pj4+Pj4gPiBUaGFua3MsDQo+Pj4+Pj4+ID4NCj4+Pj4+Pj4gPiBDYW0NCj4+
Pj4+Pj4gPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K
Pj4+Pj4+PiA+IFVzZXJzIG1haWxpbmcgbGlzdA0KPj4+Pj4+PiA+IFVzZXJzQG92aXJ0Lm9yZw0K
Pj4+Pj4+PiA+IGh0dHA6Ly9saXN0cy5vdmlydC5vcmcvbWFpbG1hbi9saXN0aW5mby91c2Vycw0K
Pj4+Pj4+PiANCj4+Pj4+PiANCj4+Pj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fXw0KPj4+Pj4+IFVzZXJzIG1haWxpbmcgbGlzdA0KPj4+Pj4+IFVzZXJz
QG92aXJ0Lm9yZw0KPj4+Pj4+IGh0dHA6Ly9saXN0cy5vdmlydC5vcmcvbWFpbG1hbi9saXN0aW5m
by91c2Vycw0KPj4+Pj4gDQo+Pj4+IA0KPj4+IA0KPj4gDQo+IA0K
--Apple-Mail-281A4CF8-F162-4110-89CA-1DC2881E579B
Content-Type: text/html;
charset=utf-8
Content-Transfer-Encoding: base64
PGh0bWw+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0
L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPjwvaGVhZD48Ym9keSBkaXI9ImF1dG8iPjxkaXY+PC9kaXY+
PGRpdj48YnI+PC9kaXY+PGRpdj48YnI+T24gMjUgTWF5IDIwMTYsIGF0IDE5OjEyLCBDYW0gTWFj
ICZsdDs8YSBocmVmPSJtYWlsdG86aXVjb3VudUBnbWFpbC5jb20iPml1Y291bnVAZ21haWwuY29t
PC9hPiZndDsgd3JvdGU6PGJyPjxicj48L2Rpdj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2
PjxkaXYgZGlyPSJsdHIiPkknbGwgdHJ5IHRoYXQgLSBwcmVzdW1hYmx5IG9uIHRoZSBwYXRocyBp
dCBpcyBjb21wbGFpbmluZyBhYm91dCwgYW5kIHRoZSBxZW11IGJpbmFyeXM/PC9kaXY+PC9kaXY+
PC9ibG9ja3F1b3RlPjxkaXY+PGJyPjwvZGl2Pkl0IHNob3VsZG4ndCBodXJ0IG9uIC8sIGl0IHNo
b3VsZCBvbmx5IGhlbHA6KTxkaXY+QW5kIGlmIGl0IGNvbXBsYWlucyBlLmcuIG9uIGF0dGFjaGVk
IG5mcywgdGhlIGkgc3VwcG9zZSB5b3UgbmVlZCB0byBydW4gaXQgdGhlcmUgdG9vPGJyPjxkaXY+
PGJyPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxkaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEi
Pjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gV2VkLCBNYXkgMjUsIDIwMTYgYXQgNDo1
OSBQTSwgTWljaGFsIFNrcml2YW5layA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0
bzptaWNoYWwuc2tyaXZhbmVrQHJlZGhhdC5jb20iIHRhcmdldD0iX2JsYW5rIj5taWNoYWwuc2ty
aXZhbmVrQHJlZGhhdC5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPjxibG9ja3F1b3RlIGNs
YXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFw
eCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPjxkaXYgc3R5bGU9IndvcmQtd3JhcDpicmVh
ay13b3JkIj48YnI+PGRpdj48c3BhbiBjbGFzcz0iIj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48
ZGl2Pk9uIDI1IE1heSAyMDE2LCBhdCAxNzozNSwgQ2FtIE1hYyAmbHQ7PGEgaHJlZj0ibWFpbHRv
Oml1Y291bnVAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+aXVjb3VudUBnbWFpbC5jb208L2E+
Jmd0OyB3cm90ZTo8L2Rpdj48YnI+PGRpdj48ZGl2IGRpcj0ibHRyIj5IaSBNaWNoYWwsPGRpdj48
YnI+PC9kaXY+PGRpdj5JIGNob3NlIHRoZSAncmVpbnN0YWxsIG5vZGUnIG9wdGlvbiBmcm9tIHRo
ZSBHVUkgbWVudSwgd2hpY2ggYXBwZWFyZWQgdG8gZ28gb2ssIGhvd2V2ZXIsIEkgc3RpbGwgY2Fu
bm90IGNyZWF0ZSBvciBtaWdyYXRlIGEgVk0gb24gdGhhdCBub2RlLiBJIGNhbiBzZWUgc2VsaW51
eCAnZGVuaWVkJyBtZXNzYWdlcyByZWxhdGluZyB0byBxZW11LWt2bSwgZS5nLjo8L2Rpdj48ZGl2
PjxkaXY+PGJyPjwvZGl2PjxkaXY+dHlwZT1BVkMgbXNnPWF1ZGl0KDE0NjQxODkyMzIuMTM2OjI1
MSk6IGF2YzogJm5ic3A7ZGVuaWVkICZuYnNwO3sgcmVhZCB9IGZvciAmbmJzcDtwaWQ9NDAxOSBj
b21tPSJxZW11LWt2bSIgbmFtZT0iNjUwMDAwYWItYjMzYS00ODNhLWFmNDYtNzZmNzMwNWUyYWU1
IiBkZXY9InNkYTIiIGlubz0zNTQwMSBzY29udGV4dD1zeXN0ZW1fPC9kaXY+PGRpdj51OnN5c3Rl
bV9yOnN2aXJ0X3Q6czA6YzcyMCxjOTI3IHRjb250ZXh0PXN5c3RlbV91Om9iamVjdF9yOnVubGFi
ZWxlZF90OnMwIHRjbGFzcz1sbmtfZmlsZTwvZGl2PjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+
VGhlcmUgYXJlIGEgbnVtYmVyIG9mIGVycm9ycyBpbiB0aGUgdmRzbSBsb2cgYnV0IEkgYXNzdW1l
IHRoYXQgcmVsYXRlcyB0byBzZWxpbnV4IGJsb2NraW5nIGl0LiBTbyBwZXJoYXBzIEkgbmVlZCB0
byByZW1vdmUgYWxsIHRoZSBvdmlydCBwYWNrYWdlcyBtYW51YWxseSwgb3IgcGVyaGFwcyByZS1p
bnN0YWxsIHRoZSBPUyBhcyB3ZWxsPyBJIGd1ZXNzIGVpdGhlciBvZiB0aG9zZSBvcHRpb25zIGlu
dm9sdmVzIGNvbXBsaWNhdGlvbnMgd2l0aCBjZXJ0aWZpY2F0ZXMgYW5kIFdXSURzIGZvciB0aGUg
YXR0YWNoZWQgU0FOLiZuYnNwOzwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+T3IgY291bGQgSSBz
b21laG93IGdlbmVyYXRlIHNlbGludXggbGFiZWxzPzwvZGl2PjwvZGl2PjwvZGl2PjwvYmxvY2tx
dW90ZT48ZGl2Pjxicj48L2Rpdj48L3NwYW4+eWVhaCwgSSB0aGluayBpdCBkaWRu4oCZdCBoYXBw
ZW4uIEkgdGhvdWdoIHdlIGRvIHJlbGFiZWxsaW5nIGFzIHBhcnQgb2YgZGVwbG95PC9kaXY+PGRp
dj5Ib3cgYWJvdXQgcnVubmluZyAicmVzdG9yZWNvbiAtcuKAnSBub3c/PC9kaXY+PGRpdj48ZGl2
IGNsYXNzPSJoNSI+PGRpdj48YnI+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGRpdj48ZGl2IGRp
cj0ibHRyIj48ZGl2Pjxicj48L2Rpdj48ZGl2PlRoZXNlIG5vZGVzICsgZW5naW5lIGFyZSBub3Qg
eWV0IHByb2R1Y3Rpb24sIHRob3VnaCBJJ2QgcHJlZmVyIHRvIGZpeCB0aGFuIHJlc3RhcnQgZW50
aXJlbHkgZnJvbSBzY3JhdGNoLjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+VGhhbmtzIGZvciBh
bnkgaGVscC48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PnJlZ2FyZHMsPC9kaXY+PGRpdj48YnI+
Q2FtcGJlbGw8L2Rpdj48ZGl2Pjxicj48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRy
YSI+PGJyPjxkaXYgY2xhc3M9ImdtYWlsX3F1b3RlIj5PbiBXZWQsIE1heSAxMSwgMjAxNiBhdCAz
OjEzIFBNLCBDYW0gTWFjIDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOml1Y291
bnVAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+aXVjb3VudUBnbWFpbC5jb208L2E+Jmd0Ozwv
c3Bhbj4gd3JvdGU6PGJyPjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1h
cmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDox
ZXgiPjxkaXYgZGlyPSJsdHIiPkFoLCBvayB0aGF0IG1ha2VzIHNlbnNlLiBGb3IgdGhlIG5vZGUs
IGlzIGl0IGVub3VnaCB0byB1c2UgdGhlICdyZWluc3RhbGwgbm9kZScgb3B0aW9uIGZyb20gdGhl
IEdVSSwgb3IgaXMgaXQgYmV0dGVyIHRvIHJlaW5zdGFsbCB0aGUgT1MgYW5kIHRoZW4gZGVwbG95
IGl0IGFnYWluPzxkaXY+PGJyPjwvZGl2PjxkaXY+VGhhbmtzLDwvZGl2PjxkaXY+PGJyPkNhbTwv
ZGl2PjwvZGl2PjxkaXY+PGRpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+PGJyPjxkaXYgY2xh
c3M9ImdtYWlsX3F1b3RlIj5PbiBXZWQsIE1heSAxMSwgMjAxNiBhdCAyOjQwIFBNLCBNaWNoYWwg
U2tyaXZhbmVrIDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOm1pY2hhbC5za3Jp
dmFuZWtAcmVkaGF0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1pY2hhbC5za3JpdmFuZWtAcmVkaGF0
LmNvbTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1
b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7
cGFkZGluZy1sZWZ0OjFleCI+PGRpdiBzdHlsZT0id29yZC13cmFwOmJyZWFrLXdvcmQiPjxicj48
ZGl2PjxzcGFuPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxkaXY+T24gMTEgTWF5IDIwMTYsIGF0
IDE1OjI0LCBDYW0gTWFjICZsdDs8YSBocmVmPSJtYWlsdG86aXVjb3VudUBnbWFpbC5jb20iIHRh
cmdldD0iX2JsYW5rIj5pdWNvdW51QGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjwvZGl2Pjxicj48
ZGl2PjxkaXYgZGlyPSJsdHIiPlRoYW5rcyBNaWNoYWwsIGlmIHJlaW5zdGFsbGluZyB0aGUgZW5n
aW5lLCAod2hpY2ggYWxzbyBoYWQgU0VMaW51eCBkaXNhYmxlZCBhdCBpbnN0YWxsKSwgd291bGQg
dGhlIGJlc3Qgd2F5IGJlIHRvIGJhY2t1cCB0aGUgZW5naW5lIGFuZCB0aGVuIHJlc3RvcmUganVz
dCB0aGUgb3ZpcnQgY29uZmlnPzwvZGl2PjwvZGl2PjwvYmxvY2txdW90ZT48ZGl2Pjxicj48L2Rp
dj48L3NwYW4+Zm9yIGVuZ2luZS4ud2VsbCwgVk0gc2VjdXJpdHkgaXMgbm90IHJlbGF0ZWQgdG8g
dGhhdCwgdGhvc2UgYXJlIHJ1bm5pbmcgb24gaHlwZXJ2aXNvcnMsIG5vdCB0aGUgZW5naW5lLiBT
byBmb3IgYW55IGZ1bmN0aW9uYWxpdHkvc2VjdXJpdHkgaXTigJlzIGlycmVsZXZhbnQgd2hhdCBT
RUxpbnV4IHN0YXRlIGl04oCZcyBpbjwvZGl2PjxkaXY+SeKAmW0gbm90IHN1cmUgaWYgcmVsYWJl
bGluZyB3aXRoIHJlc3RvcmVjb24gaXMgbm90IGVub3VnaCAoaXQgc291bGQgd29yayBhbHNvIG9u
IG5vZGVzLCBidXQgYXMgSSBzYWlkLCBpdOKAmXMgbGlrZWx5IG1vcmUgc2FmZSB0byByZWluc3Rh
bGwganVzdCB0byBiZSByZWFsbHkgcmVhbGx5IHN1cmU6KTwvZGl2PjxkaXY+U2ltb25lLCBhbSBJ
IHJpZ2h0IGFib3V0IHRoZSByZXN0b3JlY29uIGZvciBlbmdpbmU/PC9kaXY+PHNwYW4+PGRpdj48
YnI+PC9kaXY+PGRpdj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2PjxkaXYgZGlyPSJsdHIi
PjxkaXY+PGJyPjwvZGl2PjxkaXY+Q2hlZXJzLDwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+Q2Ft
PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj48ZGl2IGNsYXNzPSJnbWFp
bF9xdW90ZSI+T24gV2VkLCBNYXkgMTEsIDIwMTYgYXQgMjoxNCBQTSwgTWljaGFsIFNrcml2YW5l
ayA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0bzptaWNoYWwuc2tyaXZhbmVrQHJl
ZGhhdC5jb20iIHRhcmdldD0iX2JsYW5rIj5taWNoYWwuc2tyaXZhbmVrQHJlZGhhdC5jb208L2E+
Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5
bGU9Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmct
bGVmdDoxZXgiPjxzcGFuPjxicj4NCiZndDsgT24gMTEgTWF5IDIwMTYsIGF0IDE1OjAyLCBDYW0g
TWFjICZsdDs8YSBocmVmPSJtYWlsdG86aXVjb3VudUBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5r
Ij5pdWNvdW51QGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxicj4NCiZndDs8YnI+DQomZ3Q7IEhp
LDxicj4NCiZndDs8YnI+DQomZ3Q7IEluIHRoZSBvVmlydCBndWlkZSwgaXQgc2F5cyB0aGF0ICJT
RUxpbnV4IGlzIGJlaW5nIHVzZWQgYnkgZGVmYXVsdCBvbiBvVmlydCBOb2RlIiwgYnV0IHRoZW4g
Z29lcyBvbiB0byBzYXkgdGhhdCBpZiB5b3UgaGF2ZSBwcm9ibGVtcyB5b3Ugc2hvdWxkIHNldCBp
dCB0byBwZXJtaXNzaXZlIG1vZGUuIEkgaGF2ZSBoYWQgYSBmZXcgdGhpbmdzIGZhaWwgZHVlIHRv
IGJlaW5nIGJsb2NrZWQgYnkgU0VMaW51eCBvbiBhIG5vZGUgSSBsYXRlciBlbmFibGVkIFNFTGlu
dXggb24sIGFzIGl0IHdhcyBvZmYgYXQgaW5zdGFsbCB0aW1lLiBUaGUgb3RoZXIgbm9kZSB3aGlj
aCBoYXMgaGFkIFNFTGludXggb24gZnJvbSB0aGUgc3RhcnQgYW5kIHNvIGZhciBoYXMgbm90IGhh
ZCBhbnkgb1ZpcnQgb3BlcmF0aW9ucyBibG9ja2VkLiBJIGFtIGd1ZXNzaW5nIHRoYXQgdGhlIG9W
aXJ0IGluc3RhbGwgcHJvY2VzcyBjcmVhdGVzIHRoZSBuZWNlc3NhcnkgcnVsZXMgdG8gYWxsb3cg
dmRzbSB0byBydW4gdW5kZXIgU0VMaW51eC4gU28gaWYgeW91IHdhbnQgdG8gc2V0IFNFTGludXgg
dG8gZW5mb3JjaW5nIGFmdGVyIGluc3RhbGxhdGlvbiwgaXMgdGhlcmUgYSBzY3JpcHQgdG8gZG8g
dGhpcywgb3IgaXMgaXQgYmV0dGVyIHRvIGp1c3QgcmVpbnN0YWxsIHRoZSBub2RlIG9yIGVuZ2lu
ZSwgcmF0aGVyIHRoYW4gdHJ5aW5nIHRvIHdvcmsgb3V0IHRoZSBpbmRpdmlkdWFsIGV4Y2VwdGlv
bnM/PGJyPg0KPGJyPg0KPC9zcGFuPkZvciBvVmlydCBub2RlIGl04oCZcyBlYXNpZXIgdG8gcmVp
bnN0YWxsIGl0LCBpdCBkb2VzbuKAmXQgcGVyc2lzdCBtdWNoIGFuZCBpdOKAmXMgdGhlIGVhc2ll
cyB3YXkgaG93IHRvIGdldCB0aGUgbGFiZWxsaW5nIHJpZ2h0PGJyPg0KPGJyPg0KVGhhbmtzLDxi
cj4NCm1pY2hhbDxicj4NCjxicj4NCiZndDs8YnI+DQomZ3Q7IFRoYW5rcyw8YnI+DQomZ3Q7PGJy
Pg0KJmd0OyBDYW08YnI+DQomZ3Q7IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fPGJyPg0KJmd0OyBVc2VycyBtYWlsaW5nIGxpc3Q8YnI+DQomZ3Q7IDxhIGhy
ZWY9Im1haWx0bzpVc2Vyc0BvdmlydC5vcmciIHRhcmdldD0iX2JsYW5rIj5Vc2Vyc0BvdmlydC5v
cmc8L2E+PGJyPg0KJmd0OyA8YSBocmVmPSJodHRwOi8vbGlzdHMub3ZpcnQub3JnL21haWxtYW4v
bGlzdGluZm8vdXNlcnMiIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0dHA6Ly9s
aXN0cy5vdmlydC5vcmcvbWFpbG1hbi9saXN0aW5mby91c2VyczwvYT48YnI+DQo8YnI+DQo8L2Js
b2NrcXVvdGU+PC9kaXY+PGJyPjwvZGl2Pg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX188YnI+VXNlcnMgbWFpbGluZyBsaXN0PGJyPjxhIGhyZWY9Im1haWx0
bzpVc2Vyc0BvdmlydC5vcmciIHRhcmdldD0iX2JsYW5rIj5Vc2Vyc0BvdmlydC5vcmc8L2E+PGJy
PjxhIGhyZWY9Imh0dHA6Ly9saXN0cy5vdmlydC5vcmcvbWFpbG1hbi9saXN0aW5mby91c2VycyIg
dGFyZ2V0PSJfYmxhbmsiPmh0dHA6Ly9saXN0cy5vdmlydC5vcmcvbWFpbG1hbi9saXN0aW5mby91
c2VyczwvYT48YnI+PC9kaXY+PC9ibG9ja3F1b3RlPjwvZGl2Pjxicj48L3NwYW4+PC9kaXY+PC9i
bG9ja3F1b3RlPjwvZGl2Pjxicj48L2Rpdj4NCjwvZGl2PjwvZGl2PjwvYmxvY2txdW90ZT48L2Rp
dj48YnI+PC9kaXY+DQo8L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwvZGl2PjwvZGl2Pjwv
ZGl2PjwvYmxvY2txdW90ZT48L2Rpdj48YnI+PC9kaXY+DQo8L2Rpdj48L2Jsb2NrcXVvdGU+PC9k
aXY+PC9kaXY+PC9ib2R5PjwvaHRtbD4=
--Apple-Mail-281A4CF8-F162-4110-89CA-1DC2881E579B--
8:29 p.m.
Hi Michal,
Ran restorecon -r on '/' (and restarted vdsmd and other services): it is
still getting selinux errors. I'd like to keep selinux running, especially
as it is officially supported (and works on the other node), so I guess the
best option is to reinstall the OS and then install ovirt again perhaps.
Thanks,
Campbell
On Wed, May 25, 2016 at 6:15 PM, Michal Skrivanek <mskrivan(a)redhat.com>
wrote:
On 25 May 2016, at 19:12, Cam Mac <iucounu(a)gmail.com> wrote:
I'll try that - presumably on the paths it is complaining about, and the
qemu binarys?
It shouldn't hurt on /, it should only help:)
And if it complains e.g. on attached nfs, the i suppose you need to run it
there too
On Wed, May 25, 2016 at 4:59 PM, Michal Skrivanek <
michal.skrivanek(a)redhat.com> wrote:
>
> On 25 May 2016, at 17:35, Cam Mac <iucounu(a)gmail.com> wrote:
>
> Hi Michal,
>
> I chose the 'reinstall node' option from the GUI menu, which appeared to
> go ok, however, I still cannot create or migrate a VM on that node. I can
> see selinux 'denied' messages relating to qemu-kvm, e.g.:
>
> type=AVC msg=audit(1464189232.136:251): avc: denied { read } for
> pid=4019 comm="qemu-kvm"
name="650000ab-b33a-483a-af46-76f7305e2ae5"
> dev="sda2" ino=35401 scontext=system_
> u:system_r:svirt_t:s0:c720,c927 tcontext=system_u:object_r:unlabeled_t:s0
> tclass=lnk_file
>
> There are a number of errors in the vdsm log but I assume that relates to
> selinux blocking it. So perhaps I need to remove all the ovirt packages
> manually, or perhaps re-install the OS as well? I guess either of those
> options involves complications with certificates and WWIDs for the attached
> SAN.
>
> Or could I somehow generate selinux labels?
>
>
> yeah, I think it didn’t happen. I though we do relabelling as part of
> deploy
> How about running "restorecon -r” now?
>
>
> These nodes + engine are not yet production, though I'd prefer to fix
> than restart entirely from scratch.
>
> Thanks for any help.
>
> regards,
>
> Campbell
>
>
> On Wed, May 11, 2016 at 3:13 PM, Cam Mac <iucounu(a)gmail.com> wrote:
>
>> Ah, ok that makes sense. For the node, is it enough to use the
>> 'reinstall node' option from the GUI, or is it better to reinstall the
OS
>> and then deploy it again?
>>
>> Thanks,
>>
>> Cam
>>
>> On Wed, May 11, 2016 at 2:40 PM, Michal Skrivanek <
>> michal.skrivanek(a)redhat.com> wrote:
>>
>>>
>>> On 11 May 2016, at 15:24, Cam Mac <iucounu(a)gmail.com> wrote:
>>>
>>> Thanks Michal, if reinstalling the engine, (which also had SELinux
>>> disabled at install), would the best way be to backup the engine and then
>>> restore just the ovirt config?
>>>
>>>
>>> for engine..well, VM security is not related to that, those are running
>>> on hypervisors, not the engine. So for any functionality/security it’s
>>> irrelevant what SELinux state it’s in
>>> I’m not sure if relabeling with restorecon is not enough (it sould work
>>> also on nodes, but as I said, it’s likely more safe to reinstall just to be
>>> really really sure:)
>>> Simone, am I right about the restorecon for engine?
>>>
>>>
>>> Cheers,
>>>
>>> Cam
>>>
>>> On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek <
>>> michal.skrivanek(a)redhat.com> wrote:
>>>
>>>>
>>>> > On 11 May 2016, at 15:02, Cam Mac <iucounu(a)gmail.com> wrote:
>>>> >
>>>> > Hi,
>>>> >
>>>> > In the oVirt guide, it says that "SELinux is being used by
default
>>>> on oVirt Node", but then goes on to say that if you have problems
you
>>>> should set it to permissive mode. I have had a few things fail due to
being
>>>> blocked by SELinux on a node I later enabled SELinux on, as it was off
at
>>>> install time. The other node which has had SELinux on from the start and
so
>>>> far has not had any oVirt operations blocked. I am guessing that the
oVirt
>>>> install process creates the necessary rules to allow vdsm to run under
>>>> SELinux. So if you want to set SELinux to enforcing after installation,
is
>>>> there a script to do this, or is it better to just reinstall the node or
>>>> engine, rather than trying to work out the individual exceptions?
>>>>
>>>> For oVirt node it’s easier to reinstall it, it doesn’t persist much
>>>> and it’s the easies way how to get the labelling right
>>>>
>>>> Thanks,
>>>> michal
>>>>
>>>> >
>>>> > Thanks,
>>>> >
>>>> > Cam
>>>> > _______________________________________________
>>>> > Users mailing list
>>>> > Users(a)ovirt.org
>>>> > http://lists.ovirt.org/mailman/listinfo/users
>>>>
>>>>
>>> _______________________________________________
>>> Users mailing list
>>> Users(a)ovirt.org
>>> http://lists.ovirt.org/mailman/listinfo/users
>>>
>>>
>>>
>>
>
>
9:24 p.m.
--Apple-Mail-31476308-D6F5-4B3E-AE26-09A43CB9A8DD
Content-Type: text/plain;
charset=utf-8
Content-Transfer-Encoding: base64
DQoNCj4gT24gMjUgTWF5IDIwMTYsIGF0IDE5OjI5LCBDYW0gTWFjIDxpdWNvdW51QGdtYWlsLmNv
bT4gd3JvdGU6DQo+IA0KPiBIaSBNaWNoYWwsDQo+IA0KPiBSYW4gcmVzdG9yZWNvbiAtciBvbiAn
LycgKGFuZCByZXN0YXJ0ZWQgdmRzbWQgYW5kIG90aGVyIHNlcnZpY2VzKTogaXQgaXMgc3RpbGwg
Z2V0dGluZyBzZWxpbnV4IGVycm9ycy4gSSdkIGxpa2UgdG8ga2VlcCBzZWxpbnV4IHJ1bm5pbmcs
IGVzcGVjaWFsbHkgYXMgaXQgaXMgb2ZmaWNpYWxseSBzdXBwb3J0ZWQNCg0KWWVhaC4gSG0sIGR1
bm5vIHdoeSBpdCBkaWRuJ3Qgd29yaywgcGVyaGFwcyB0aGUgY29uZmlnIGlzIG5vdCBzZXQgdXAg
Y29ycmVjdGx5LiBJIHRob3VnaHQgcmVkZXBsb3kgd291bGQgZml4IGl0IGJ1dCBJIGRvbid0IHJl
YWxseSBrbm93IHRoZSBkZXBsb3ltZW50IGNvZGUgc28gbWF5YmUgSSdtIHdyb25nDQoNCj4gKGFu
ZCB3b3JrcyBvbiB0aGUgb3RoZXIgbm9kZSksIHNvIEkgZ3Vlc3MgdGhlIGJlc3Qgb3B0aW9uIGlz
IHRvIHJlaW5zdGFsbCB0aGUgT1MgYW5kIHRoZW4gaW5zdGFsbCBvdmlydCBhZ2FpbiBwZXJoYXBz
Lg0KDQpUaGF0J3MgdGhlIG1vc3QgZWFzeSB3YXkgb3V0LCB5ZXM6KQ0KDQpUaGFua3MsDQptaWNo
YWwNCj4gDQo+IFRoYW5rcywNCj4gDQo+IENhbXBiZWxsDQo+IA0KPj4gT24gV2VkLCBNYXkgMjUs
IDIwMTYgYXQgNjoxNSBQTSwgTWljaGFsIFNrcml2YW5layA8bXNrcml2YW5AcmVkaGF0LmNvbT4g
d3JvdGU6DQo+PiANCj4+IA0KPj4+IE9uIDI1IE1heSAyMDE2LCBhdCAxOToxMiwgQ2FtIE1hYyA8
aXVjb3VudUBnbWFpbC5jb20+IHdyb3RlOg0KPj4+IA0KPj4+IEknbGwgdHJ5IHRoYXQgLSBwcmVz
dW1hYmx5IG9uIHRoZSBwYXRocyBpdCBpcyBjb21wbGFpbmluZyBhYm91dCwgYW5kIHRoZSBxZW11
IGJpbmFyeXM/DQo+PiANCj4+IEl0IHNob3VsZG4ndCBodXJ0IG9uIC8sIGl0IHNob3VsZCBvbmx5
IGhlbHA6KQ0KPj4gQW5kIGlmIGl0IGNvbXBsYWlucyBlLmcuIG9uIGF0dGFjaGVkIG5mcywgdGhl
IGkgc3VwcG9zZSB5b3UgbmVlZCB0byBydW4gaXQgdGhlcmUgdG9vDQo+PiANCj4+IA0KPj4+IA0K
Pj4+PiBPbiBXZWQsIE1heSAyNSwgMjAxNiBhdCA0OjU5IFBNLCBNaWNoYWwgU2tyaXZhbmVrIDxt
aWNoYWwuc2tyaXZhbmVrQHJlZGhhdC5jb20+IHdyb3RlOg0KPj4+PiANCj4+Pj4+IE9uIDI1IE1h
eSAyMDE2LCBhdCAxNzozNSwgQ2FtIE1hYyA8aXVjb3VudUBnbWFpbC5jb20+IHdyb3RlOg0KPj4+
Pj4gDQo+Pj4+PiBIaSBNaWNoYWwsDQo+Pj4+PiANCj4+Pj4+IEkgY2hvc2UgdGhlICdyZWluc3Rh
bGwgbm9kZScgb3B0aW9uIGZyb20gdGhlIEdVSSBtZW51LCB3aGljaCBhcHBlYXJlZCB0byBnbyBv
aywgaG93ZXZlciwgSSBzdGlsbCBjYW5ub3QgY3JlYXRlIG9yIG1pZ3JhdGUgYSBWTSBvbiB0aGF0
IG5vZGUuIEkgY2FuIHNlZSBzZWxpbnV4ICdkZW5pZWQnIG1lc3NhZ2VzIHJlbGF0aW5nIHRvIHFl
bXUta3ZtLCBlLmcuOg0KPj4+Pj4gDQo+Pj4+PiB0eXBlPUFWQyBtc2c9YXVkaXQoMTQ2NDE4OTIz
Mi4xMzY6MjUxKTogYXZjOiAgZGVuaWVkICB7IHJlYWQgfSBmb3IgIHBpZD00MDE5IGNvbW09InFl
bXUta3ZtIiBuYW1lPSI2NTAwMDBhYi1iMzNhLTQ4M2EtYWY0Ni03NmY3MzA1ZTJhZTUiIGRldj0i
c2RhMiIgaW5vPTM1NDAxIHNjb250ZXh0PXN5c3RlbV8NCj4+Pj4+IHU6c3lzdGVtX3I6c3ZpcnRf
dDpzMDpjNzIwLGM5MjcgdGNvbnRleHQ9c3lzdGVtX3U6b2JqZWN0X3I6dW5sYWJlbGVkX3Q6czAg
dGNsYXNzPWxua19maWxlDQo+Pj4+PiANCj4+Pj4+IFRoZXJlIGFyZSBhIG51bWJlciBvZiBlcnJv
cnMgaW4gdGhlIHZkc20gbG9nIGJ1dCBJIGFzc3VtZSB0aGF0IHJlbGF0ZXMgdG8gc2VsaW51eCBi
bG9ja2luZyBpdC4gU28gcGVyaGFwcyBJIG5lZWQgdG8gcmVtb3ZlIGFsbCB0aGUgb3ZpcnQgcGFj
a2FnZXMgbWFudWFsbHksIG9yIHBlcmhhcHMgcmUtaW5zdGFsbCB0aGUgT1MgYXMgd2VsbD8gSSBn
dWVzcyBlaXRoZXIgb2YgdGhvc2Ugb3B0aW9ucyBpbnZvbHZlcyBjb21wbGljYXRpb25zIHdpdGgg
Y2VydGlmaWNhdGVzIGFuZCBXV0lEcyBmb3IgdGhlIGF0dGFjaGVkIFNBTi4gDQo+Pj4+PiANCj4+
Pj4+IE9yIGNvdWxkIEkgc29tZWhvdyBnZW5lcmF0ZSBzZWxpbnV4IGxhYmVscz8NCj4+Pj4gDQo+
Pj4+IHllYWgsIEkgdGhpbmsgaXQgZGlkbuKAmXQgaGFwcGVuLiBJIHRob3VnaCB3ZSBkbyByZWxh
YmVsbGluZyBhcyBwYXJ0IG9mIGRlcGxveQ0KPj4+PiBIb3cgYWJvdXQgcnVubmluZyAicmVzdG9y
ZWNvbiAtcuKAnSBub3c/DQo+Pj4+IA0KPj4+Pj4gDQo+Pj4+PiBUaGVzZSBub2RlcyArIGVuZ2lu
ZSBhcmUgbm90IHlldCBwcm9kdWN0aW9uLCB0aG91Z2ggSSdkIHByZWZlciB0byBmaXggdGhhbiBy
ZXN0YXJ0IGVudGlyZWx5IGZyb20gc2NyYXRjaC4NCj4+Pj4+IA0KPj4+Pj4gVGhhbmtzIGZvciBh
bnkgaGVscC4NCj4+Pj4+IA0KPj4+Pj4gcmVnYXJkcywNCj4+Pj4+IA0KPj4+Pj4gQ2FtcGJlbGwN
Cj4+Pj4+IA0KPj4+Pj4gDQo+Pj4+Pj4gT24gV2VkLCBNYXkgMTEsIDIwMTYgYXQgMzoxMyBQTSwg
Q2FtIE1hYyA8aXVjb3VudUBnbWFpbC5jb20+IHdyb3RlOg0KPj4+Pj4+IEFoLCBvayB0aGF0IG1h
a2VzIHNlbnNlLiBGb3IgdGhlIG5vZGUsIGlzIGl0IGVub3VnaCB0byB1c2UgdGhlICdyZWluc3Rh
bGwgbm9kZScgb3B0aW9uIGZyb20gdGhlIEdVSSwgb3IgaXMgaXQgYmV0dGVyIHRvIHJlaW5zdGFs
bCB0aGUgT1MgYW5kIHRoZW4gZGVwbG95IGl0IGFnYWluPw0KPj4+Pj4+IA0KPj4+Pj4+IFRoYW5r
cywNCj4+Pj4+PiANCj4+Pj4+PiBDYW0NCj4+Pj4+PiANCj4+Pj4+Pj4gT24gV2VkLCBNYXkgMTEs
IDIwMTYgYXQgMjo0MCBQTSwgTWljaGFsIFNrcml2YW5layA8bWljaGFsLnNrcml2YW5la0ByZWRo
YXQuY29tPiB3cm90ZToNCj4+Pj4+Pj4gDQo+Pj4+Pj4+PiBPbiAxMSBNYXkgMjAxNiwgYXQgMTU6
MjQsIENhbSBNYWMgPGl1Y291bnVAZ21haWwuY29tPiB3cm90ZToNCj4+Pj4+Pj4+IA0KPj4+Pj4+
Pj4gVGhhbmtzIE1pY2hhbCwgaWYgcmVpbnN0YWxsaW5nIHRoZSBlbmdpbmUsICh3aGljaCBhbHNv
IGhhZCBTRUxpbnV4IGRpc2FibGVkIGF0IGluc3RhbGwpLCB3b3VsZCB0aGUgYmVzdCB3YXkgYmUg
dG8gYmFja3VwIHRoZSBlbmdpbmUgYW5kIHRoZW4gcmVzdG9yZSBqdXN0IHRoZSBvdmlydCBjb25m
aWc/DQo+Pj4+Pj4+IA0KPj4+Pj4+PiBmb3IgZW5naW5lLi53ZWxsLCBWTSBzZWN1cml0eSBpcyBu
b3QgcmVsYXRlZCB0byB0aGF0LCB0aG9zZSBhcmUgcnVubmluZyBvbiBoeXBlcnZpc29ycywgbm90
IHRoZSBlbmdpbmUuIFNvIGZvciBhbnkgZnVuY3Rpb25hbGl0eS9zZWN1cml0eSBpdOKAmXMgaXJy
ZWxldmFudCB3aGF0IFNFTGludXggc3RhdGUgaXTigJlzIGluDQo+Pj4+Pj4+IEnigJltIG5vdCBz
dXJlIGlmIHJlbGFiZWxpbmcgd2l0aCByZXN0b3JlY29uIGlzIG5vdCBlbm91Z2ggKGl0IHNvdWxk
IHdvcmsgYWxzbyBvbiBub2RlcywgYnV0IGFzIEkgc2FpZCwgaXTigJlzIGxpa2VseSBtb3JlIHNh
ZmUgdG8gcmVpbnN0YWxsIGp1c3QgdG8gYmUgcmVhbGx5IHJlYWxseSBzdXJlOikNCj4+Pj4+Pj4g
U2ltb25lLCBhbSBJIHJpZ2h0IGFib3V0IHRoZSByZXN0b3JlY29uIGZvciBlbmdpbmU/DQo+Pj4+
Pj4+IA0KPj4+Pj4+Pj4gDQo+Pj4+Pj4+PiBDaGVlcnMsDQo+Pj4+Pj4+PiANCj4+Pj4+Pj4+IENh
bQ0KPj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4gT24gV2VkLCBNYXkgMTEsIDIwMTYgYXQgMjoxNCBQTSwg
TWljaGFsIFNrcml2YW5layA8bWljaGFsLnNrcml2YW5la0ByZWRoYXQuY29tPiB3cm90ZToNCj4+
Pj4+Pj4+PiANCj4+Pj4+Pj4+PiA+IE9uIDExIE1heSAyMDE2LCBhdCAxNTowMiwgQ2FtIE1hYyA8
aXVjb3VudUBnbWFpbC5jb20+IHdyb3RlOg0KPj4+Pj4+Pj4+ID4NCj4+Pj4+Pj4+PiA+IEhpLA0K
Pj4+Pj4+Pj4+ID4NCj4+Pj4+Pj4+PiA+IEluIHRoZSBvVmlydCBndWlkZSwgaXQgc2F5cyB0aGF0
ICJTRUxpbnV4IGlzIGJlaW5nIHVzZWQgYnkgZGVmYXVsdCBvbiBvVmlydCBOb2RlIiwgYnV0IHRo
ZW4gZ29lcyBvbiB0byBzYXkgdGhhdCBpZiB5b3UgaGF2ZSBwcm9ibGVtcyB5b3Ugc2hvdWxkIHNl
dCBpdCB0byBwZXJtaXNzaXZlIG1vZGUuIEkgaGF2ZSBoYWQgYSBmZXcgdGhpbmdzIGZhaWwgZHVl
IHRvIGJlaW5nIGJsb2NrZWQgYnkgU0VMaW51eCBvbiBhIG5vZGUgSSBsYXRlciBlbmFibGVkIFNF
TGludXggb24sIGFzIGl0IHdhcyBvZmYgYXQgaW5zdGFsbCB0aW1lLiBUaGUgb3RoZXIgbm9kZSB3
aGljaCBoYXMgaGFkIFNFTGludXggb24gZnJvbSB0aGUgc3RhcnQgYW5kIHNvIGZhciBoYXMgbm90
IGhhZCBhbnkgb1ZpcnQgb3BlcmF0aW9ucyBibG9ja2VkLiBJIGFtIGd1ZXNzaW5nIHRoYXQgdGhl
IG9WaXJ0IGluc3RhbGwgcHJvY2VzcyBjcmVhdGVzIHRoZSBuZWNlc3NhcnkgcnVsZXMgdG8gYWxs
b3cgdmRzbSB0byBydW4gdW5kZXIgU0VMaW51eC4gU28gaWYgeW91IHdhbnQgdG8gc2V0IFNFTGlu
dXggdG8gZW5mb3JjaW5nIGFmdGVyIGluc3RhbGxhdGlvbiwgaXMgdGhlcmUgYSBzY3JpcHQgdG8g
ZG8gdGhpcywgb3IgaXMgaXQgYmV0dGVyIHRvIGp1c3QgcmVpbnN0YWxsIHRoZSBub2RlIG9yIGVu
Z2luZSwgcmF0aGVyIHRoYW4gdHJ5aW5nIHRvIHdvcmsgb3V0IHRoZSBpbmRpdmlkdWFsIGV4Y2Vw
dGlvbnM/DQo+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4gRm9yIG9WaXJ0IG5vZGUgaXTigJlzIGVhc2ll
ciB0byByZWluc3RhbGwgaXQsIGl0IGRvZXNu4oCZdCBwZXJzaXN0IG11Y2ggYW5kIGl04oCZcyB0
aGUgZWFzaWVzIHdheSBob3cgdG8gZ2V0IHRoZSBsYWJlbGxpbmcgcmlnaHQNCj4+Pj4+Pj4+PiAN
Cj4+Pj4+Pj4+PiBUaGFua3MsDQo+Pj4+Pj4+Pj4gbWljaGFsDQo+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+
Pj4gPg0KPj4+Pj4+Pj4+ID4gVGhhbmtzLA0KPj4+Pj4+Pj4+ID4NCj4+Pj4+Pj4+PiA+IENhbQ0K
Pj4+Pj4+Pj4+ID4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X18NCj4+Pj4+Pj4+PiA+IFVzZXJzIG1haWxpbmcgbGlzdA0KPj4+Pj4+Pj4+ID4gVXNlcnNAb3Zp
cnQub3JnDQo+Pj4+Pj4+Pj4gPiBodHRwOi8vbGlzdHMub3ZpcnQub3JnL21haWxtYW4vbGlzdGlu
Zm8vdXNlcnMNCj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4gX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+Pj4+Pj4+IFVzZXJzIG1haWxpbmcg
bGlzdA0KPj4+Pj4+Pj4gVXNlcnNAb3ZpcnQub3JnDQo+Pj4+Pj4+PiBodHRwOi8vbGlzdHMub3Zp
cnQub3JnL21haWxtYW4vbGlzdGluZm8vdXNlcnMNCj4+Pj4+Pj4gDQo+Pj4+Pj4gDQo+Pj4+PiAN
Cj4+Pj4gDQo+Pj4gDQo+IA0K
--Apple-Mail-31476308-D6F5-4B3E-AE26-09A43CB9A8DD
Content-Type: text/html;
charset=utf-8
Content-Transfer-Encoding: base64
PGh0bWw+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0
L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPjwvaGVhZD48Ym9keSBkaXI9ImF1dG8iPjxkaXY+PC9kaXY+
PGRpdj48YnI+PC9kaXY+PGRpdj48YnI+T24gMjUgTWF5IDIwMTYsIGF0IDE5OjI5LCBDYW0gTWFj
ICZsdDs8YSBocmVmPSJtYWlsdG86aXVjb3VudUBnbWFpbC5jb20iPml1Y291bnVAZ21haWwuY29t
PC9hPiZndDsgd3JvdGU6PGJyPjxicj48L2Rpdj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2
PjxkaXYgZGlyPSJsdHIiPkhpIE1pY2hhbCw8ZGl2Pjxicj48L2Rpdj48ZGl2PlJhbiByZXN0b3Jl
Y29uIC1yIG9uICcvJyAoYW5kIHJlc3RhcnRlZCB2ZHNtZCBhbmQgb3RoZXIgc2VydmljZXMpOiBp
dCBpcyBzdGlsbCBnZXR0aW5nIHNlbGludXggZXJyb3JzLiBJJ2QgbGlrZSB0byBrZWVwIHNlbGlu
dXggcnVubmluZywgZXNwZWNpYWxseSBhcyBpdCBpcyBvZmZpY2lhbGx5IHN1cHBvcnRlZCA8L2Rp
dj48L2Rpdj48L2Rpdj48L2Jsb2NrcXVvdGU+PGRpdj48YnI+PC9kaXY+WWVhaC4gSG0sIGR1bm5v
IHdoeSBpdCBkaWRuJ3Qgd29yaywgcGVyaGFwcyB0aGUgY29uZmlnIGlzIG5vdCBzZXQgdXAgY29y
cmVjdGx5LiBJIHRob3VnaHQgcmVkZXBsb3kgd291bGQgZml4IGl0IGJ1dCBJIGRvbid0IHJlYWxs
eSBrbm93IHRoZSBkZXBsb3ltZW50IGNvZGUgc28gbWF5YmUgSSdtIHdyb25nPGRpdj48YnI+PGJs
b2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGRpdj48ZGl2IGRpcj0ibHRyIj48ZGl2PihhbmQgd29ya3Mg
b24gdGhlIG90aGVyIG5vZGUpLCBzbyBJIGd1ZXNzIHRoZSBiZXN0IG9wdGlvbiBpcyB0byByZWlu
c3RhbGwgdGhlIE9TIGFuZCB0aGVuIGluc3RhbGwgb3ZpcnQgYWdhaW4gcGVyaGFwcy48L2Rpdj48
L2Rpdj48L2Rpdj48L2Jsb2NrcXVvdGU+PGRpdj48YnI+PC9kaXY+VGhhdCdzIHRoZSBtb3N0IGVh
c3kgd2F5IG91dCwgeWVzOik8L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PlRoYW5rcyw8L2Rpdj48
ZGl2Pm1pY2hhbDxicj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2PjxkaXYgZGlyPSJsdHIi
PjxkaXY+PGJyPjwvZGl2PjxkaXY+VGhhbmtzLDwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+Q2Ft
cGJlbGw8L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+PGJyPjxkaXYgY2xhc3M9
ImdtYWlsX3F1b3RlIj5PbiBXZWQsIE1heSAyNSwgMjAxNiBhdCA2OjE1IFBNLCBNaWNoYWwgU2ty
aXZhbmVrIDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOm1za3JpdmFuQHJlZGhh
dC5jb20iIHRhcmdldD0iX2JsYW5rIj5tc2tyaXZhbkByZWRoYXQuY29tPC9hPiZndDs8L3NwYW4+
IHdyb3RlOjxicj48YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46
MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4Ij48
ZGl2IGRpcj0iYXV0byI+PHNwYW4gY2xhc3M9IiI+PGRpdj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48
ZGl2Pjxicj5PbiAyNSBNYXkgMjAxNiwgYXQgMTk6MTIsIENhbSBNYWMgJmx0OzxhIGhyZWY9Im1h
aWx0bzppdWNvdW51QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPml1Y291bnVAZ21haWwuY29t
PC9hPiZndDsgd3JvdGU6PGJyPjxicj48L2Rpdj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2
PjxkaXYgZGlyPSJsdHIiPkknbGwgdHJ5IHRoYXQgLSBwcmVzdW1hYmx5IG9uIHRoZSBwYXRocyBp
dCBpcyBjb21wbGFpbmluZyBhYm91dCwgYW5kIHRoZSBxZW11IGJpbmFyeXM/PC9kaXY+PC9kaXY+
PC9ibG9ja3F1b3RlPjxkaXY+PGJyPjwvZGl2Pjwvc3Bhbj5JdCBzaG91bGRuJ3QgaHVydCBvbiAv
LCBpdCBzaG91bGQgb25seSBoZWxwOik8ZGl2PkFuZCBpZiBpdCBjb21wbGFpbnMgZS5nLiBvbiBh
dHRhY2hlZCBuZnMsIHRoZSBpIHN1cHBvc2UgeW91IG5lZWQgdG8gcnVuIGl0IHRoZXJlIHRvbzxk
aXY+PGRpdiBjbGFzcz0iaDUiPjxicj48ZGl2Pjxicj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48
ZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnI+PGRpdiBjbGFzcz0iZ21haWxfcXVvdGUi
Pk9uIFdlZCwgTWF5IDI1LCAyMDE2IGF0IDQ6NTkgUE0sIE1pY2hhbCBTa3JpdmFuZWsgPHNwYW4g
ZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86bWljaGFsLnNrcml2YW5la0ByZWRoYXQuY29t
IiB0YXJnZXQ9Il9ibGFuayI+bWljaGFsLnNrcml2YW5la0ByZWRoYXQuY29tPC9hPiZndDs8L3Nw
YW4+IHdyb3RlOjxicj48YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJn
aW46MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4
Ij48ZGl2IHN0eWxlPSJ3b3JkLXdyYXA6YnJlYWstd29yZCI+PGJyPjxkaXY+PHNwYW4+PGJsb2Nr
cXVvdGUgdHlwZT0iY2l0ZSI+PGRpdj5PbiAyNSBNYXkgMjAxNiwgYXQgMTc6MzUsIENhbSBNYWMg
Jmx0OzxhIGhyZWY9Im1haWx0bzppdWNvdW51QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPml1
Y291bnVAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PC9kaXY+PGJyPjxkaXY+PGRpdiBkaXI9Imx0
ciI+SGkgTWljaGFsLDxkaXY+PGJyPjwvZGl2PjxkaXY+SSBjaG9zZSB0aGUgJ3JlaW5zdGFsbCBu
b2RlJyBvcHRpb24gZnJvbSB0aGUgR1VJIG1lbnUsIHdoaWNoIGFwcGVhcmVkIHRvIGdvIG9rLCBo
b3dldmVyLCBJIHN0aWxsIGNhbm5vdCBjcmVhdGUgb3IgbWlncmF0ZSBhIFZNIG9uIHRoYXQgbm9k
ZS4gSSBjYW4gc2VlIHNlbGludXggJ2RlbmllZCcgbWVzc2FnZXMgcmVsYXRpbmcgdG8gcWVtdS1r
dm0sIGUuZy46PC9kaXY+PGRpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PnR5cGU9QVZDIG1zZz1hdWRp
dCgxNDY0MTg5MjMyLjEzNjoyNTEpOiBhdmM6ICZuYnNwO2RlbmllZCAmbmJzcDt7IHJlYWQgfSBm
b3IgJm5ic3A7cGlkPTQwMTkgY29tbT0icWVtdS1rdm0iIG5hbWU9IjY1MDAwMGFiLWIzM2EtNDgz
YS1hZjQ2LTc2ZjczMDVlMmFlNSIgZGV2PSJzZGEyIiBpbm89MzU0MDEgc2NvbnRleHQ9c3lzdGVt
XzwvZGl2PjxkaXY+dTpzeXN0ZW1fcjpzdmlydF90OnMwOmM3MjAsYzkyNyB0Y29udGV4dD1zeXN0
ZW1fdTpvYmplY3Rfcjp1bmxhYmVsZWRfdDpzMCB0Y2xhc3M9bG5rX2ZpbGU8L2Rpdj48L2Rpdj48
ZGl2Pjxicj48L2Rpdj48ZGl2PlRoZXJlIGFyZSBhIG51bWJlciBvZiBlcnJvcnMgaW4gdGhlIHZk
c20gbG9nIGJ1dCBJIGFzc3VtZSB0aGF0IHJlbGF0ZXMgdG8gc2VsaW51eCBibG9ja2luZyBpdC4g
U28gcGVyaGFwcyBJIG5lZWQgdG8gcmVtb3ZlIGFsbCB0aGUgb3ZpcnQgcGFja2FnZXMgbWFudWFs
bHksIG9yIHBlcmhhcHMgcmUtaW5zdGFsbCB0aGUgT1MgYXMgd2VsbD8gSSBndWVzcyBlaXRoZXIg
b2YgdGhvc2Ugb3B0aW9ucyBpbnZvbHZlcyBjb21wbGljYXRpb25zIHdpdGggY2VydGlmaWNhdGVz
IGFuZCBXV0lEcyBmb3IgdGhlIGF0dGFjaGVkIFNBTi4mbmJzcDs8L2Rpdj48ZGl2Pjxicj48L2Rp
dj48ZGl2Pk9yIGNvdWxkIEkgc29tZWhvdyBnZW5lcmF0ZSBzZWxpbnV4IGxhYmVscz88L2Rpdj48
L2Rpdj48L2Rpdj48L2Jsb2NrcXVvdGU+PGRpdj48YnI+PC9kaXY+PC9zcGFuPnllYWgsIEkgdGhp
bmsgaXQgZGlkbuKAmXQgaGFwcGVuLiBJIHRob3VnaCB3ZSBkbyByZWxhYmVsbGluZyBhcyBwYXJ0
IG9mIGRlcGxveTwvZGl2PjxkaXY+SG93IGFib3V0IHJ1bm5pbmcgInJlc3RvcmVjb24gLXLigJ0g
bm93PzwvZGl2PjxkaXY+PGRpdj48ZGl2Pjxicj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2
PjxkaXYgZGlyPSJsdHIiPjxkaXY+PGJyPjwvZGl2PjxkaXY+VGhlc2Ugbm9kZXMgKyBlbmdpbmUg
YXJlIG5vdCB5ZXQgcHJvZHVjdGlvbiwgdGhvdWdoIEknZCBwcmVmZXIgdG8gZml4IHRoYW4gcmVz
dGFydCBlbnRpcmVseSBmcm9tIHNjcmF0Y2guPC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5UaGFu
a3MgZm9yIGFueSBoZWxwLjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+cmVnYXJkcyw8L2Rpdj48
ZGl2Pjxicj5DYW1wYmVsbDwvZGl2PjxkaXY+PGJyPjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9Imdt
YWlsX2V4dHJhIj48YnI+PGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPk9uIFdlZCwgTWF5IDExLCAy
MDE2IGF0IDM6MTMgUE0sIENhbSBNYWMgPHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWls
dG86aXVjb3VudUBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5pdWNvdW51QGdtYWlsLmNvbTwv
YT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBz
dHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGlu
Zy1sZWZ0OjFleCI+PGRpdiBkaXI9Imx0ciI+QWgsIG9rIHRoYXQgbWFrZXMgc2Vuc2UuIEZvciB0
aGUgbm9kZSwgaXMgaXQgZW5vdWdoIHRvIHVzZSB0aGUgJ3JlaW5zdGFsbCBub2RlJyBvcHRpb24g
ZnJvbSB0aGUgR1VJLCBvciBpcyBpdCBiZXR0ZXIgdG8gcmVpbnN0YWxsIHRoZSBPUyBhbmQgdGhl
biBkZXBsb3kgaXQgYWdhaW4/PGRpdj48YnI+PC9kaXY+PGRpdj5UaGFua3MsPC9kaXY+PGRpdj48
YnI+Q2FtPC9kaXY+PC9kaXY+PGRpdj48ZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnI+
PGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPk9uIFdlZCwgTWF5IDExLCAyMDE2IGF0IDI6NDAgUE0s
IE1pY2hhbCBTa3JpdmFuZWsgPHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86bWlj
aGFsLnNrcml2YW5la0ByZWRoYXQuY29tIiB0YXJnZXQ9Il9ibGFuayI+bWljaGFsLnNrcml2YW5l
a0ByZWRoYXQuY29tPC9hPiZndDs8L3NwYW4+IHdyb3RlOjxicj48YmxvY2txdW90ZSBjbGFzcz0i
Z21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2Nj
YyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4Ij48ZGl2IHN0eWxlPSJ3b3JkLXdyYXA6YnJlYWstd29y
ZCI+PGJyPjxkaXY+PHNwYW4+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGRpdj5PbiAxMSBNYXkg
MjAxNiwgYXQgMTU6MjQsIENhbSBNYWMgJmx0OzxhIGhyZWY9Im1haWx0bzppdWNvdW51QGdtYWls
LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPml1Y291bnVAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PC9k
aXY+PGJyPjxkaXY+PGRpdiBkaXI9Imx0ciI+VGhhbmtzIE1pY2hhbCwgaWYgcmVpbnN0YWxsaW5n
IHRoZSBlbmdpbmUsICh3aGljaCBhbHNvIGhhZCBTRUxpbnV4IGRpc2FibGVkIGF0IGluc3RhbGwp
LCB3b3VsZCB0aGUgYmVzdCB3YXkgYmUgdG8gYmFja3VwIHRoZSBlbmdpbmUgYW5kIHRoZW4gcmVz
dG9yZSBqdXN0IHRoZSBvdmlydCBjb25maWc/PC9kaXY+PC9kaXY+PC9ibG9ja3F1b3RlPjxkaXY+
PGJyPjwvZGl2Pjwvc3Bhbj5mb3IgZW5naW5lLi53ZWxsLCBWTSBzZWN1cml0eSBpcyBub3QgcmVs
YXRlZCB0byB0aGF0LCB0aG9zZSBhcmUgcnVubmluZyBvbiBoeXBlcnZpc29ycywgbm90IHRoZSBl
bmdpbmUuIFNvIGZvciBhbnkgZnVuY3Rpb25hbGl0eS9zZWN1cml0eSBpdOKAmXMgaXJyZWxldmFu
dCB3aGF0IFNFTGludXggc3RhdGUgaXTigJlzIGluPC9kaXY+PGRpdj5J4oCZbSBub3Qgc3VyZSBp
ZiByZWxhYmVsaW5nIHdpdGggcmVzdG9yZWNvbiBpcyBub3QgZW5vdWdoIChpdCBzb3VsZCB3b3Jr
IGFsc28gb24gbm9kZXMsIGJ1dCBhcyBJIHNhaWQsIGl04oCZcyBsaWtlbHkgbW9yZSBzYWZlIHRv
IHJlaW5zdGFsbCBqdXN0IHRvIGJlIHJlYWxseSByZWFsbHkgc3VyZTopPC9kaXY+PGRpdj5TaW1v
bmUsIGFtIEkgcmlnaHQgYWJvdXQgdGhlIHJlc3RvcmVjb24gZm9yIGVuZ2luZT88L2Rpdj48c3Bh
bj48ZGl2Pjxicj48L2Rpdj48ZGl2PjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxkaXY+PGRpdiBk
aXI9Imx0ciI+PGRpdj48YnI+PC9kaXY+PGRpdj5DaGVlcnMsPC9kaXY+PGRpdj48YnI+PC9kaXY+
PGRpdj5DYW08L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+PGJyPjxkaXYgY2xh
c3M9ImdtYWlsX3F1b3RlIj5PbiBXZWQsIE1heSAxMSwgMjAxNiBhdCAyOjE0IFBNLCBNaWNoYWwg
U2tyaXZhbmVrIDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOm1pY2hhbC5za3Jp
dmFuZWtAcmVkaGF0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1pY2hhbC5za3JpdmFuZWtAcmVkaGF0
LmNvbTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1
b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7
cGFkZGluZy1sZWZ0OjFleCI+PHNwYW4+PGJyPg0KJmd0OyBPbiAxMSBNYXkgMjAxNiwgYXQgMTU6
MDIsIENhbSBNYWMgJmx0OzxhIGhyZWY9Im1haWx0bzppdWNvdW51QGdtYWlsLmNvbSIgdGFyZ2V0
PSJfYmxhbmsiPml1Y291bnVAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PGJyPg0KJmd0Ozxicj4N
CiZndDsgSGksPGJyPg0KJmd0Ozxicj4NCiZndDsgSW4gdGhlIG9WaXJ0IGd1aWRlLCBpdCBzYXlz
IHRoYXQgIlNFTGludXggaXMgYmVpbmcgdXNlZCBieSBkZWZhdWx0IG9uIG9WaXJ0IE5vZGUiLCBi
dXQgdGhlbiBnb2VzIG9uIHRvIHNheSB0aGF0IGlmIHlvdSBoYXZlIHByb2JsZW1zIHlvdSBzaG91
bGQgc2V0IGl0IHRvIHBlcm1pc3NpdmUgbW9kZS4gSSBoYXZlIGhhZCBhIGZldyB0aGluZ3MgZmFp
bCBkdWUgdG8gYmVpbmcgYmxvY2tlZCBieSBTRUxpbnV4IG9uIGEgbm9kZSBJIGxhdGVyIGVuYWJs
ZWQgU0VMaW51eCBvbiwgYXMgaXQgd2FzIG9mZiBhdCBpbnN0YWxsIHRpbWUuIFRoZSBvdGhlciBu
b2RlIHdoaWNoIGhhcyBoYWQgU0VMaW51eCBvbiBmcm9tIHRoZSBzdGFydCBhbmQgc28gZmFyIGhh
cyBub3QgaGFkIGFueSBvVmlydCBvcGVyYXRpb25zIGJsb2NrZWQuIEkgYW0gZ3Vlc3NpbmcgdGhh
dCB0aGUgb1ZpcnQgaW5zdGFsbCBwcm9jZXNzIGNyZWF0ZXMgdGhlIG5lY2Vzc2FyeSBydWxlcyB0
byBhbGxvdyB2ZHNtIHRvIHJ1biB1bmRlciBTRUxpbnV4LiBTbyBpZiB5b3Ugd2FudCB0byBzZXQg
U0VMaW51eCB0byBlbmZvcmNpbmcgYWZ0ZXIgaW5zdGFsbGF0aW9uLCBpcyB0aGVyZSBhIHNjcmlw
dCB0byBkbyB0aGlzLCBvciBpcyBpdCBiZXR0ZXIgdG8ganVzdCByZWluc3RhbGwgdGhlIG5vZGUg
b3IgZW5naW5lLCByYXRoZXIgdGhhbiB0cnlpbmcgdG8gd29yayBvdXQgdGhlIGluZGl2aWR1YWwg
ZXhjZXB0aW9ucz88YnI+DQo8YnI+DQo8L3NwYW4+Rm9yIG9WaXJ0IG5vZGUgaXTigJlzIGVhc2ll
ciB0byByZWluc3RhbGwgaXQsIGl0IGRvZXNu4oCZdCBwZXJzaXN0IG11Y2ggYW5kIGl04oCZcyB0
aGUgZWFzaWVzIHdheSBob3cgdG8gZ2V0IHRoZSBsYWJlbGxpbmcgcmlnaHQ8YnI+DQo8YnI+DQpU
aGFua3MsPGJyPg0KbWljaGFsPGJyPg0KPGJyPg0KJmd0Ozxicj4NCiZndDsgVGhhbmtzLDxicj4N
CiZndDs8YnI+DQomZ3Q7IENhbTxicj4NCiZndDsgX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX188YnI+DQomZ3Q7IFVzZXJzIG1haWxpbmcgbGlzdDxicj4NCiZn
dDsgPGEgaHJlZj0ibWFpbHRvOlVzZXJzQG92aXJ0Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPlVzZXJz
QG92aXJ0Lm9yZzwvYT48YnI+DQomZ3Q7IDxhIGhyZWY9Imh0dHA6Ly9saXN0cy5vdmlydC5vcmcv
bWFpbG1hbi9saXN0aW5mby91c2VycyIgcmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+
aHR0cDovL2xpc3RzLm92aXJ0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VzZXJzPC9hPjxicj4NCjxi
cj4NCjwvYmxvY2txdW90ZT48L2Rpdj48YnI+PC9kaXY+DQpfX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fXzxicj5Vc2VycyBtYWlsaW5nIGxpc3Q8YnI+PGEgaHJl
Zj0ibWFpbHRvOlVzZXJzQG92aXJ0Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPlVzZXJzQG92aXJ0Lm9y
ZzwvYT48YnI+PGEgaHJlZj0iaHR0cDovL2xpc3RzLm92aXJ0Lm9yZy9tYWlsbWFuL2xpc3RpbmZv
L3VzZXJzIiB0YXJnZXQ9Il9ibGFuayI+aHR0cDovL2xpc3RzLm92aXJ0Lm9yZy9tYWlsbWFuL2xp
c3RpbmZvL3VzZXJzPC9hPjxicj48L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwvc3Bhbj48
L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwvZGl2Pg0KPC9kaXY+PC9kaXY+PC9ibG9ja3F1
b3RlPjwvZGl2Pjxicj48L2Rpdj4NCjwvZGl2PjwvYmxvY2txdW90ZT48L2Rpdj48YnI+PC9kaXY+
PC9kaXY+PC9kaXY+PC9ibG9ja3F1b3RlPjwvZGl2Pjxicj48L2Rpdj4NCjwvZGl2PjwvYmxvY2tx
dW90ZT48L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJy
PjwvZGl2Pg0KPC9kaXY+PC9ibG9ja3F1b3RlPjwvZGl2PjwvYm9keT48L2h0bWw+
--Apple-Mail-31476308-D6F5-4B3E-AE26-09A43CB9A8DD--
4:46 p.m.
Hi Michal,
I re-installed the OS and then oVirt on that node, with SELinux enabled,
and that has resolved the issue.
Thanks for your help.
Cheers,
Cam
On Wed, May 25, 2016 at 7:24 PM, Michal Skrivanek <mskrivan(a)redhat.com>
wrote:
On 25 May 2016, at 19:29, Cam Mac <iucounu(a)gmail.com> wrote:
Hi Michal,
Ran restorecon -r on '/' (and restarted vdsmd and other services): it is
still getting selinux errors. I'd like to keep selinux running, especially
as it is officially supported
Yeah. Hm, dunno why it didn't work, perhaps the config is not set up
correctly. I thought redeploy would fix it but I don't really know the
deployment code so maybe I'm wrong
(and works on the other node), so I guess the best option is to reinstall
the OS and then install ovirt again perhaps.
That's the most easy way out, yes:)
Thanks,
michal
Thanks,
Campbell
On Wed, May 25, 2016 at 6:15 PM, Michal Skrivanek <mskrivan(a)redhat.com>
wrote:
>
>
> On 25 May 2016, at 19:12, Cam Mac <iucounu(a)gmail.com> wrote:
>
> I'll try that - presumably on the paths it is complaining about, and the
> qemu binarys?
>
>
> It shouldn't hurt on /, it should only help:)
> And if it complains e.g. on attached nfs, the i suppose you need to run
> it there too
>
>
>
> On Wed, May 25, 2016 at 4:59 PM, Michal Skrivanek <
> michal.skrivanek(a)redhat.com> wrote:
>
>>
>> On 25 May 2016, at 17:35, Cam Mac <iucounu(a)gmail.com> wrote:
>>
>> Hi Michal,
>>
>> I chose the 'reinstall node' option from the GUI menu, which appeared to
>> go ok, however, I still cannot create or migrate a VM on that node. I can
>> see selinux 'denied' messages relating to qemu-kvm, e.g.:
>>
>> type=AVC msg=audit(1464189232.136:251): avc: denied { read } for
>> pid=4019 comm="qemu-kvm"
name="650000ab-b33a-483a-af46-76f7305e2ae5"
>> dev="sda2" ino=35401 scontext=system_
>> u:system_r:svirt_t:s0:c720,c927
>> tcontext=system_u:object_r:unlabeled_t:s0 tclass=lnk_file
>>
>> There are a number of errors in the vdsm log but I assume that relates
>> to selinux blocking it. So perhaps I need to remove all the ovirt packages
>> manually, or perhaps re-install the OS as well? I guess either of those
>> options involves complications with certificates and WWIDs for the attached
>> SAN.
>>
>> Or could I somehow generate selinux labels?
>>
>>
>> yeah, I think it didn’t happen. I though we do relabelling as part of
>> deploy
>> How about running "restorecon -r” now?
>>
>>
>> These nodes + engine are not yet production, though I'd prefer to fix
>> than restart entirely from scratch.
>>
>> Thanks for any help.
>>
>> regards,
>>
>> Campbell
>>
>>
>> On Wed, May 11, 2016 at 3:13 PM, Cam Mac <iucounu(a)gmail.com> wrote:
>>
>>> Ah, ok that makes sense. For the node, is it enough to use the
>>> 'reinstall node' option from the GUI, or is it better to reinstall
the OS
>>> and then deploy it again?
>>>
>>> Thanks,
>>>
>>> Cam
>>>
>>> On Wed, May 11, 2016 at 2:40 PM, Michal Skrivanek <
>>> michal.skrivanek(a)redhat.com> wrote:
>>>
>>>>
>>>> On 11 May 2016, at 15:24, Cam Mac <iucounu(a)gmail.com> wrote:
>>>>
>>>> Thanks Michal, if reinstalling the engine, (which also had SELinux
>>>> disabled at install), would the best way be to backup the engine and
then
>>>> restore just the ovirt config?
>>>>
>>>>
>>>> for engine..well, VM security is not related to that, those are
>>>> running on hypervisors, not the engine. So for any
functionality/security
>>>> it’s irrelevant what SELinux state it’s in
>>>> I’m not sure if relabeling with restorecon is not enough (it sould
>>>> work also on nodes, but as I said, it’s likely more safe to reinstall
just
>>>> to be really really sure:)
>>>> Simone, am I right about the restorecon for engine?
>>>>
>>>>
>>>> Cheers,
>>>>
>>>> Cam
>>>>
>>>> On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek <
>>>> michal.skrivanek(a)redhat.com> wrote:
>>>>
>>>>>
>>>>> > On 11 May 2016, at 15:02, Cam Mac <iucounu(a)gmail.com>
wrote:
>>>>> >
>>>>> > Hi,
>>>>> >
>>>>> > In the oVirt guide, it says that "SELinux is being used by
default
>>>>> on oVirt Node", but then goes on to say that if you have
problems you
>>>>> should set it to permissive mode. I have had a few things fail due to
being
>>>>> blocked by SELinux on a node I later enabled SELinux on, as it was
off at
>>>>> install time. The other node which has had SELinux on from the start
and so
>>>>> far has not had any oVirt operations blocked. I am guessing that the
oVirt
>>>>> install process creates the necessary rules to allow vdsm to run
under
>>>>> SELinux. So if you want to set SELinux to enforcing after
installation, is
>>>>> there a script to do this, or is it better to just reinstall the node
or
>>>>> engine, rather than trying to work out the individual exceptions?
>>>>>
>>>>> For oVirt node it’s easier to reinstall it, it doesn’t persist much
>>>>> and it’s the easies way how to get the labelling right
>>>>>
>>>>> Thanks,
>>>>> michal
>>>>>
>>>>> >
>>>>> > Thanks,
>>>>> >
>>>>> > Cam
>>>>> > _______________________________________________
>>>>> > Users mailing list
>>>>> > Users(a)ovirt.org
>>>>> > http://lists.ovirt.org/mailman/listinfo/users
>>>>>
>>>>>
>>>> _______________________________________________
>>>> Users mailing list
>>>> Users(a)ovirt.org
>>>> http://lists.ovirt.org/mailman/listinfo/users
>>>>
>>>>
>>>>
>>>
>>
>>
>
3102
days inactive
3117
days old
11 comments
3 participants
participants (3)
-
Cam Mac -
Michal Skrivanek -
Michal Skrivanek