Hi, In the oVirt guide, it says that "SELinux is being used by default on oVirt Node", but then goes on to say that if you have problems you should set it to permissive mode. I have had a few things fail due to being blocked by SELinux on a node I later enabled SELinux on, as it was off at install time. The other node which has had SELinux on from the start and so far has not had any oVirt operations blocked. I am guessing that the oVirt install process creates the necessary rules to allow vdsm to run under SELinux. So if you want to set SELinux to enforcing after installation, is there a script to do this, or is it better to just reinstall the node or engine, rather than trying to work out the individual exceptions? Thanks, Cam
On 11 May 2016, at 15:02, Cam Mac <iucounu@gmail.com> wrote:
Hi,
In the oVirt guide, it says that "SELinux is being used by default on oVirt Node", but then goes on to say that if you have problems you should set it to permissive mode. I have had a few things fail due to being blocked by SELinux on a node I later enabled SELinux on, as it was off at install time. The other node which has had SELinux on from the start and so far has not had any oVirt operations blocked. I am guessing that the oVirt install process creates the necessary rules to allow vdsm to run under SELinux. So if you want to set SELinux to enforcing after installation, is there a script to do this, or is it better to just reinstall the node or engine, rather than trying to work out the individual exceptions?
For oVirt node it’s easier to reinstall it, it doesn’t persist much and it’s the easies way how to get the labelling right Thanks, michal
Thanks,
Cam _______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
Thanks Michal, if reinstalling the engine, (which also had SELinux disabled at install), would the best way be to backup the engine and then restore just the ovirt config? Cheers, Cam On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek < michal.skrivanek@redhat.com> wrote:
On 11 May 2016, at 15:02, Cam Mac <iucounu@gmail.com> wrote:
Hi,
In the oVirt guide, it says that "SELinux is being used by default on oVirt Node", but then goes on to say that if you have problems you should set it to permissive mode. I have had a few things fail due to being blocked by SELinux on a node I later enabled SELinux on, as it was off at install time. The other node which has had SELinux on from the start and so far has not had any oVirt operations blocked. I am guessing that the oVirt install process creates the necessary rules to allow vdsm to run under SELinux. So if you want to set SELinux to enforcing after installation, is there a script to do this, or is it better to just reinstall the node or engine, rather than trying to work out the individual exceptions?
For oVirt node it’s easier to reinstall it, it doesn’t persist much and it’s the easies way how to get the labelling right
Thanks, michal
Thanks,
Cam _______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
On 11 May 2016, at 15:24, Cam Mac <iucounu@gmail.com> wrote: =20 Thanks Michal, if reinstalling the engine, (which also had SELinux = disabled at install), would the best way be to backup the engine and =
=20 Cheers, =20 Cam =20 On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek = <michal.skrivanek@redhat.com <mailto:michal.skrivanek@redhat.com>> = wrote: =20
On 11 May 2016, at 15:02, Cam Mac <iucounu@gmail.com = <mailto:iucounu@gmail.com>> wrote:
Hi,
In the oVirt guide, it says that "SELinux is being used by default = on oVirt Node", but then goes on to say that if you have problems you = should set it to permissive mode. I have had a few things fail due to = being blocked by SELinux on a node I later enabled SELinux on, as it was = off at install time. The other node which has had SELinux on from the = start and so far has not had any oVirt operations blocked. I am guessing =
=20 For oVirt node it=E2=80=99s easier to reinstall it, it doesn=E2=80=99t =
--Apple-Mail=_CDE436FE-61F8-4137-8BB4-CE456B791151 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 then restore just the ovirt config? for engine..well, VM security is not related to that, those are running = on hypervisors, not the engine. So for any functionality/security it=E2=80= =99s irrelevant what SELinux state it=E2=80=99s in I=E2=80=99m not sure if relabeling with restorecon is not enough (it = sould work also on nodes, but as I said, it=E2=80=99s likely more safe = to reinstall just to be really really sure:) Simone, am I right about the restorecon for engine? that the oVirt install process creates the necessary rules to allow vdsm = to run under SELinux. So if you want to set SELinux to enforcing after = installation, is there a script to do this, or is it better to just = reinstall the node or engine, rather than trying to work out the = individual exceptions? persist much and it=E2=80=99s the easies way how to get the labelling = right
=20 Thanks, michal =20
Thanks,
Cam _______________________________________________ Users mailing list Users@ovirt.org <mailto:Users@ovirt.org> http://lists.ovirt.org/mailman/listinfo/users =
<http://lists.ovirt.org/mailman/listinfo/users> =20 =20 _______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
--Apple-Mail=_CDE436FE-61F8-4137-8BB4-CE456B791151 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" = class=3D""><br class=3D""><div><blockquote type=3D"cite" class=3D""><div = class=3D"">On 11 May 2016, at 15:24, Cam Mac <<a = href=3D"mailto:iucounu@gmail.com" class=3D"">iucounu@gmail.com</a>> = wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div = dir=3D"ltr" class=3D"">Thanks Michal, if reinstalling the engine, (which = also had SELinux disabled at install), would the best way be to backup = the engine and then restore just the ovirt = config?</div></div></blockquote><div><br class=3D""></div>for = engine..well, VM security is not related to that, those are running on = hypervisors, not the engine. So for any functionality/security it=E2=80=99= s irrelevant what SELinux state it=E2=80=99s in</div><div>I=E2=80=99m = not sure if relabeling with restorecon is not enough (it sould work also = on nodes, but as I said, it=E2=80=99s likely more safe to reinstall just = to be really really sure:)</div><div>Simone, am I right about the = restorecon for engine?</div><div><br class=3D""></div><div><blockquote = type=3D"cite" class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div = class=3D""><br class=3D""></div><div class=3D"">Cheers,</div><div = class=3D""><br class=3D""></div><div class=3D"">Cam</div></div><div = class=3D"gmail_extra"><br class=3D""><div class=3D"gmail_quote">On Wed, = May 11, 2016 at 2:14 PM, Michal Skrivanek <span dir=3D"ltr" = class=3D""><<a href=3D"mailto:michal.skrivanek@redhat.com" = target=3D"_blank" class=3D"">michal.skrivanek@redhat.com</a>></span> = wrote:<br class=3D""><blockquote class=3D"gmail_quote" style=3D"margin:0 = 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=3D""><br= class=3D""> > On 11 May 2016, at 15:02, Cam Mac <<a = href=3D"mailto:iucounu@gmail.com" class=3D"">iucounu@gmail.com</a>> = wrote:<br class=3D""> ><br class=3D""> > Hi,<br class=3D""> ><br class=3D""> > In the oVirt guide, it says that "SELinux is being used by default = on oVirt Node", but then goes on to say that if you have problems you = should set it to permissive mode. I have had a few things fail due to = being blocked by SELinux on a node I later enabled SELinux on, as it was = off at install time. The other node which has had SELinux on from the = start and so far has not had any oVirt operations blocked. I am guessing = that the oVirt install process creates the necessary rules to allow vdsm = to run under SELinux. So if you want to set SELinux to enforcing after = installation, is there a script to do this, or is it better to just = reinstall the node or engine, rather than trying to work out the = individual exceptions?<br class=3D""> <br class=3D""> </span>For oVirt node it=E2=80=99s easier to reinstall it, it doesn=E2=80=99= t persist much and it=E2=80=99s the easies way how to get the labelling = right<br class=3D""> <br class=3D""> Thanks,<br class=3D""> michal<br class=3D""> <br class=3D""> ><br class=3D""> > Thanks,<br class=3D""> ><br class=3D""> > Cam<br class=3D""> > _______________________________________________<br class=3D""> > Users mailing list<br class=3D""> > <a href=3D"mailto:Users@ovirt.org" class=3D"">Users@ovirt.org</a><br = class=3D""> > <a href=3D"http://lists.ovirt.org/mailman/listinfo/users" = rel=3D"noreferrer" target=3D"_blank" = class=3D"">http://lists.ovirt.org/mailman/listinfo/users</a><br = class=3D""> <br class=3D""> </blockquote></div><br class=3D""></div> _______________________________________________<br class=3D"">Users = mailing list<br class=3D""><a href=3D"mailto:Users@ovirt.org" = class=3D"">Users@ovirt.org</a><br = class=3D"">http://lists.ovirt.org/mailman/listinfo/users<br = class=3D""></div></blockquote></div><br class=3D""></body></html>= --Apple-Mail=_CDE436FE-61F8-4137-8BB4-CE456B791151--
Ah, ok that makes sense. For the node, is it enough to use the 'reinstall node' option from the GUI, or is it better to reinstall the OS and then deploy it again? Thanks, Cam On Wed, May 11, 2016 at 2:40 PM, Michal Skrivanek < michal.skrivanek@redhat.com> wrote:
On 11 May 2016, at 15:24, Cam Mac <iucounu@gmail.com> wrote:
Thanks Michal, if reinstalling the engine, (which also had SELinux disabled at install), would the best way be to backup the engine and then restore just the ovirt config?
for engine..well, VM security is not related to that, those are running on hypervisors, not the engine. So for any functionality/security it’s irrelevant what SELinux state it’s in I’m not sure if relabeling with restorecon is not enough (it sould work also on nodes, but as I said, it’s likely more safe to reinstall just to be really really sure:) Simone, am I right about the restorecon for engine?
Cheers,
Cam
On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek < michal.skrivanek@redhat.com> wrote:
On 11 May 2016, at 15:02, Cam Mac <iucounu@gmail.com> wrote:
Hi,
In the oVirt guide, it says that "SELinux is being used by default on oVirt Node", but then goes on to say that if you have problems you should set it to permissive mode. I have had a few things fail due to being blocked by SELinux on a node I later enabled SELinux on, as it was off at install time. The other node which has had SELinux on from the start and so far has not had any oVirt operations blocked. I am guessing that the oVirt install process creates the necessary rules to allow vdsm to run under SELinux. So if you want to set SELinux to enforcing after installation, is there a script to do this, or is it better to just reinstall the node or engine, rather than trying to work out the individual exceptions?
For oVirt node it’s easier to reinstall it, it doesn’t persist much and it’s the easies way how to get the labelling right
Thanks, michal
Thanks,
Cam _______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
Hi Michal, I chose the 'reinstall node' option from the GUI menu, which appeared to go ok, however, I still cannot create or migrate a VM on that node. I can see selinux 'denied' messages relating to qemu-kvm, e.g.: type=AVC msg=audit(1464189232.136:251): avc: denied { read } for pid=4019 comm="qemu-kvm" name="650000ab-b33a-483a-af46-76f7305e2ae5" dev="sda2" ino=35401 scontext=system_ u:system_r:svirt_t:s0:c720,c927 tcontext=system_u:object_r:unlabeled_t:s0 tclass=lnk_file There are a number of errors in the vdsm log but I assume that relates to selinux blocking it. So perhaps I need to remove all the ovirt packages manually, or perhaps re-install the OS as well? I guess either of those options involves complications with certificates and WWIDs for the attached SAN. Or could I somehow generate selinux labels? These nodes + engine are not yet production, though I'd prefer to fix than restart entirely from scratch. Thanks for any help. regards, Campbell On Wed, May 11, 2016 at 3:13 PM, Cam Mac <iucounu@gmail.com> wrote:
Ah, ok that makes sense. For the node, is it enough to use the 'reinstall node' option from the GUI, or is it better to reinstall the OS and then deploy it again?
Thanks,
Cam
On Wed, May 11, 2016 at 2:40 PM, Michal Skrivanek < michal.skrivanek@redhat.com> wrote:
On 11 May 2016, at 15:24, Cam Mac <iucounu@gmail.com> wrote:
Thanks Michal, if reinstalling the engine, (which also had SELinux disabled at install), would the best way be to backup the engine and then restore just the ovirt config?
for engine..well, VM security is not related to that, those are running on hypervisors, not the engine. So for any functionality/security it’s irrelevant what SELinux state it’s in I’m not sure if relabeling with restorecon is not enough (it sould work also on nodes, but as I said, it’s likely more safe to reinstall just to be really really sure:) Simone, am I right about the restorecon for engine?
Cheers,
Cam
On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek < michal.skrivanek@redhat.com> wrote:
On 11 May 2016, at 15:02, Cam Mac <iucounu@gmail.com> wrote:
Hi,
In the oVirt guide, it says that "SELinux is being used by default on oVirt Node", but then goes on to say that if you have problems you should set it to permissive mode. I have had a few things fail due to being blocked by SELinux on a node I later enabled SELinux on, as it was off at install time. The other node which has had SELinux on from the start and so far has not had any oVirt operations blocked. I am guessing that the oVirt install process creates the necessary rules to allow vdsm to run under SELinux. So if you want to set SELinux to enforcing after installation, is there a script to do this, or is it better to just reinstall the node or engine, rather than trying to work out the individual exceptions?
For oVirt node it’s easier to reinstall it, it doesn’t persist much and it’s the easies way how to get the labelling right
Thanks, michal
Thanks,
Cam _______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
On 25 May 2016, at 17:35, Cam Mac <iucounu@gmail.com> wrote: =20 Hi Michal, =20 I chose the 'reinstall node' option from the GUI menu, which appeared = to go ok, however, I still cannot create or migrate a VM on that node. I = can see selinux 'denied' messages relating to qemu-kvm, e.g.: =20 type=3DAVC msg=3Daudit(1464189232.136:251): avc: denied { read } for =
u:system_r:svirt_t:s0:c720,c927 = tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dlnk_file =20 There are a number of errors in the vdsm log but I assume that relates = to selinux blocking it. So perhaps I need to remove all the ovirt =
--Apple-Mail=_9687EDFD-A956-44FC-B7A6-ED6E5AA0CA88 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 pid=3D4019 comm=3D"qemu-kvm" = name=3D"650000ab-b33a-483a-af46-76f7305e2ae5" dev=3D"sda2" ino=3D35401 = scontext=3Dsystem_ packages manually, or perhaps re-install the OS as well? I guess either = of those options involves complications with certificates and WWIDs for = the attached SAN.=20
=20 Or could I somehow generate selinux labels?
=20 These nodes + engine are not yet production, though I'd prefer to fix =
=20 Thanks for any help. =20 regards, =20 Campbell =20 =20 On Wed, May 11, 2016 at 3:13 PM, Cam Mac <iucounu@gmail.com = <mailto:iucounu@gmail.com>> wrote: Ah, ok that makes sense. For the node, is it enough to use the = 'reinstall node' option from the GUI, or is it better to reinstall the = OS and then deploy it again? =20 Thanks, =20 Cam =20 On Wed, May 11, 2016 at 2:40 PM, Michal Skrivanek = <michal.skrivanek@redhat.com <mailto:michal.skrivanek@redhat.com>> = wrote: =20
On 11 May 2016, at 15:24, Cam Mac <iucounu@gmail.com = <mailto:iucounu@gmail.com>> wrote: =20 Thanks Michal, if reinstalling the engine, (which also had SELinux = disabled at install), would the best way be to backup the engine and =
=20 for engine..well, VM security is not related to that, those are = running on hypervisors, not the engine. So for any = functionality/security it=E2=80=99s irrelevant what SELinux state it=E2=80= =99s in I=E2=80=99m not sure if relabeling with restorecon is not enough (it = sould work also on nodes, but as I said, it=E2=80=99s likely more safe = to reinstall just to be really really sure:) Simone, am I right about the restorecon for engine? =20
=20 Cheers, =20 Cam =20 On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek = <michal.skrivanek@redhat.com <mailto:michal.skrivanek@redhat.com>> = wrote: =20
On 11 May 2016, at 15:02, Cam Mac <iucounu@gmail.com = <mailto:iucounu@gmail.com>> wrote:
Hi,
In the oVirt guide, it says that "SELinux is being used by default = on oVirt Node", but then goes on to say that if you have problems you = should set it to permissive mode. I have had a few things fail due to = being blocked by SELinux on a node I later enabled SELinux on, as it was = off at install time. The other node which has had SELinux on from the = start and so far has not had any oVirt operations blocked. I am guessing =
=20 For oVirt node it=E2=80=99s easier to reinstall it, it doesn=E2=80=99t =
yeah, I think it didn=E2=80=99t happen. I though we do relabelling as = part of deploy How about running "restorecon -r=E2=80=9D now? than restart entirely from scratch. then restore just the ovirt config? that the oVirt install process creates the necessary rules to allow vdsm = to run under SELinux. So if you want to set SELinux to enforcing after = installation, is there a script to do this, or is it better to just = reinstall the node or engine, rather than trying to work out the = individual exceptions? persist much and it=E2=80=99s the easies way how to get the labelling = right
=20 Thanks, michal =20
Thanks,
Cam _______________________________________________ Users mailing list Users@ovirt.org <mailto:Users@ovirt.org> http://lists.ovirt.org/mailman/listinfo/users =
<http://lists.ovirt.org/mailman/listinfo/users> =20 =20 _______________________________________________ Users mailing list Users@ovirt.org <mailto:Users@ovirt.org> http://lists.ovirt.org/mailman/listinfo/users = <http://lists.ovirt.org/mailman/listinfo/users> =20 =20 =20
--Apple-Mail=_9687EDFD-A956-44FC-B7A6-ED6E5AA0CA88 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" = class=3D""><br class=3D""><div><blockquote type=3D"cite" class=3D""><div = class=3D"">On 25 May 2016, at 17:35, Cam Mac <<a = href=3D"mailto:iucounu@gmail.com" class=3D"">iucounu@gmail.com</a>> = wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div = dir=3D"ltr" class=3D"">Hi Michal,<div class=3D""><br class=3D""></div><div= class=3D"">I chose the 'reinstall node' option from the GUI menu, which = appeared to go ok, however, I still cannot create or migrate a VM on = that node. I can see selinux 'denied' messages relating to qemu-kvm, = e.g.:</div><div class=3D""><div class=3D""><br class=3D""></div><div = class=3D"">type=3DAVC msg=3Daudit(1464189232.136:251): avc: denied = { read } for pid=3D4019 comm=3D"qemu-kvm" = name=3D"650000ab-b33a-483a-af46-76f7305e2ae5" dev=3D"sda2" ino=3D35401 = scontext=3Dsystem_</div><div class=3D"">u:system_r:svirt_t:s0:c720,c927 = tcontext=3Dsystem_u:object_r:unlabeled_t:s0 = tclass=3Dlnk_file</div></div><div class=3D""><br class=3D""></div><div = class=3D"">There are a number of errors in the vdsm log but I assume = that relates to selinux blocking it. So perhaps I need to remove all the = ovirt packages manually, or perhaps re-install the OS as well? I guess = either of those options involves complications with certificates and = WWIDs for the attached SAN. </div><div class=3D""><br = class=3D""></div><div class=3D"">Or could I somehow generate selinux = labels?</div></div></div></blockquote><div><br class=3D""></div>yeah, I = think it didn=E2=80=99t happen. I though we do relabelling as part of = deploy</div><div>How about running "restorecon -r=E2=80=9D = now?</div><div><br class=3D""><blockquote type=3D"cite" class=3D""><div = class=3D""><div dir=3D"ltr" class=3D""><div class=3D""><br = class=3D""></div><div class=3D"">These nodes + engine are not yet = production, though I'd prefer to fix than restart entirely from = scratch.</div><div class=3D""><br class=3D""></div><div class=3D"">Thanks = for any help.</div><div class=3D""><br class=3D""></div><div = class=3D"">regards,</div><div class=3D""><br class=3D"">Campbell</div><div= class=3D""><br class=3D""></div></div><div class=3D"gmail_extra"><br = class=3D""><div class=3D"gmail_quote">On Wed, May 11, 2016 at 3:13 PM, = Cam Mac <span dir=3D"ltr" class=3D""><<a = href=3D"mailto:iucounu@gmail.com" target=3D"_blank" = class=3D"">iucounu@gmail.com</a>></span> wrote:<br = class=3D""><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 = .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr" = class=3D"">Ah, ok that makes sense. For the node, is it enough to use = the 'reinstall node' option from the GUI, or is it better to reinstall = the OS and then deploy it again?<div class=3D""><br class=3D""></div><div = class=3D"">Thanks,</div><div class=3D""><br class=3D"">Cam</div></div><div= class=3D"HOEnZb"><div class=3D"h5"><div class=3D"gmail_extra"><br = class=3D""><div class=3D"gmail_quote">On Wed, May 11, 2016 at 2:40 PM, = Michal Skrivanek <span dir=3D"ltr" class=3D""><<a = href=3D"mailto:michal.skrivanek@redhat.com" target=3D"_blank" = class=3D"">michal.skrivanek@redhat.com</a>></span> wrote:<br = class=3D""><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 = .8ex;border-left:1px #ccc solid;padding-left:1ex"><div = style=3D"word-wrap:break-word" class=3D""><br class=3D""><div = class=3D""><span class=3D""><blockquote type=3D"cite" class=3D""><div = class=3D"">On 11 May 2016, at 15:24, Cam Mac <<a = href=3D"mailto:iucounu@gmail.com" target=3D"_blank" = class=3D"">iucounu@gmail.com</a>> wrote:</div><br class=3D""><div = class=3D""><div dir=3D"ltr" class=3D"">Thanks Michal, if reinstalling = the engine, (which also had SELinux disabled at install), would the best = way be to backup the engine and then restore just the ovirt = config?</div></div></blockquote><div class=3D""><br = class=3D""></div></span>for engine..well, VM security is not related to = that, those are running on hypervisors, not the engine. So for any = functionality/security it=E2=80=99s irrelevant what SELinux state it=E2=80= =99s in</div><div class=3D"">I=E2=80=99m not sure if relabeling with = restorecon is not enough (it sould work also on nodes, but as I said, = it=E2=80=99s likely more safe to reinstall just to be really really = sure:)</div><div class=3D"">Simone, am I right about the restorecon for = engine?</div><span class=3D""><div class=3D""><br class=3D""></div><div = class=3D""><blockquote type=3D"cite" class=3D""><div class=3D""><div = dir=3D"ltr" class=3D""><div class=3D""><br class=3D""></div><div = class=3D"">Cheers,</div><div class=3D""><br class=3D""></div><div = class=3D"">Cam</div></div><div class=3D"gmail_extra"><br class=3D""><div = class=3D"gmail_quote">On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek = <span dir=3D"ltr" class=3D""><<a = href=3D"mailto:michal.skrivanek@redhat.com" target=3D"_blank" = class=3D"">michal.skrivanek@redhat.com</a>></span> wrote:<br = class=3D""><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 = .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=3D""><br = class=3D""> > On 11 May 2016, at 15:02, Cam Mac <<a = href=3D"mailto:iucounu@gmail.com" target=3D"_blank" = class=3D"">iucounu@gmail.com</a>> wrote:<br class=3D""> ><br class=3D""> > Hi,<br class=3D""> ><br class=3D""> > In the oVirt guide, it says that "SELinux is being used by default = on oVirt Node", but then goes on to say that if you have problems you = should set it to permissive mode. I have had a few things fail due to = being blocked by SELinux on a node I later enabled SELinux on, as it was = off at install time. The other node which has had SELinux on from the = start and so far has not had any oVirt operations blocked. I am guessing = that the oVirt install process creates the necessary rules to allow vdsm = to run under SELinux. So if you want to set SELinux to enforcing after = installation, is there a script to do this, or is it better to just = reinstall the node or engine, rather than trying to work out the = individual exceptions?<br class=3D""> <br class=3D""> </span>For oVirt node it=E2=80=99s easier to reinstall it, it doesn=E2=80=99= t persist much and it=E2=80=99s the easies way how to get the labelling = right<br class=3D""> <br class=3D""> Thanks,<br class=3D""> michal<br class=3D""> <br class=3D""> ><br class=3D""> > Thanks,<br class=3D""> ><br class=3D""> > Cam<br class=3D""> > _______________________________________________<br class=3D""> > Users mailing list<br class=3D""> > <a href=3D"mailto:Users@ovirt.org" target=3D"_blank" = class=3D"">Users@ovirt.org</a><br class=3D""> > <a href=3D"http://lists.ovirt.org/mailman/listinfo/users" = rel=3D"noreferrer" target=3D"_blank" = class=3D"">http://lists.ovirt.org/mailman/listinfo/users</a><br = class=3D""> <br class=3D""> </blockquote></div><br class=3D""></div> _______________________________________________<br class=3D"">Users = mailing list<br class=3D""><a href=3D"mailto:Users@ovirt.org" = target=3D"_blank" class=3D"">Users@ovirt.org</a><br class=3D""><a = href=3D"http://lists.ovirt.org/mailman/listinfo/users" target=3D"_blank" = class=3D"">http://lists.ovirt.org/mailman/listinfo/users</a><br = class=3D""></div></blockquote></div><br = class=3D""></span></div></blockquote></div><br class=3D""></div> </div></div></blockquote></div><br class=3D""></div> </div></blockquote></div><br class=3D""></body></html>= --Apple-Mail=_9687EDFD-A956-44FC-B7A6-ED6E5AA0CA88--
I'll try that - presumably on the paths it is complaining about, and the qemu binarys? On Wed, May 25, 2016 at 4:59 PM, Michal Skrivanek < michal.skrivanek@redhat.com> wrote:
On 25 May 2016, at 17:35, Cam Mac <iucounu@gmail.com> wrote:
Hi Michal,
I chose the 'reinstall node' option from the GUI menu, which appeared to go ok, however, I still cannot create or migrate a VM on that node. I can see selinux 'denied' messages relating to qemu-kvm, e.g.:
type=AVC msg=audit(1464189232.136:251): avc: denied { read } for pid=4019 comm="qemu-kvm" name="650000ab-b33a-483a-af46-76f7305e2ae5" dev="sda2" ino=35401 scontext=system_ u:system_r:svirt_t:s0:c720,c927 tcontext=system_u:object_r:unlabeled_t:s0 tclass=lnk_file
There are a number of errors in the vdsm log but I assume that relates to selinux blocking it. So perhaps I need to remove all the ovirt packages manually, or perhaps re-install the OS as well? I guess either of those options involves complications with certificates and WWIDs for the attached SAN.
Or could I somehow generate selinux labels?
yeah, I think it didn’t happen. I though we do relabelling as part of deploy How about running "restorecon -r” now?
These nodes + engine are not yet production, though I'd prefer to fix than restart entirely from scratch.
Thanks for any help.
regards,
Campbell
On Wed, May 11, 2016 at 3:13 PM, Cam Mac <iucounu@gmail.com> wrote:
Ah, ok that makes sense. For the node, is it enough to use the 'reinstall node' option from the GUI, or is it better to reinstall the OS and then deploy it again?
Thanks,
Cam
On Wed, May 11, 2016 at 2:40 PM, Michal Skrivanek < michal.skrivanek@redhat.com> wrote:
On 11 May 2016, at 15:24, Cam Mac <iucounu@gmail.com> wrote:
Thanks Michal, if reinstalling the engine, (which also had SELinux disabled at install), would the best way be to backup the engine and then restore just the ovirt config?
for engine..well, VM security is not related to that, those are running on hypervisors, not the engine. So for any functionality/security it’s irrelevant what SELinux state it’s in I’m not sure if relabeling with restorecon is not enough (it sould work also on nodes, but as I said, it’s likely more safe to reinstall just to be really really sure:) Simone, am I right about the restorecon for engine?
Cheers,
Cam
On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek < michal.skrivanek@redhat.com> wrote:
On 11 May 2016, at 15:02, Cam Mac <iucounu@gmail.com> wrote:
Hi,
In the oVirt guide, it says that "SELinux is being used by default on oVirt Node", but then goes on to say that if you have problems you should set it to permissive mode. I have had a few things fail due to being blocked by SELinux on a node I later enabled SELinux on, as it was off at install time. The other node which has had SELinux on from the start and so far has not had any oVirt operations blocked. I am guessing that the oVirt install process creates the necessary rules to allow vdsm to run under SELinux. So if you want to set SELinux to enforcing after installation, is there a script to do this, or is it better to just reinstall the node or engine, rather than trying to work out the individual exceptions?
For oVirt node it’s easier to reinstall it, it doesn’t persist much and it’s the easies way how to get the labelling right
Thanks, michal
Thanks,
Cam _______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
--Apple-Mail-281A4CF8-F162-4110-89CA-1DC2881E579B Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 DQoNCj4gT24gMjUgTWF5IDIwMTYsIGF0IDE5OjEyLCBDYW0gTWFjIDxpdWNvdW51QGdtYWlsLmNv bT4gd3JvdGU6DQo+IA0KPiBJJ2xsIHRyeSB0aGF0IC0gcHJlc3VtYWJseSBvbiB0aGUgcGF0aHMg aXQgaXMgY29tcGxhaW5pbmcgYWJvdXQsIGFuZCB0aGUgcWVtdSBiaW5hcnlzPw0KDQpJdCBzaG91 bGRuJ3QgaHVydCBvbiAvLCBpdCBzaG91bGQgb25seSBoZWxwOikNCkFuZCBpZiBpdCBjb21wbGFp bnMgZS5nLiBvbiBhdHRhY2hlZCBuZnMsIHRoZSBpIHN1cHBvc2UgeW91IG5lZWQgdG8gcnVuIGl0 IHRoZXJlIHRvbw0KDQo+IA0KPj4gT24gV2VkLCBNYXkgMjUsIDIwMTYgYXQgNDo1OSBQTSwgTWlj aGFsIFNrcml2YW5layA8bWljaGFsLnNrcml2YW5la0ByZWRoYXQuY29tPiB3cm90ZToNCj4+IA0K Pj4+IE9uIDI1IE1heSAyMDE2LCBhdCAxNzozNSwgQ2FtIE1hYyA8aXVjb3VudUBnbWFpbC5jb20+ IHdyb3RlOg0KPj4+IA0KPj4+IEhpIE1pY2hhbCwNCj4+PiANCj4+PiBJIGNob3NlIHRoZSAncmVp bnN0YWxsIG5vZGUnIG9wdGlvbiBmcm9tIHRoZSBHVUkgbWVudSwgd2hpY2ggYXBwZWFyZWQgdG8g Z28gb2ssIGhvd2V2ZXIsIEkgc3RpbGwgY2Fubm90IGNyZWF0ZSBvciBtaWdyYXRlIGEgVk0gb24g dGhhdCBub2RlLiBJIGNhbiBzZWUgc2VsaW51eCAnZGVuaWVkJyBtZXNzYWdlcyByZWxhdGluZyB0 byBxZW11LWt2bSwgZS5nLjoNCj4+PiANCj4+PiB0eXBlPUFWQyBtc2c9YXVkaXQoMTQ2NDE4OTIz Mi4xMzY6MjUxKTogYXZjOiAgZGVuaWVkICB7IHJlYWQgfSBmb3IgIHBpZD00MDE5IGNvbW09InFl bXUta3ZtIiBuYW1lPSI2NTAwMDBhYi1iMzNhLTQ4M2EtYWY0Ni03NmY3MzA1ZTJhZTUiIGRldj0i c2RhMiIgaW5vPTM1NDAxIHNjb250ZXh0PXN5c3RlbV8NCj4+PiB1OnN5c3RlbV9yOnN2aXJ0X3Q6 czA6YzcyMCxjOTI3IHRjb250ZXh0PXN5c3RlbV91Om9iamVjdF9yOnVubGFiZWxlZF90OnMwIHRj bGFzcz1sbmtfZmlsZQ0KPj4+IA0KPj4+IFRoZXJlIGFyZSBhIG51bWJlciBvZiBlcnJvcnMgaW4g dGhlIHZkc20gbG9nIGJ1dCBJIGFzc3VtZSB0aGF0IHJlbGF0ZXMgdG8gc2VsaW51eCBibG9ja2lu ZyBpdC4gU28gcGVyaGFwcyBJIG5lZWQgdG8gcmVtb3ZlIGFsbCB0aGUgb3ZpcnQgcGFja2FnZXMg bWFudWFsbHksIG9yIHBlcmhhcHMgcmUtaW5zdGFsbCB0aGUgT1MgYXMgd2VsbD8gSSBndWVzcyBl aXRoZXIgb2YgdGhvc2Ugb3B0aW9ucyBpbnZvbHZlcyBjb21wbGljYXRpb25zIHdpdGggY2VydGlm aWNhdGVzIGFuZCBXV0lEcyBmb3IgdGhlIGF0dGFjaGVkIFNBTi4gDQo+Pj4gDQo+Pj4gT3IgY291 bGQgSSBzb21laG93IGdlbmVyYXRlIHNlbGludXggbGFiZWxzPw0KPj4gDQo+PiB5ZWFoLCBJIHRo aW5rIGl0IGRpZG7igJl0IGhhcHBlbi4gSSB0aG91Z2ggd2UgZG8gcmVsYWJlbGxpbmcgYXMgcGFy dCBvZiBkZXBsb3kNCj4+IEhvdyBhYm91dCBydW5uaW5nICJyZXN0b3JlY29uIC1y4oCdIG5vdz8N Cj4+IA0KPj4+IA0KPj4+IFRoZXNlIG5vZGVzICsgZW5naW5lIGFyZSBub3QgeWV0IHByb2R1Y3Rp b24sIHRob3VnaCBJJ2QgcHJlZmVyIHRvIGZpeCB0aGFuIHJlc3RhcnQgZW50aXJlbHkgZnJvbSBz Y3JhdGNoLg0KPj4+IA0KPj4+IFRoYW5rcyBmb3IgYW55IGhlbHAuDQo+Pj4gDQo+Pj4gcmVnYXJk cywNCj4+PiANCj4+PiBDYW1wYmVsbA0KPj4+IA0KPj4+IA0KPj4+PiBPbiBXZWQsIE1heSAxMSwg MjAxNiBhdCAzOjEzIFBNLCBDYW0gTWFjIDxpdWNvdW51QGdtYWlsLmNvbT4gd3JvdGU6DQo+Pj4+ IEFoLCBvayB0aGF0IG1ha2VzIHNlbnNlLiBGb3IgdGhlIG5vZGUsIGlzIGl0IGVub3VnaCB0byB1 c2UgdGhlICdyZWluc3RhbGwgbm9kZScgb3B0aW9uIGZyb20gdGhlIEdVSSwgb3IgaXMgaXQgYmV0 dGVyIHRvIHJlaW5zdGFsbCB0aGUgT1MgYW5kIHRoZW4gZGVwbG95IGl0IGFnYWluPw0KPj4+PiAN Cj4+Pj4gVGhhbmtzLA0KPj4+PiANCj4+Pj4gQ2FtDQo+Pj4+IA0KPj4+Pj4gT24gV2VkLCBNYXkg MTEsIDIwMTYgYXQgMjo0MCBQTSwgTWljaGFsIFNrcml2YW5layA8bWljaGFsLnNrcml2YW5la0By ZWRoYXQuY29tPiB3cm90ZToNCj4+Pj4+IA0KPj4+Pj4+IE9uIDExIE1heSAyMDE2LCBhdCAxNToy NCwgQ2FtIE1hYyA8aXVjb3VudUBnbWFpbC5jb20+IHdyb3RlOg0KPj4+Pj4+IA0KPj4+Pj4+IFRo YW5rcyBNaWNoYWwsIGlmIHJlaW5zdGFsbGluZyB0aGUgZW5naW5lLCAod2hpY2ggYWxzbyBoYWQg U0VMaW51eCBkaXNhYmxlZCBhdCBpbnN0YWxsKSwgd291bGQgdGhlIGJlc3Qgd2F5IGJlIHRvIGJh Y2t1cCB0aGUgZW5naW5lIGFuZCB0aGVuIHJlc3RvcmUganVzdCB0aGUgb3ZpcnQgY29uZmlnPw0K Pj4+Pj4gDQo+Pj4+PiBmb3IgZW5naW5lLi53ZWxsLCBWTSBzZWN1cml0eSBpcyBub3QgcmVsYXRl ZCB0byB0aGF0LCB0aG9zZSBhcmUgcnVubmluZyBvbiBoeXBlcnZpc29ycywgbm90IHRoZSBlbmdp bmUuIFNvIGZvciBhbnkgZnVuY3Rpb25hbGl0eS9zZWN1cml0eSBpdOKAmXMgaXJyZWxldmFudCB3 aGF0IFNFTGludXggc3RhdGUgaXTigJlzIGluDQo+Pj4+PiBJ4oCZbSBub3Qgc3VyZSBpZiByZWxh YmVsaW5nIHdpdGggcmVzdG9yZWNvbiBpcyBub3QgZW5vdWdoIChpdCBzb3VsZCB3b3JrIGFsc28g b24gbm9kZXMsIGJ1dCBhcyBJIHNhaWQsIGl04oCZcyBsaWtlbHkgbW9yZSBzYWZlIHRvIHJlaW5z dGFsbCBqdXN0IHRvIGJlIHJlYWxseSByZWFsbHkgc3VyZTopDQo+Pj4+PiBTaW1vbmUsIGFtIEkg cmlnaHQgYWJvdXQgdGhlIHJlc3RvcmVjb24gZm9yIGVuZ2luZT8NCj4+Pj4+IA0KPj4+Pj4+IA0K Pj4+Pj4+IENoZWVycywNCj4+Pj4+PiANCj4+Pj4+PiBDYW0NCj4+Pj4+PiANCj4+Pj4+Pj4gT24g V2VkLCBNYXkgMTEsIDIwMTYgYXQgMjoxNCBQTSwgTWljaGFsIFNrcml2YW5layA8bWljaGFsLnNr cml2YW5la0ByZWRoYXQuY29tPiB3cm90ZToNCj4+Pj4+Pj4gDQo+Pj4+Pj4+ID4gT24gMTEgTWF5 IDIwMTYsIGF0IDE1OjAyLCBDYW0gTWFjIDxpdWNvdW51QGdtYWlsLmNvbT4gd3JvdGU6DQo+Pj4+ Pj4+ID4NCj4+Pj4+Pj4gPiBIaSwNCj4+Pj4+Pj4gPg0KPj4+Pj4+PiA+IEluIHRoZSBvVmlydCBn dWlkZSwgaXQgc2F5cyB0aGF0ICJTRUxpbnV4IGlzIGJlaW5nIHVzZWQgYnkgZGVmYXVsdCBvbiBv VmlydCBOb2RlIiwgYnV0IHRoZW4gZ29lcyBvbiB0byBzYXkgdGhhdCBpZiB5b3UgaGF2ZSBwcm9i bGVtcyB5b3Ugc2hvdWxkIHNldCBpdCB0byBwZXJtaXNzaXZlIG1vZGUuIEkgaGF2ZSBoYWQgYSBm ZXcgdGhpbmdzIGZhaWwgZHVlIHRvIGJlaW5nIGJsb2NrZWQgYnkgU0VMaW51eCBvbiBhIG5vZGUg SSBsYXRlciBlbmFibGVkIFNFTGludXggb24sIGFzIGl0IHdhcyBvZmYgYXQgaW5zdGFsbCB0aW1l LiBUaGUgb3RoZXIgbm9kZSB3aGljaCBoYXMgaGFkIFNFTGludXggb24gZnJvbSB0aGUgc3RhcnQg YW5kIHNvIGZhciBoYXMgbm90IGhhZCBhbnkgb1ZpcnQgb3BlcmF0aW9ucyBibG9ja2VkLiBJIGFt IGd1ZXNzaW5nIHRoYXQgdGhlIG9WaXJ0IGluc3RhbGwgcHJvY2VzcyBjcmVhdGVzIHRoZSBuZWNl c3NhcnkgcnVsZXMgdG8gYWxsb3cgdmRzbSB0byBydW4gdW5kZXIgU0VMaW51eC4gU28gaWYgeW91 IHdhbnQgdG8gc2V0IFNFTGludXggdG8gZW5mb3JjaW5nIGFmdGVyIGluc3RhbGxhdGlvbiwgaXMg dGhlcmUgYSBzY3JpcHQgdG8gZG8gdGhpcywgb3IgaXMgaXQgYmV0dGVyIHRvIGp1c3QgcmVpbnN0 YWxsIHRoZSBub2RlIG9yIGVuZ2luZSwgcmF0aGVyIHRoYW4gdHJ5aW5nIHRvIHdvcmsgb3V0IHRo ZSBpbmRpdmlkdWFsIGV4Y2VwdGlvbnM/DQo+Pj4+Pj4+IA0KPj4+Pj4+PiBGb3Igb1ZpcnQgbm9k ZSBpdOKAmXMgZWFzaWVyIHRvIHJlaW5zdGFsbCBpdCwgaXQgZG9lc27igJl0IHBlcnNpc3QgbXVj aCBhbmQgaXTigJlzIHRoZSBlYXNpZXMgd2F5IGhvdyB0byBnZXQgdGhlIGxhYmVsbGluZyByaWdo dA0KPj4+Pj4+PiANCj4+Pj4+Pj4gVGhhbmtzLA0KPj4+Pj4+PiBtaWNoYWwNCj4+Pj4+Pj4gDQo+ Pj4+Pj4+ID4NCj4+Pj4+Pj4gPiBUaGFua3MsDQo+Pj4+Pj4+ID4NCj4+Pj4+Pj4gPiBDYW0NCj4+ Pj4+Pj4gPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K Pj4+Pj4+PiA+IFVzZXJzIG1haWxpbmcgbGlzdA0KPj4+Pj4+PiA+IFVzZXJzQG92aXJ0Lm9yZw0K Pj4+Pj4+PiA+IGh0dHA6Ly9saXN0cy5vdmlydC5vcmcvbWFpbG1hbi9saXN0aW5mby91c2Vycw0K Pj4+Pj4+PiANCj4+Pj4+PiANCj4+Pj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXw0KPj4+Pj4+IFVzZXJzIG1haWxpbmcgbGlzdA0KPj4+Pj4+IFVzZXJz QG92aXJ0Lm9yZw0KPj4+Pj4+IGh0dHA6Ly9saXN0cy5vdmlydC5vcmcvbWFpbG1hbi9saXN0aW5m by91c2Vycw0KPj4+Pj4gDQo+Pj4+IA0KPj4+IA0KPj4gDQo+IA0K --Apple-Mail-281A4CF8-F162-4110-89CA-1DC2881E579B Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 PGh0bWw+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0 L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPjwvaGVhZD48Ym9keSBkaXI9ImF1dG8iPjxkaXY+PC9kaXY+ PGRpdj48YnI+PC9kaXY+PGRpdj48YnI+T24gMjUgTWF5IDIwMTYsIGF0IDE5OjEyLCBDYW0gTWFj ICZsdDs8YSBocmVmPSJtYWlsdG86aXVjb3VudUBnbWFpbC5jb20iPml1Y291bnVAZ21haWwuY29t PC9hPiZndDsgd3JvdGU6PGJyPjxicj48L2Rpdj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2 PjxkaXYgZGlyPSJsdHIiPkknbGwgdHJ5IHRoYXQgLSBwcmVzdW1hYmx5IG9uIHRoZSBwYXRocyBp dCBpcyBjb21wbGFpbmluZyBhYm91dCwgYW5kIHRoZSBxZW11IGJpbmFyeXM/PC9kaXY+PC9kaXY+ PC9ibG9ja3F1b3RlPjxkaXY+PGJyPjwvZGl2Pkl0IHNob3VsZG4ndCBodXJ0IG9uIC8sIGl0IHNo b3VsZCBvbmx5IGhlbHA6KTxkaXY+QW5kIGlmIGl0IGNvbXBsYWlucyBlLmcuIG9uIGF0dGFjaGVk IG5mcywgdGhlIGkgc3VwcG9zZSB5b3UgbmVlZCB0byBydW4gaXQgdGhlcmUgdG9vPGJyPjxkaXY+ PGJyPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxkaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEi Pjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gV2VkLCBNYXkgMjUsIDIwMTYgYXQgNDo1 OSBQTSwgTWljaGFsIFNrcml2YW5layA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0 bzptaWNoYWwuc2tyaXZhbmVrQHJlZGhhdC5jb20iIHRhcmdldD0iX2JsYW5rIj5taWNoYWwuc2ty aXZhbmVrQHJlZGhhdC5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPjxibG9ja3F1b3RlIGNs YXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFw eCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPjxkaXYgc3R5bGU9IndvcmQtd3JhcDpicmVh ay13b3JkIj48YnI+PGRpdj48c3BhbiBjbGFzcz0iIj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48 ZGl2Pk9uIDI1IE1heSAyMDE2LCBhdCAxNzozNSwgQ2FtIE1hYyAmbHQ7PGEgaHJlZj0ibWFpbHRv Oml1Y291bnVAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+aXVjb3VudUBnbWFpbC5jb208L2E+ Jmd0OyB3cm90ZTo8L2Rpdj48YnI+PGRpdj48ZGl2IGRpcj0ibHRyIj5IaSBNaWNoYWwsPGRpdj48 YnI+PC9kaXY+PGRpdj5JIGNob3NlIHRoZSAncmVpbnN0YWxsIG5vZGUnIG9wdGlvbiBmcm9tIHRo ZSBHVUkgbWVudSwgd2hpY2ggYXBwZWFyZWQgdG8gZ28gb2ssIGhvd2V2ZXIsIEkgc3RpbGwgY2Fu bm90IGNyZWF0ZSBvciBtaWdyYXRlIGEgVk0gb24gdGhhdCBub2RlLiBJIGNhbiBzZWUgc2VsaW51 eCAnZGVuaWVkJyBtZXNzYWdlcyByZWxhdGluZyB0byBxZW11LWt2bSwgZS5nLjo8L2Rpdj48ZGl2 PjxkaXY+PGJyPjwvZGl2PjxkaXY+dHlwZT1BVkMgbXNnPWF1ZGl0KDE0NjQxODkyMzIuMTM2OjI1 MSk6IGF2YzogJm5ic3A7ZGVuaWVkICZuYnNwO3sgcmVhZCB9IGZvciAmbmJzcDtwaWQ9NDAxOSBj b21tPSJxZW11LWt2bSIgbmFtZT0iNjUwMDAwYWItYjMzYS00ODNhLWFmNDYtNzZmNzMwNWUyYWU1 IiBkZXY9InNkYTIiIGlubz0zNTQwMSBzY29udGV4dD1zeXN0ZW1fPC9kaXY+PGRpdj51OnN5c3Rl bV9yOnN2aXJ0X3Q6czA6YzcyMCxjOTI3IHRjb250ZXh0PXN5c3RlbV91Om9iamVjdF9yOnVubGFi ZWxlZF90OnMwIHRjbGFzcz1sbmtfZmlsZTwvZGl2PjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+ VGhlcmUgYXJlIGEgbnVtYmVyIG9mIGVycm9ycyBpbiB0aGUgdmRzbSBsb2cgYnV0IEkgYXNzdW1l IHRoYXQgcmVsYXRlcyB0byBzZWxpbnV4IGJsb2NraW5nIGl0LiBTbyBwZXJoYXBzIEkgbmVlZCB0 byByZW1vdmUgYWxsIHRoZSBvdmlydCBwYWNrYWdlcyBtYW51YWxseSwgb3IgcGVyaGFwcyByZS1p bnN0YWxsIHRoZSBPUyBhcyB3ZWxsPyBJIGd1ZXNzIGVpdGhlciBvZiB0aG9zZSBvcHRpb25zIGlu dm9sdmVzIGNvbXBsaWNhdGlvbnMgd2l0aCBjZXJ0aWZpY2F0ZXMgYW5kIFdXSURzIGZvciB0aGUg YXR0YWNoZWQgU0FOLiZuYnNwOzwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+T3IgY291bGQgSSBz b21laG93IGdlbmVyYXRlIHNlbGludXggbGFiZWxzPzwvZGl2PjwvZGl2PjwvZGl2PjwvYmxvY2tx dW90ZT48ZGl2Pjxicj48L2Rpdj48L3NwYW4+eWVhaCwgSSB0aGluayBpdCBkaWRu4oCZdCBoYXBw ZW4uIEkgdGhvdWdoIHdlIGRvIHJlbGFiZWxsaW5nIGFzIHBhcnQgb2YgZGVwbG95PC9kaXY+PGRp dj5Ib3cgYWJvdXQgcnVubmluZyAicmVzdG9yZWNvbiAtcuKAnSBub3c/PC9kaXY+PGRpdj48ZGl2 IGNsYXNzPSJoNSI+PGRpdj48YnI+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGRpdj48ZGl2IGRp cj0ibHRyIj48ZGl2Pjxicj48L2Rpdj48ZGl2PlRoZXNlIG5vZGVzICsgZW5naW5lIGFyZSBub3Qg eWV0IHByb2R1Y3Rpb24sIHRob3VnaCBJJ2QgcHJlZmVyIHRvIGZpeCB0aGFuIHJlc3RhcnQgZW50 aXJlbHkgZnJvbSBzY3JhdGNoLjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+VGhhbmtzIGZvciBh bnkgaGVscC48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PnJlZ2FyZHMsPC9kaXY+PGRpdj48YnI+ Q2FtcGJlbGw8L2Rpdj48ZGl2Pjxicj48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRy YSI+PGJyPjxkaXYgY2xhc3M9ImdtYWlsX3F1b3RlIj5PbiBXZWQsIE1heSAxMSwgMjAxNiBhdCAz OjEzIFBNLCBDYW0gTWFjIDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOml1Y291 bnVAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+aXVjb3VudUBnbWFpbC5jb208L2E+Jmd0Ozwv c3Bhbj4gd3JvdGU6PGJyPjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1h cmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDox ZXgiPjxkaXYgZGlyPSJsdHIiPkFoLCBvayB0aGF0IG1ha2VzIHNlbnNlLiBGb3IgdGhlIG5vZGUs IGlzIGl0IGVub3VnaCB0byB1c2UgdGhlICdyZWluc3RhbGwgbm9kZScgb3B0aW9uIGZyb20gdGhl IEdVSSwgb3IgaXMgaXQgYmV0dGVyIHRvIHJlaW5zdGFsbCB0aGUgT1MgYW5kIHRoZW4gZGVwbG95 IGl0IGFnYWluPzxkaXY+PGJyPjwvZGl2PjxkaXY+VGhhbmtzLDwvZGl2PjxkaXY+PGJyPkNhbTwv ZGl2PjwvZGl2PjxkaXY+PGRpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+PGJyPjxkaXYgY2xh c3M9ImdtYWlsX3F1b3RlIj5PbiBXZWQsIE1heSAxMSwgMjAxNiBhdCAyOjQwIFBNLCBNaWNoYWwg U2tyaXZhbmVrIDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOm1pY2hhbC5za3Jp dmFuZWtAcmVkaGF0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1pY2hhbC5za3JpdmFuZWtAcmVkaGF0 LmNvbTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1 b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7 cGFkZGluZy1sZWZ0OjFleCI+PGRpdiBzdHlsZT0id29yZC13cmFwOmJyZWFrLXdvcmQiPjxicj48 ZGl2PjxzcGFuPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxkaXY+T24gMTEgTWF5IDIwMTYsIGF0 IDE1OjI0LCBDYW0gTWFjICZsdDs8YSBocmVmPSJtYWlsdG86aXVjb3VudUBnbWFpbC5jb20iIHRh cmdldD0iX2JsYW5rIj5pdWNvdW51QGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjwvZGl2Pjxicj48 ZGl2PjxkaXYgZGlyPSJsdHIiPlRoYW5rcyBNaWNoYWwsIGlmIHJlaW5zdGFsbGluZyB0aGUgZW5n aW5lLCAod2hpY2ggYWxzbyBoYWQgU0VMaW51eCBkaXNhYmxlZCBhdCBpbnN0YWxsKSwgd291bGQg dGhlIGJlc3Qgd2F5IGJlIHRvIGJhY2t1cCB0aGUgZW5naW5lIGFuZCB0aGVuIHJlc3RvcmUganVz dCB0aGUgb3ZpcnQgY29uZmlnPzwvZGl2PjwvZGl2PjwvYmxvY2txdW90ZT48ZGl2Pjxicj48L2Rp dj48L3NwYW4+Zm9yIGVuZ2luZS4ud2VsbCwgVk0gc2VjdXJpdHkgaXMgbm90IHJlbGF0ZWQgdG8g dGhhdCwgdGhvc2UgYXJlIHJ1bm5pbmcgb24gaHlwZXJ2aXNvcnMsIG5vdCB0aGUgZW5naW5lLiBT byBmb3IgYW55IGZ1bmN0aW9uYWxpdHkvc2VjdXJpdHkgaXTigJlzIGlycmVsZXZhbnQgd2hhdCBT RUxpbnV4IHN0YXRlIGl04oCZcyBpbjwvZGl2PjxkaXY+SeKAmW0gbm90IHN1cmUgaWYgcmVsYWJl bGluZyB3aXRoIHJlc3RvcmVjb24gaXMgbm90IGVub3VnaCAoaXQgc291bGQgd29yayBhbHNvIG9u IG5vZGVzLCBidXQgYXMgSSBzYWlkLCBpdOKAmXMgbGlrZWx5IG1vcmUgc2FmZSB0byByZWluc3Rh bGwganVzdCB0byBiZSByZWFsbHkgcmVhbGx5IHN1cmU6KTwvZGl2PjxkaXY+U2ltb25lLCBhbSBJ IHJpZ2h0IGFib3V0IHRoZSByZXN0b3JlY29uIGZvciBlbmdpbmU/PC9kaXY+PHNwYW4+PGRpdj48 YnI+PC9kaXY+PGRpdj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2PjxkaXYgZGlyPSJsdHIi PjxkaXY+PGJyPjwvZGl2PjxkaXY+Q2hlZXJzLDwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+Q2Ft PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj48ZGl2IGNsYXNzPSJnbWFp bF9xdW90ZSI+T24gV2VkLCBNYXkgMTEsIDIwMTYgYXQgMjoxNCBQTSwgTWljaGFsIFNrcml2YW5l ayA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0bzptaWNoYWwuc2tyaXZhbmVrQHJl ZGhhdC5jb20iIHRhcmdldD0iX2JsYW5rIj5taWNoYWwuc2tyaXZhbmVrQHJlZGhhdC5jb208L2E+ Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5 bGU9Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmct bGVmdDoxZXgiPjxzcGFuPjxicj4NCiZndDsgT24gMTEgTWF5IDIwMTYsIGF0IDE1OjAyLCBDYW0g TWFjICZsdDs8YSBocmVmPSJtYWlsdG86aXVjb3VudUBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5r Ij5pdWNvdW51QGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxicj4NCiZndDs8YnI+DQomZ3Q7IEhp LDxicj4NCiZndDs8YnI+DQomZ3Q7IEluIHRoZSBvVmlydCBndWlkZSwgaXQgc2F5cyB0aGF0ICJT RUxpbnV4IGlzIGJlaW5nIHVzZWQgYnkgZGVmYXVsdCBvbiBvVmlydCBOb2RlIiwgYnV0IHRoZW4g Z29lcyBvbiB0byBzYXkgdGhhdCBpZiB5b3UgaGF2ZSBwcm9ibGVtcyB5b3Ugc2hvdWxkIHNldCBp dCB0byBwZXJtaXNzaXZlIG1vZGUuIEkgaGF2ZSBoYWQgYSBmZXcgdGhpbmdzIGZhaWwgZHVlIHRv IGJlaW5nIGJsb2NrZWQgYnkgU0VMaW51eCBvbiBhIG5vZGUgSSBsYXRlciBlbmFibGVkIFNFTGlu dXggb24sIGFzIGl0IHdhcyBvZmYgYXQgaW5zdGFsbCB0aW1lLiBUaGUgb3RoZXIgbm9kZSB3aGlj aCBoYXMgaGFkIFNFTGludXggb24gZnJvbSB0aGUgc3RhcnQgYW5kIHNvIGZhciBoYXMgbm90IGhh ZCBhbnkgb1ZpcnQgb3BlcmF0aW9ucyBibG9ja2VkLiBJIGFtIGd1ZXNzaW5nIHRoYXQgdGhlIG9W aXJ0IGluc3RhbGwgcHJvY2VzcyBjcmVhdGVzIHRoZSBuZWNlc3NhcnkgcnVsZXMgdG8gYWxsb3cg dmRzbSB0byBydW4gdW5kZXIgU0VMaW51eC4gU28gaWYgeW91IHdhbnQgdG8gc2V0IFNFTGludXgg dG8gZW5mb3JjaW5nIGFmdGVyIGluc3RhbGxhdGlvbiwgaXMgdGhlcmUgYSBzY3JpcHQgdG8gZG8g dGhpcywgb3IgaXMgaXQgYmV0dGVyIHRvIGp1c3QgcmVpbnN0YWxsIHRoZSBub2RlIG9yIGVuZ2lu ZSwgcmF0aGVyIHRoYW4gdHJ5aW5nIHRvIHdvcmsgb3V0IHRoZSBpbmRpdmlkdWFsIGV4Y2VwdGlv bnM/PGJyPg0KPGJyPg0KPC9zcGFuPkZvciBvVmlydCBub2RlIGl04oCZcyBlYXNpZXIgdG8gcmVp bnN0YWxsIGl0LCBpdCBkb2VzbuKAmXQgcGVyc2lzdCBtdWNoIGFuZCBpdOKAmXMgdGhlIGVhc2ll cyB3YXkgaG93IHRvIGdldCB0aGUgbGFiZWxsaW5nIHJpZ2h0PGJyPg0KPGJyPg0KVGhhbmtzLDxi cj4NCm1pY2hhbDxicj4NCjxicj4NCiZndDs8YnI+DQomZ3Q7IFRoYW5rcyw8YnI+DQomZ3Q7PGJy Pg0KJmd0OyBDYW08YnI+DQomZ3Q7IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fPGJyPg0KJmd0OyBVc2VycyBtYWlsaW5nIGxpc3Q8YnI+DQomZ3Q7IDxhIGhy ZWY9Im1haWx0bzpVc2Vyc0BvdmlydC5vcmciIHRhcmdldD0iX2JsYW5rIj5Vc2Vyc0BvdmlydC5v cmc8L2E+PGJyPg0KJmd0OyA8YSBocmVmPSJodHRwOi8vbGlzdHMub3ZpcnQub3JnL21haWxtYW4v bGlzdGluZm8vdXNlcnMiIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0dHA6Ly9s aXN0cy5vdmlydC5vcmcvbWFpbG1hbi9saXN0aW5mby91c2VyczwvYT48YnI+DQo8YnI+DQo8L2Js b2NrcXVvdGU+PC9kaXY+PGJyPjwvZGl2Pg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX188YnI+VXNlcnMgbWFpbGluZyBsaXN0PGJyPjxhIGhyZWY9Im1haWx0 bzpVc2Vyc0BvdmlydC5vcmciIHRhcmdldD0iX2JsYW5rIj5Vc2Vyc0BvdmlydC5vcmc8L2E+PGJy PjxhIGhyZWY9Imh0dHA6Ly9saXN0cy5vdmlydC5vcmcvbWFpbG1hbi9saXN0aW5mby91c2VycyIg dGFyZ2V0PSJfYmxhbmsiPmh0dHA6Ly9saXN0cy5vdmlydC5vcmcvbWFpbG1hbi9saXN0aW5mby91 c2VyczwvYT48YnI+PC9kaXY+PC9ibG9ja3F1b3RlPjwvZGl2Pjxicj48L3NwYW4+PC9kaXY+PC9i bG9ja3F1b3RlPjwvZGl2Pjxicj48L2Rpdj4NCjwvZGl2PjwvZGl2PjwvYmxvY2txdW90ZT48L2Rp dj48YnI+PC9kaXY+DQo8L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwvZGl2PjwvZGl2Pjwv ZGl2PjwvYmxvY2txdW90ZT48L2Rpdj48YnI+PC9kaXY+DQo8L2Rpdj48L2Jsb2NrcXVvdGU+PC9k aXY+PC9kaXY+PC9ib2R5PjwvaHRtbD4= --Apple-Mail-281A4CF8-F162-4110-89CA-1DC2881E579B--
Hi Michal, Ran restorecon -r on '/' (and restarted vdsmd and other services): it is still getting selinux errors. I'd like to keep selinux running, especially as it is officially supported (and works on the other node), so I guess the best option is to reinstall the OS and then install ovirt again perhaps. Thanks, Campbell On Wed, May 25, 2016 at 6:15 PM, Michal Skrivanek <mskrivan@redhat.com> wrote:
On 25 May 2016, at 19:12, Cam Mac <iucounu@gmail.com> wrote:
I'll try that - presumably on the paths it is complaining about, and the qemu binarys?
It shouldn't hurt on /, it should only help:) And if it complains e.g. on attached nfs, the i suppose you need to run it there too
On Wed, May 25, 2016 at 4:59 PM, Michal Skrivanek < michal.skrivanek@redhat.com> wrote:
On 25 May 2016, at 17:35, Cam Mac <iucounu@gmail.com> wrote:
Hi Michal,
I chose the 'reinstall node' option from the GUI menu, which appeared to go ok, however, I still cannot create or migrate a VM on that node. I can see selinux 'denied' messages relating to qemu-kvm, e.g.:
type=AVC msg=audit(1464189232.136:251): avc: denied { read } for pid=4019 comm="qemu-kvm" name="650000ab-b33a-483a-af46-76f7305e2ae5" dev="sda2" ino=35401 scontext=system_ u:system_r:svirt_t:s0:c720,c927 tcontext=system_u:object_r:unlabeled_t:s0 tclass=lnk_file
There are a number of errors in the vdsm log but I assume that relates to selinux blocking it. So perhaps I need to remove all the ovirt packages manually, or perhaps re-install the OS as well? I guess either of those options involves complications with certificates and WWIDs for the attached SAN.
Or could I somehow generate selinux labels?
yeah, I think it didn’t happen. I though we do relabelling as part of deploy How about running "restorecon -r” now?
These nodes + engine are not yet production, though I'd prefer to fix than restart entirely from scratch.
Thanks for any help.
regards,
Campbell
On Wed, May 11, 2016 at 3:13 PM, Cam Mac <iucounu@gmail.com> wrote:
Ah, ok that makes sense. For the node, is it enough to use the 'reinstall node' option from the GUI, or is it better to reinstall the OS and then deploy it again?
Thanks,
Cam
On Wed, May 11, 2016 at 2:40 PM, Michal Skrivanek < michal.skrivanek@redhat.com> wrote:
On 11 May 2016, at 15:24, Cam Mac <iucounu@gmail.com> wrote:
Thanks Michal, if reinstalling the engine, (which also had SELinux disabled at install), would the best way be to backup the engine and then restore just the ovirt config?
for engine..well, VM security is not related to that, those are running on hypervisors, not the engine. So for any functionality/security it’s irrelevant what SELinux state it’s in I’m not sure if relabeling with restorecon is not enough (it sould work also on nodes, but as I said, it’s likely more safe to reinstall just to be really really sure:) Simone, am I right about the restorecon for engine?
Cheers,
Cam
On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek < michal.skrivanek@redhat.com> wrote:
On 11 May 2016, at 15:02, Cam Mac <iucounu@gmail.com> wrote:
Hi,
In the oVirt guide, it says that "SELinux is being used by default on oVirt Node", but then goes on to say that if you have problems you should set it to permissive mode. I have had a few things fail due to being blocked by SELinux on a node I later enabled SELinux on, as it was off at install time. The other node which has had SELinux on from the start and so far has not had any oVirt operations blocked. I am guessing that the oVirt install process creates the necessary rules to allow vdsm to run under SELinux. So if you want to set SELinux to enforcing after installation, is there a script to do this, or is it better to just reinstall the node or engine, rather than trying to work out the individual exceptions?
For oVirt node it’s easier to reinstall it, it doesn’t persist much and it’s the easies way how to get the labelling right
Thanks, michal
Thanks,
Cam _______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
--Apple-Mail-31476308-D6F5-4B3E-AE26-09A43CB9A8DD Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 DQoNCj4gT24gMjUgTWF5IDIwMTYsIGF0IDE5OjI5LCBDYW0gTWFjIDxpdWNvdW51QGdtYWlsLmNv bT4gd3JvdGU6DQo+IA0KPiBIaSBNaWNoYWwsDQo+IA0KPiBSYW4gcmVzdG9yZWNvbiAtciBvbiAn LycgKGFuZCByZXN0YXJ0ZWQgdmRzbWQgYW5kIG90aGVyIHNlcnZpY2VzKTogaXQgaXMgc3RpbGwg Z2V0dGluZyBzZWxpbnV4IGVycm9ycy4gSSdkIGxpa2UgdG8ga2VlcCBzZWxpbnV4IHJ1bm5pbmcs IGVzcGVjaWFsbHkgYXMgaXQgaXMgb2ZmaWNpYWxseSBzdXBwb3J0ZWQNCg0KWWVhaC4gSG0sIGR1 bm5vIHdoeSBpdCBkaWRuJ3Qgd29yaywgcGVyaGFwcyB0aGUgY29uZmlnIGlzIG5vdCBzZXQgdXAg Y29ycmVjdGx5LiBJIHRob3VnaHQgcmVkZXBsb3kgd291bGQgZml4IGl0IGJ1dCBJIGRvbid0IHJl YWxseSBrbm93IHRoZSBkZXBsb3ltZW50IGNvZGUgc28gbWF5YmUgSSdtIHdyb25nDQoNCj4gKGFu ZCB3b3JrcyBvbiB0aGUgb3RoZXIgbm9kZSksIHNvIEkgZ3Vlc3MgdGhlIGJlc3Qgb3B0aW9uIGlz IHRvIHJlaW5zdGFsbCB0aGUgT1MgYW5kIHRoZW4gaW5zdGFsbCBvdmlydCBhZ2FpbiBwZXJoYXBz Lg0KDQpUaGF0J3MgdGhlIG1vc3QgZWFzeSB3YXkgb3V0LCB5ZXM6KQ0KDQpUaGFua3MsDQptaWNo YWwNCj4gDQo+IFRoYW5rcywNCj4gDQo+IENhbXBiZWxsDQo+IA0KPj4gT24gV2VkLCBNYXkgMjUs IDIwMTYgYXQgNjoxNSBQTSwgTWljaGFsIFNrcml2YW5layA8bXNrcml2YW5AcmVkaGF0LmNvbT4g d3JvdGU6DQo+PiANCj4+IA0KPj4+IE9uIDI1IE1heSAyMDE2LCBhdCAxOToxMiwgQ2FtIE1hYyA8 aXVjb3VudUBnbWFpbC5jb20+IHdyb3RlOg0KPj4+IA0KPj4+IEknbGwgdHJ5IHRoYXQgLSBwcmVz dW1hYmx5IG9uIHRoZSBwYXRocyBpdCBpcyBjb21wbGFpbmluZyBhYm91dCwgYW5kIHRoZSBxZW11 IGJpbmFyeXM/DQo+PiANCj4+IEl0IHNob3VsZG4ndCBodXJ0IG9uIC8sIGl0IHNob3VsZCBvbmx5 IGhlbHA6KQ0KPj4gQW5kIGlmIGl0IGNvbXBsYWlucyBlLmcuIG9uIGF0dGFjaGVkIG5mcywgdGhl IGkgc3VwcG9zZSB5b3UgbmVlZCB0byBydW4gaXQgdGhlcmUgdG9vDQo+PiANCj4+IA0KPj4+IA0K Pj4+PiBPbiBXZWQsIE1heSAyNSwgMjAxNiBhdCA0OjU5IFBNLCBNaWNoYWwgU2tyaXZhbmVrIDxt aWNoYWwuc2tyaXZhbmVrQHJlZGhhdC5jb20+IHdyb3RlOg0KPj4+PiANCj4+Pj4+IE9uIDI1IE1h eSAyMDE2LCBhdCAxNzozNSwgQ2FtIE1hYyA8aXVjb3VudUBnbWFpbC5jb20+IHdyb3RlOg0KPj4+ Pj4gDQo+Pj4+PiBIaSBNaWNoYWwsDQo+Pj4+PiANCj4+Pj4+IEkgY2hvc2UgdGhlICdyZWluc3Rh bGwgbm9kZScgb3B0aW9uIGZyb20gdGhlIEdVSSBtZW51LCB3aGljaCBhcHBlYXJlZCB0byBnbyBv aywgaG93ZXZlciwgSSBzdGlsbCBjYW5ub3QgY3JlYXRlIG9yIG1pZ3JhdGUgYSBWTSBvbiB0aGF0 IG5vZGUuIEkgY2FuIHNlZSBzZWxpbnV4ICdkZW5pZWQnIG1lc3NhZ2VzIHJlbGF0aW5nIHRvIHFl bXUta3ZtLCBlLmcuOg0KPj4+Pj4gDQo+Pj4+PiB0eXBlPUFWQyBtc2c9YXVkaXQoMTQ2NDE4OTIz Mi4xMzY6MjUxKTogYXZjOiAgZGVuaWVkICB7IHJlYWQgfSBmb3IgIHBpZD00MDE5IGNvbW09InFl bXUta3ZtIiBuYW1lPSI2NTAwMDBhYi1iMzNhLTQ4M2EtYWY0Ni03NmY3MzA1ZTJhZTUiIGRldj0i c2RhMiIgaW5vPTM1NDAxIHNjb250ZXh0PXN5c3RlbV8NCj4+Pj4+IHU6c3lzdGVtX3I6c3ZpcnRf dDpzMDpjNzIwLGM5MjcgdGNvbnRleHQ9c3lzdGVtX3U6b2JqZWN0X3I6dW5sYWJlbGVkX3Q6czAg dGNsYXNzPWxua19maWxlDQo+Pj4+PiANCj4+Pj4+IFRoZXJlIGFyZSBhIG51bWJlciBvZiBlcnJv cnMgaW4gdGhlIHZkc20gbG9nIGJ1dCBJIGFzc3VtZSB0aGF0IHJlbGF0ZXMgdG8gc2VsaW51eCBi bG9ja2luZyBpdC4gU28gcGVyaGFwcyBJIG5lZWQgdG8gcmVtb3ZlIGFsbCB0aGUgb3ZpcnQgcGFj a2FnZXMgbWFudWFsbHksIG9yIHBlcmhhcHMgcmUtaW5zdGFsbCB0aGUgT1MgYXMgd2VsbD8gSSBn dWVzcyBlaXRoZXIgb2YgdGhvc2Ugb3B0aW9ucyBpbnZvbHZlcyBjb21wbGljYXRpb25zIHdpdGgg Y2VydGlmaWNhdGVzIGFuZCBXV0lEcyBmb3IgdGhlIGF0dGFjaGVkIFNBTi4gDQo+Pj4+PiANCj4+ Pj4+IE9yIGNvdWxkIEkgc29tZWhvdyBnZW5lcmF0ZSBzZWxpbnV4IGxhYmVscz8NCj4+Pj4gDQo+ Pj4+IHllYWgsIEkgdGhpbmsgaXQgZGlkbuKAmXQgaGFwcGVuLiBJIHRob3VnaCB3ZSBkbyByZWxh YmVsbGluZyBhcyBwYXJ0IG9mIGRlcGxveQ0KPj4+PiBIb3cgYWJvdXQgcnVubmluZyAicmVzdG9y ZWNvbiAtcuKAnSBub3c/DQo+Pj4+IA0KPj4+Pj4gDQo+Pj4+PiBUaGVzZSBub2RlcyArIGVuZ2lu ZSBhcmUgbm90IHlldCBwcm9kdWN0aW9uLCB0aG91Z2ggSSdkIHByZWZlciB0byBmaXggdGhhbiBy ZXN0YXJ0IGVudGlyZWx5IGZyb20gc2NyYXRjaC4NCj4+Pj4+IA0KPj4+Pj4gVGhhbmtzIGZvciBh bnkgaGVscC4NCj4+Pj4+IA0KPj4+Pj4gcmVnYXJkcywNCj4+Pj4+IA0KPj4+Pj4gQ2FtcGJlbGwN Cj4+Pj4+IA0KPj4+Pj4gDQo+Pj4+Pj4gT24gV2VkLCBNYXkgMTEsIDIwMTYgYXQgMzoxMyBQTSwg Q2FtIE1hYyA8aXVjb3VudUBnbWFpbC5jb20+IHdyb3RlOg0KPj4+Pj4+IEFoLCBvayB0aGF0IG1h a2VzIHNlbnNlLiBGb3IgdGhlIG5vZGUsIGlzIGl0IGVub3VnaCB0byB1c2UgdGhlICdyZWluc3Rh bGwgbm9kZScgb3B0aW9uIGZyb20gdGhlIEdVSSwgb3IgaXMgaXQgYmV0dGVyIHRvIHJlaW5zdGFs bCB0aGUgT1MgYW5kIHRoZW4gZGVwbG95IGl0IGFnYWluPw0KPj4+Pj4+IA0KPj4+Pj4+IFRoYW5r cywNCj4+Pj4+PiANCj4+Pj4+PiBDYW0NCj4+Pj4+PiANCj4+Pj4+Pj4gT24gV2VkLCBNYXkgMTEs IDIwMTYgYXQgMjo0MCBQTSwgTWljaGFsIFNrcml2YW5layA8bWljaGFsLnNrcml2YW5la0ByZWRo YXQuY29tPiB3cm90ZToNCj4+Pj4+Pj4gDQo+Pj4+Pj4+PiBPbiAxMSBNYXkgMjAxNiwgYXQgMTU6 MjQsIENhbSBNYWMgPGl1Y291bnVAZ21haWwuY29tPiB3cm90ZToNCj4+Pj4+Pj4+IA0KPj4+Pj4+ Pj4gVGhhbmtzIE1pY2hhbCwgaWYgcmVpbnN0YWxsaW5nIHRoZSBlbmdpbmUsICh3aGljaCBhbHNv IGhhZCBTRUxpbnV4IGRpc2FibGVkIGF0IGluc3RhbGwpLCB3b3VsZCB0aGUgYmVzdCB3YXkgYmUg dG8gYmFja3VwIHRoZSBlbmdpbmUgYW5kIHRoZW4gcmVzdG9yZSBqdXN0IHRoZSBvdmlydCBjb25m aWc/DQo+Pj4+Pj4+IA0KPj4+Pj4+PiBmb3IgZW5naW5lLi53ZWxsLCBWTSBzZWN1cml0eSBpcyBu b3QgcmVsYXRlZCB0byB0aGF0LCB0aG9zZSBhcmUgcnVubmluZyBvbiBoeXBlcnZpc29ycywgbm90 IHRoZSBlbmdpbmUuIFNvIGZvciBhbnkgZnVuY3Rpb25hbGl0eS9zZWN1cml0eSBpdOKAmXMgaXJy ZWxldmFudCB3aGF0IFNFTGludXggc3RhdGUgaXTigJlzIGluDQo+Pj4+Pj4+IEnigJltIG5vdCBz dXJlIGlmIHJlbGFiZWxpbmcgd2l0aCByZXN0b3JlY29uIGlzIG5vdCBlbm91Z2ggKGl0IHNvdWxk IHdvcmsgYWxzbyBvbiBub2RlcywgYnV0IGFzIEkgc2FpZCwgaXTigJlzIGxpa2VseSBtb3JlIHNh ZmUgdG8gcmVpbnN0YWxsIGp1c3QgdG8gYmUgcmVhbGx5IHJlYWxseSBzdXJlOikNCj4+Pj4+Pj4g U2ltb25lLCBhbSBJIHJpZ2h0IGFib3V0IHRoZSByZXN0b3JlY29uIGZvciBlbmdpbmU/DQo+Pj4+ Pj4+IA0KPj4+Pj4+Pj4gDQo+Pj4+Pj4+PiBDaGVlcnMsDQo+Pj4+Pj4+PiANCj4+Pj4+Pj4+IENh bQ0KPj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4gT24gV2VkLCBNYXkgMTEsIDIwMTYgYXQgMjoxNCBQTSwg TWljaGFsIFNrcml2YW5layA8bWljaGFsLnNrcml2YW5la0ByZWRoYXQuY29tPiB3cm90ZToNCj4+ Pj4+Pj4+PiANCj4+Pj4+Pj4+PiA+IE9uIDExIE1heSAyMDE2LCBhdCAxNTowMiwgQ2FtIE1hYyA8 aXVjb3VudUBnbWFpbC5jb20+IHdyb3RlOg0KPj4+Pj4+Pj4+ID4NCj4+Pj4+Pj4+PiA+IEhpLA0K Pj4+Pj4+Pj4+ID4NCj4+Pj4+Pj4+PiA+IEluIHRoZSBvVmlydCBndWlkZSwgaXQgc2F5cyB0aGF0 ICJTRUxpbnV4IGlzIGJlaW5nIHVzZWQgYnkgZGVmYXVsdCBvbiBvVmlydCBOb2RlIiwgYnV0IHRo ZW4gZ29lcyBvbiB0byBzYXkgdGhhdCBpZiB5b3UgaGF2ZSBwcm9ibGVtcyB5b3Ugc2hvdWxkIHNl dCBpdCB0byBwZXJtaXNzaXZlIG1vZGUuIEkgaGF2ZSBoYWQgYSBmZXcgdGhpbmdzIGZhaWwgZHVl IHRvIGJlaW5nIGJsb2NrZWQgYnkgU0VMaW51eCBvbiBhIG5vZGUgSSBsYXRlciBlbmFibGVkIFNF TGludXggb24sIGFzIGl0IHdhcyBvZmYgYXQgaW5zdGFsbCB0aW1lLiBUaGUgb3RoZXIgbm9kZSB3 aGljaCBoYXMgaGFkIFNFTGludXggb24gZnJvbSB0aGUgc3RhcnQgYW5kIHNvIGZhciBoYXMgbm90 IGhhZCBhbnkgb1ZpcnQgb3BlcmF0aW9ucyBibG9ja2VkLiBJIGFtIGd1ZXNzaW5nIHRoYXQgdGhl IG9WaXJ0IGluc3RhbGwgcHJvY2VzcyBjcmVhdGVzIHRoZSBuZWNlc3NhcnkgcnVsZXMgdG8gYWxs b3cgdmRzbSB0byBydW4gdW5kZXIgU0VMaW51eC4gU28gaWYgeW91IHdhbnQgdG8gc2V0IFNFTGlu dXggdG8gZW5mb3JjaW5nIGFmdGVyIGluc3RhbGxhdGlvbiwgaXMgdGhlcmUgYSBzY3JpcHQgdG8g ZG8gdGhpcywgb3IgaXMgaXQgYmV0dGVyIHRvIGp1c3QgcmVpbnN0YWxsIHRoZSBub2RlIG9yIGVu Z2luZSwgcmF0aGVyIHRoYW4gdHJ5aW5nIHRvIHdvcmsgb3V0IHRoZSBpbmRpdmlkdWFsIGV4Y2Vw dGlvbnM/DQo+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+Pj4gRm9yIG9WaXJ0IG5vZGUgaXTigJlzIGVhc2ll ciB0byByZWluc3RhbGwgaXQsIGl0IGRvZXNu4oCZdCBwZXJzaXN0IG11Y2ggYW5kIGl04oCZcyB0 aGUgZWFzaWVzIHdheSBob3cgdG8gZ2V0IHRoZSBsYWJlbGxpbmcgcmlnaHQNCj4+Pj4+Pj4+PiAN Cj4+Pj4+Pj4+PiBUaGFua3MsDQo+Pj4+Pj4+Pj4gbWljaGFsDQo+Pj4+Pj4+Pj4gDQo+Pj4+Pj4+ Pj4gPg0KPj4+Pj4+Pj4+ID4gVGhhbmtzLA0KPj4+Pj4+Pj4+ID4NCj4+Pj4+Pj4+PiA+IENhbQ0K Pj4+Pj4+Pj4+ID4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18NCj4+Pj4+Pj4+PiA+IFVzZXJzIG1haWxpbmcgbGlzdA0KPj4+Pj4+Pj4+ID4gVXNlcnNAb3Zp cnQub3JnDQo+Pj4+Pj4+Pj4gPiBodHRwOi8vbGlzdHMub3ZpcnQub3JnL21haWxtYW4vbGlzdGlu Zm8vdXNlcnMNCj4+Pj4+Pj4+PiANCj4+Pj4+Pj4+IA0KPj4+Pj4+Pj4gX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+Pj4+Pj4+IFVzZXJzIG1haWxpbmcg bGlzdA0KPj4+Pj4+Pj4gVXNlcnNAb3ZpcnQub3JnDQo+Pj4+Pj4+PiBodHRwOi8vbGlzdHMub3Zp cnQub3JnL21haWxtYW4vbGlzdGluZm8vdXNlcnMNCj4+Pj4+Pj4gDQo+Pj4+Pj4gDQo+Pj4+PiAN Cj4+Pj4gDQo+Pj4gDQo+IA0K --Apple-Mail-31476308-D6F5-4B3E-AE26-09A43CB9A8DD Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 PGh0bWw+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0 L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPjwvaGVhZD48Ym9keSBkaXI9ImF1dG8iPjxkaXY+PC9kaXY+ PGRpdj48YnI+PC9kaXY+PGRpdj48YnI+T24gMjUgTWF5IDIwMTYsIGF0IDE5OjI5LCBDYW0gTWFj ICZsdDs8YSBocmVmPSJtYWlsdG86aXVjb3VudUBnbWFpbC5jb20iPml1Y291bnVAZ21haWwuY29t PC9hPiZndDsgd3JvdGU6PGJyPjxicj48L2Rpdj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2 PjxkaXYgZGlyPSJsdHIiPkhpIE1pY2hhbCw8ZGl2Pjxicj48L2Rpdj48ZGl2PlJhbiByZXN0b3Jl Y29uIC1yIG9uICcvJyAoYW5kIHJlc3RhcnRlZCB2ZHNtZCBhbmQgb3RoZXIgc2VydmljZXMpOiBp dCBpcyBzdGlsbCBnZXR0aW5nIHNlbGludXggZXJyb3JzLiBJJ2QgbGlrZSB0byBrZWVwIHNlbGlu dXggcnVubmluZywgZXNwZWNpYWxseSBhcyBpdCBpcyBvZmZpY2lhbGx5IHN1cHBvcnRlZCA8L2Rp dj48L2Rpdj48L2Rpdj48L2Jsb2NrcXVvdGU+PGRpdj48YnI+PC9kaXY+WWVhaC4gSG0sIGR1bm5v IHdoeSBpdCBkaWRuJ3Qgd29yaywgcGVyaGFwcyB0aGUgY29uZmlnIGlzIG5vdCBzZXQgdXAgY29y cmVjdGx5LiBJIHRob3VnaHQgcmVkZXBsb3kgd291bGQgZml4IGl0IGJ1dCBJIGRvbid0IHJlYWxs eSBrbm93IHRoZSBkZXBsb3ltZW50IGNvZGUgc28gbWF5YmUgSSdtIHdyb25nPGRpdj48YnI+PGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGRpdj48ZGl2IGRpcj0ibHRyIj48ZGl2PihhbmQgd29ya3Mg b24gdGhlIG90aGVyIG5vZGUpLCBzbyBJIGd1ZXNzIHRoZSBiZXN0IG9wdGlvbiBpcyB0byByZWlu c3RhbGwgdGhlIE9TIGFuZCB0aGVuIGluc3RhbGwgb3ZpcnQgYWdhaW4gcGVyaGFwcy48L2Rpdj48 L2Rpdj48L2Rpdj48L2Jsb2NrcXVvdGU+PGRpdj48YnI+PC9kaXY+VGhhdCdzIHRoZSBtb3N0IGVh c3kgd2F5IG91dCwgeWVzOik8L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PlRoYW5rcyw8L2Rpdj48 ZGl2Pm1pY2hhbDxicj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2PjxkaXYgZGlyPSJsdHIi PjxkaXY+PGJyPjwvZGl2PjxkaXY+VGhhbmtzLDwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+Q2Ft cGJlbGw8L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+PGJyPjxkaXYgY2xhc3M9 ImdtYWlsX3F1b3RlIj5PbiBXZWQsIE1heSAyNSwgMjAxNiBhdCA2OjE1IFBNLCBNaWNoYWwgU2ty aXZhbmVrIDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOm1za3JpdmFuQHJlZGhh dC5jb20iIHRhcmdldD0iX2JsYW5rIj5tc2tyaXZhbkByZWRoYXQuY29tPC9hPiZndDs8L3NwYW4+ IHdyb3RlOjxicj48YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46 MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4Ij48 ZGl2IGRpcj0iYXV0byI+PHNwYW4gY2xhc3M9IiI+PGRpdj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48 ZGl2Pjxicj5PbiAyNSBNYXkgMjAxNiwgYXQgMTk6MTIsIENhbSBNYWMgJmx0OzxhIGhyZWY9Im1h aWx0bzppdWNvdW51QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPml1Y291bnVAZ21haWwuY29t PC9hPiZndDsgd3JvdGU6PGJyPjxicj48L2Rpdj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2 PjxkaXYgZGlyPSJsdHIiPkknbGwgdHJ5IHRoYXQgLSBwcmVzdW1hYmx5IG9uIHRoZSBwYXRocyBp dCBpcyBjb21wbGFpbmluZyBhYm91dCwgYW5kIHRoZSBxZW11IGJpbmFyeXM/PC9kaXY+PC9kaXY+ PC9ibG9ja3F1b3RlPjxkaXY+PGJyPjwvZGl2Pjwvc3Bhbj5JdCBzaG91bGRuJ3QgaHVydCBvbiAv LCBpdCBzaG91bGQgb25seSBoZWxwOik8ZGl2PkFuZCBpZiBpdCBjb21wbGFpbnMgZS5nLiBvbiBh dHRhY2hlZCBuZnMsIHRoZSBpIHN1cHBvc2UgeW91IG5lZWQgdG8gcnVuIGl0IHRoZXJlIHRvbzxk aXY+PGRpdiBjbGFzcz0iaDUiPjxicj48ZGl2Pjxicj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48 ZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnI+PGRpdiBjbGFzcz0iZ21haWxfcXVvdGUi Pk9uIFdlZCwgTWF5IDI1LCAyMDE2IGF0IDQ6NTkgUE0sIE1pY2hhbCBTa3JpdmFuZWsgPHNwYW4g ZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86bWljaGFsLnNrcml2YW5la0ByZWRoYXQuY29t IiB0YXJnZXQ9Il9ibGFuayI+bWljaGFsLnNrcml2YW5la0ByZWRoYXQuY29tPC9hPiZndDs8L3Nw YW4+IHdyb3RlOjxicj48YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJn aW46MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4 Ij48ZGl2IHN0eWxlPSJ3b3JkLXdyYXA6YnJlYWstd29yZCI+PGJyPjxkaXY+PHNwYW4+PGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+PGRpdj5PbiAyNSBNYXkgMjAxNiwgYXQgMTc6MzUsIENhbSBNYWMg Jmx0OzxhIGhyZWY9Im1haWx0bzppdWNvdW51QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPml1 Y291bnVAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PC9kaXY+PGJyPjxkaXY+PGRpdiBkaXI9Imx0 ciI+SGkgTWljaGFsLDxkaXY+PGJyPjwvZGl2PjxkaXY+SSBjaG9zZSB0aGUgJ3JlaW5zdGFsbCBu b2RlJyBvcHRpb24gZnJvbSB0aGUgR1VJIG1lbnUsIHdoaWNoIGFwcGVhcmVkIHRvIGdvIG9rLCBo b3dldmVyLCBJIHN0aWxsIGNhbm5vdCBjcmVhdGUgb3IgbWlncmF0ZSBhIFZNIG9uIHRoYXQgbm9k ZS4gSSBjYW4gc2VlIHNlbGludXggJ2RlbmllZCcgbWVzc2FnZXMgcmVsYXRpbmcgdG8gcWVtdS1r dm0sIGUuZy46PC9kaXY+PGRpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PnR5cGU9QVZDIG1zZz1hdWRp dCgxNDY0MTg5MjMyLjEzNjoyNTEpOiBhdmM6ICZuYnNwO2RlbmllZCAmbmJzcDt7IHJlYWQgfSBm b3IgJm5ic3A7cGlkPTQwMTkgY29tbT0icWVtdS1rdm0iIG5hbWU9IjY1MDAwMGFiLWIzM2EtNDgz YS1hZjQ2LTc2ZjczMDVlMmFlNSIgZGV2PSJzZGEyIiBpbm89MzU0MDEgc2NvbnRleHQ9c3lzdGVt XzwvZGl2PjxkaXY+dTpzeXN0ZW1fcjpzdmlydF90OnMwOmM3MjAsYzkyNyB0Y29udGV4dD1zeXN0 ZW1fdTpvYmplY3Rfcjp1bmxhYmVsZWRfdDpzMCB0Y2xhc3M9bG5rX2ZpbGU8L2Rpdj48L2Rpdj48 ZGl2Pjxicj48L2Rpdj48ZGl2PlRoZXJlIGFyZSBhIG51bWJlciBvZiBlcnJvcnMgaW4gdGhlIHZk c20gbG9nIGJ1dCBJIGFzc3VtZSB0aGF0IHJlbGF0ZXMgdG8gc2VsaW51eCBibG9ja2luZyBpdC4g U28gcGVyaGFwcyBJIG5lZWQgdG8gcmVtb3ZlIGFsbCB0aGUgb3ZpcnQgcGFja2FnZXMgbWFudWFs bHksIG9yIHBlcmhhcHMgcmUtaW5zdGFsbCB0aGUgT1MgYXMgd2VsbD8gSSBndWVzcyBlaXRoZXIg b2YgdGhvc2Ugb3B0aW9ucyBpbnZvbHZlcyBjb21wbGljYXRpb25zIHdpdGggY2VydGlmaWNhdGVz IGFuZCBXV0lEcyBmb3IgdGhlIGF0dGFjaGVkIFNBTi4mbmJzcDs8L2Rpdj48ZGl2Pjxicj48L2Rp dj48ZGl2Pk9yIGNvdWxkIEkgc29tZWhvdyBnZW5lcmF0ZSBzZWxpbnV4IGxhYmVscz88L2Rpdj48 L2Rpdj48L2Rpdj48L2Jsb2NrcXVvdGU+PGRpdj48YnI+PC9kaXY+PC9zcGFuPnllYWgsIEkgdGhp bmsgaXQgZGlkbuKAmXQgaGFwcGVuLiBJIHRob3VnaCB3ZSBkbyByZWxhYmVsbGluZyBhcyBwYXJ0 IG9mIGRlcGxveTwvZGl2PjxkaXY+SG93IGFib3V0IHJ1bm5pbmcgInJlc3RvcmVjb24gLXLigJ0g bm93PzwvZGl2PjxkaXY+PGRpdj48ZGl2Pjxicj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2 PjxkaXYgZGlyPSJsdHIiPjxkaXY+PGJyPjwvZGl2PjxkaXY+VGhlc2Ugbm9kZXMgKyBlbmdpbmUg YXJlIG5vdCB5ZXQgcHJvZHVjdGlvbiwgdGhvdWdoIEknZCBwcmVmZXIgdG8gZml4IHRoYW4gcmVz dGFydCBlbnRpcmVseSBmcm9tIHNjcmF0Y2guPC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5UaGFu a3MgZm9yIGFueSBoZWxwLjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+cmVnYXJkcyw8L2Rpdj48 ZGl2Pjxicj5DYW1wYmVsbDwvZGl2PjxkaXY+PGJyPjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9Imdt YWlsX2V4dHJhIj48YnI+PGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPk9uIFdlZCwgTWF5IDExLCAy MDE2IGF0IDM6MTMgUE0sIENhbSBNYWMgPHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWls dG86aXVjb3VudUBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5pdWNvdW51QGdtYWlsLmNvbTwv YT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBz dHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGlu Zy1sZWZ0OjFleCI+PGRpdiBkaXI9Imx0ciI+QWgsIG9rIHRoYXQgbWFrZXMgc2Vuc2UuIEZvciB0 aGUgbm9kZSwgaXMgaXQgZW5vdWdoIHRvIHVzZSB0aGUgJ3JlaW5zdGFsbCBub2RlJyBvcHRpb24g ZnJvbSB0aGUgR1VJLCBvciBpcyBpdCBiZXR0ZXIgdG8gcmVpbnN0YWxsIHRoZSBPUyBhbmQgdGhl biBkZXBsb3kgaXQgYWdhaW4/PGRpdj48YnI+PC9kaXY+PGRpdj5UaGFua3MsPC9kaXY+PGRpdj48 YnI+Q2FtPC9kaXY+PC9kaXY+PGRpdj48ZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnI+ PGRpdiBjbGFzcz0iZ21haWxfcXVvdGUiPk9uIFdlZCwgTWF5IDExLCAyMDE2IGF0IDI6NDAgUE0s IE1pY2hhbCBTa3JpdmFuZWsgPHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86bWlj aGFsLnNrcml2YW5la0ByZWRoYXQuY29tIiB0YXJnZXQ9Il9ibGFuayI+bWljaGFsLnNrcml2YW5l a0ByZWRoYXQuY29tPC9hPiZndDs8L3NwYW4+IHdyb3RlOjxicj48YmxvY2txdW90ZSBjbGFzcz0i Z21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2Nj YyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4Ij48ZGl2IHN0eWxlPSJ3b3JkLXdyYXA6YnJlYWstd29y ZCI+PGJyPjxkaXY+PHNwYW4+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGRpdj5PbiAxMSBNYXkg MjAxNiwgYXQgMTU6MjQsIENhbSBNYWMgJmx0OzxhIGhyZWY9Im1haWx0bzppdWNvdW51QGdtYWls LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPml1Y291bnVAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PC9k aXY+PGJyPjxkaXY+PGRpdiBkaXI9Imx0ciI+VGhhbmtzIE1pY2hhbCwgaWYgcmVpbnN0YWxsaW5n IHRoZSBlbmdpbmUsICh3aGljaCBhbHNvIGhhZCBTRUxpbnV4IGRpc2FibGVkIGF0IGluc3RhbGwp LCB3b3VsZCB0aGUgYmVzdCB3YXkgYmUgdG8gYmFja3VwIHRoZSBlbmdpbmUgYW5kIHRoZW4gcmVz dG9yZSBqdXN0IHRoZSBvdmlydCBjb25maWc/PC9kaXY+PC9kaXY+PC9ibG9ja3F1b3RlPjxkaXY+ PGJyPjwvZGl2Pjwvc3Bhbj5mb3IgZW5naW5lLi53ZWxsLCBWTSBzZWN1cml0eSBpcyBub3QgcmVs YXRlZCB0byB0aGF0LCB0aG9zZSBhcmUgcnVubmluZyBvbiBoeXBlcnZpc29ycywgbm90IHRoZSBl bmdpbmUuIFNvIGZvciBhbnkgZnVuY3Rpb25hbGl0eS9zZWN1cml0eSBpdOKAmXMgaXJyZWxldmFu dCB3aGF0IFNFTGludXggc3RhdGUgaXTigJlzIGluPC9kaXY+PGRpdj5J4oCZbSBub3Qgc3VyZSBp ZiByZWxhYmVsaW5nIHdpdGggcmVzdG9yZWNvbiBpcyBub3QgZW5vdWdoIChpdCBzb3VsZCB3b3Jr IGFsc28gb24gbm9kZXMsIGJ1dCBhcyBJIHNhaWQsIGl04oCZcyBsaWtlbHkgbW9yZSBzYWZlIHRv IHJlaW5zdGFsbCBqdXN0IHRvIGJlIHJlYWxseSByZWFsbHkgc3VyZTopPC9kaXY+PGRpdj5TaW1v bmUsIGFtIEkgcmlnaHQgYWJvdXQgdGhlIHJlc3RvcmVjb24gZm9yIGVuZ2luZT88L2Rpdj48c3Bh bj48ZGl2Pjxicj48L2Rpdj48ZGl2PjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxkaXY+PGRpdiBk aXI9Imx0ciI+PGRpdj48YnI+PC9kaXY+PGRpdj5DaGVlcnMsPC9kaXY+PGRpdj48YnI+PC9kaXY+ PGRpdj5DYW08L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+PGJyPjxkaXYgY2xh c3M9ImdtYWlsX3F1b3RlIj5PbiBXZWQsIE1heSAxMSwgMjAxNiBhdCAyOjE0IFBNLCBNaWNoYWwg U2tyaXZhbmVrIDxzcGFuIGRpcj0ibHRyIj4mbHQ7PGEgaHJlZj0ibWFpbHRvOm1pY2hhbC5za3Jp dmFuZWtAcmVkaGF0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1pY2hhbC5za3JpdmFuZWtAcmVkaGF0 LmNvbTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1 b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7 cGFkZGluZy1sZWZ0OjFleCI+PHNwYW4+PGJyPg0KJmd0OyBPbiAxMSBNYXkgMjAxNiwgYXQgMTU6 MDIsIENhbSBNYWMgJmx0OzxhIGhyZWY9Im1haWx0bzppdWNvdW51QGdtYWlsLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPml1Y291bnVAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PGJyPg0KJmd0Ozxicj4N CiZndDsgSGksPGJyPg0KJmd0Ozxicj4NCiZndDsgSW4gdGhlIG9WaXJ0IGd1aWRlLCBpdCBzYXlz IHRoYXQgIlNFTGludXggaXMgYmVpbmcgdXNlZCBieSBkZWZhdWx0IG9uIG9WaXJ0IE5vZGUiLCBi dXQgdGhlbiBnb2VzIG9uIHRvIHNheSB0aGF0IGlmIHlvdSBoYXZlIHByb2JsZW1zIHlvdSBzaG91 bGQgc2V0IGl0IHRvIHBlcm1pc3NpdmUgbW9kZS4gSSBoYXZlIGhhZCBhIGZldyB0aGluZ3MgZmFp bCBkdWUgdG8gYmVpbmcgYmxvY2tlZCBieSBTRUxpbnV4IG9uIGEgbm9kZSBJIGxhdGVyIGVuYWJs ZWQgU0VMaW51eCBvbiwgYXMgaXQgd2FzIG9mZiBhdCBpbnN0YWxsIHRpbWUuIFRoZSBvdGhlciBu b2RlIHdoaWNoIGhhcyBoYWQgU0VMaW51eCBvbiBmcm9tIHRoZSBzdGFydCBhbmQgc28gZmFyIGhh cyBub3QgaGFkIGFueSBvVmlydCBvcGVyYXRpb25zIGJsb2NrZWQuIEkgYW0gZ3Vlc3NpbmcgdGhh dCB0aGUgb1ZpcnQgaW5zdGFsbCBwcm9jZXNzIGNyZWF0ZXMgdGhlIG5lY2Vzc2FyeSBydWxlcyB0 byBhbGxvdyB2ZHNtIHRvIHJ1biB1bmRlciBTRUxpbnV4LiBTbyBpZiB5b3Ugd2FudCB0byBzZXQg U0VMaW51eCB0byBlbmZvcmNpbmcgYWZ0ZXIgaW5zdGFsbGF0aW9uLCBpcyB0aGVyZSBhIHNjcmlw dCB0byBkbyB0aGlzLCBvciBpcyBpdCBiZXR0ZXIgdG8ganVzdCByZWluc3RhbGwgdGhlIG5vZGUg b3IgZW5naW5lLCByYXRoZXIgdGhhbiB0cnlpbmcgdG8gd29yayBvdXQgdGhlIGluZGl2aWR1YWwg ZXhjZXB0aW9ucz88YnI+DQo8YnI+DQo8L3NwYW4+Rm9yIG9WaXJ0IG5vZGUgaXTigJlzIGVhc2ll ciB0byByZWluc3RhbGwgaXQsIGl0IGRvZXNu4oCZdCBwZXJzaXN0IG11Y2ggYW5kIGl04oCZcyB0 aGUgZWFzaWVzIHdheSBob3cgdG8gZ2V0IHRoZSBsYWJlbGxpbmcgcmlnaHQ8YnI+DQo8YnI+DQpU aGFua3MsPGJyPg0KbWljaGFsPGJyPg0KPGJyPg0KJmd0Ozxicj4NCiZndDsgVGhhbmtzLDxicj4N CiZndDs8YnI+DQomZ3Q7IENhbTxicj4NCiZndDsgX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX188YnI+DQomZ3Q7IFVzZXJzIG1haWxpbmcgbGlzdDxicj4NCiZn dDsgPGEgaHJlZj0ibWFpbHRvOlVzZXJzQG92aXJ0Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPlVzZXJz QG92aXJ0Lm9yZzwvYT48YnI+DQomZ3Q7IDxhIGhyZWY9Imh0dHA6Ly9saXN0cy5vdmlydC5vcmcv bWFpbG1hbi9saXN0aW5mby91c2VycyIgcmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+ aHR0cDovL2xpc3RzLm92aXJ0Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VzZXJzPC9hPjxicj4NCjxi cj4NCjwvYmxvY2txdW90ZT48L2Rpdj48YnI+PC9kaXY+DQpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXzxicj5Vc2VycyBtYWlsaW5nIGxpc3Q8YnI+PGEgaHJl Zj0ibWFpbHRvOlVzZXJzQG92aXJ0Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPlVzZXJzQG92aXJ0Lm9y ZzwvYT48YnI+PGEgaHJlZj0iaHR0cDovL2xpc3RzLm92aXJ0Lm9yZy9tYWlsbWFuL2xpc3RpbmZv L3VzZXJzIiB0YXJnZXQ9Il9ibGFuayI+aHR0cDovL2xpc3RzLm92aXJ0Lm9yZy9tYWlsbWFuL2xp c3RpbmZvL3VzZXJzPC9hPjxicj48L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwvc3Bhbj48 L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwvZGl2Pg0KPC9kaXY+PC9kaXY+PC9ibG9ja3F1 b3RlPjwvZGl2Pjxicj48L2Rpdj4NCjwvZGl2PjwvYmxvY2txdW90ZT48L2Rpdj48YnI+PC9kaXY+ PC9kaXY+PC9kaXY+PC9ibG9ja3F1b3RlPjwvZGl2Pjxicj48L2Rpdj4NCjwvZGl2PjwvYmxvY2tx dW90ZT48L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJy PjwvZGl2Pg0KPC9kaXY+PC9ibG9ja3F1b3RlPjwvZGl2PjwvYm9keT48L2h0bWw+ --Apple-Mail-31476308-D6F5-4B3E-AE26-09A43CB9A8DD--
Hi Michal, I re-installed the OS and then oVirt on that node, with SELinux enabled, and that has resolved the issue. Thanks for your help. Cheers, Cam On Wed, May 25, 2016 at 7:24 PM, Michal Skrivanek <mskrivan@redhat.com> wrote:
On 25 May 2016, at 19:29, Cam Mac <iucounu@gmail.com> wrote:
Hi Michal,
Ran restorecon -r on '/' (and restarted vdsmd and other services): it is still getting selinux errors. I'd like to keep selinux running, especially as it is officially supported
Yeah. Hm, dunno why it didn't work, perhaps the config is not set up correctly. I thought redeploy would fix it but I don't really know the deployment code so maybe I'm wrong
(and works on the other node), so I guess the best option is to reinstall the OS and then install ovirt again perhaps.
That's the most easy way out, yes:)
Thanks, michal
Thanks,
Campbell
On Wed, May 25, 2016 at 6:15 PM, Michal Skrivanek <mskrivan@redhat.com> wrote:
On 25 May 2016, at 19:12, Cam Mac <iucounu@gmail.com> wrote:
I'll try that - presumably on the paths it is complaining about, and the qemu binarys?
It shouldn't hurt on /, it should only help:) And if it complains e.g. on attached nfs, the i suppose you need to run it there too
On Wed, May 25, 2016 at 4:59 PM, Michal Skrivanek < michal.skrivanek@redhat.com> wrote:
On 25 May 2016, at 17:35, Cam Mac <iucounu@gmail.com> wrote:
Hi Michal,
I chose the 'reinstall node' option from the GUI menu, which appeared to go ok, however, I still cannot create or migrate a VM on that node. I can see selinux 'denied' messages relating to qemu-kvm, e.g.:
type=AVC msg=audit(1464189232.136:251): avc: denied { read } for pid=4019 comm="qemu-kvm" name="650000ab-b33a-483a-af46-76f7305e2ae5" dev="sda2" ino=35401 scontext=system_ u:system_r:svirt_t:s0:c720,c927 tcontext=system_u:object_r:unlabeled_t:s0 tclass=lnk_file
There are a number of errors in the vdsm log but I assume that relates to selinux blocking it. So perhaps I need to remove all the ovirt packages manually, or perhaps re-install the OS as well? I guess either of those options involves complications with certificates and WWIDs for the attached SAN.
Or could I somehow generate selinux labels?
yeah, I think it didn’t happen. I though we do relabelling as part of deploy How about running "restorecon -r” now?
These nodes + engine are not yet production, though I'd prefer to fix than restart entirely from scratch.
Thanks for any help.
regards,
Campbell
On Wed, May 11, 2016 at 3:13 PM, Cam Mac <iucounu@gmail.com> wrote:
Ah, ok that makes sense. For the node, is it enough to use the 'reinstall node' option from the GUI, or is it better to reinstall the OS and then deploy it again?
Thanks,
Cam
On Wed, May 11, 2016 at 2:40 PM, Michal Skrivanek < michal.skrivanek@redhat.com> wrote:
On 11 May 2016, at 15:24, Cam Mac <iucounu@gmail.com> wrote:
Thanks Michal, if reinstalling the engine, (which also had SELinux disabled at install), would the best way be to backup the engine and then restore just the ovirt config?
for engine..well, VM security is not related to that, those are running on hypervisors, not the engine. So for any functionality/security it’s irrelevant what SELinux state it’s in I’m not sure if relabeling with restorecon is not enough (it sould work also on nodes, but as I said, it’s likely more safe to reinstall just to be really really sure:) Simone, am I right about the restorecon for engine?
Cheers,
Cam
On Wed, May 11, 2016 at 2:14 PM, Michal Skrivanek < michal.skrivanek@redhat.com> wrote:
> On 11 May 2016, at 15:02, Cam Mac <iucounu@gmail.com> wrote: > > Hi, > > In the oVirt guide, it says that "SELinux is being used by default on oVirt Node", but then goes on to say that if you have problems you should set it to permissive mode. I have had a few things fail due to being blocked by SELinux on a node I later enabled SELinux on, as it was off at install time. The other node which has had SELinux on from the start and so far has not had any oVirt operations blocked. I am guessing that the oVirt install process creates the necessary rules to allow vdsm to run under SELinux. So if you want to set SELinux to enforcing after installation, is there a script to do this, or is it better to just reinstall the node or engine, rather than trying to work out the individual exceptions?
For oVirt node it’s easier to reinstall it, it doesn’t persist much and it’s the easies way how to get the labelling right
Thanks, michal
> > Thanks, > > Cam > _______________________________________________ > Users mailing list > Users@ovirt.org > http://lists.ovirt.org/mailman/listinfo/users
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
participants (3)
-
Cam Mac -
Michal Skrivanek -
Michal Skrivanek