[Users] ovirt VM start fails - Perm Denied error

[Keith Robertson]

On 02/13/2012 08:33 AM, Deepak C Shetty wrote:
> On 02/13/2012 03:16 PM, Dan Kenigsberg wrote:
>> On Sun, Feb 12, 2012 at 11:58:05PM +0530, Deepak C Shetty wrote:
>>> Hi,
>>>     I have tried this multiple times and i hit the same error.
>>>
>>> I have 3 storage domains  created (iso, data and export) all
>>> connected to the DC with DC status as Up and
>>> 1 host with status as Up and the same (only) host acting as SPM.
>>>
>>> I used the engine-iso-uploader utility to upload my .iso to the iso 
>>> domain.
>>> Created a new VM and attached a vdisk of type sparse (thin-prov) and
>>> click on "Run Once",
>>> where i select "Attach CD" and select my .iso, and change boot order
>>> to boot from CD, then disk.
>>>
>>> But i get this error...
>>>
>>> VM first-ovirt-vm is down. Exit message internal error process
>>> exited while connecting to monitor: qemu-kvm: -drive 
>>> file=/rhev/data-center/4087fea7-b54a-4318-8d5c-828eff8846f4/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso,if=none,media=cdrom,id=drive-ide0-1-0,readonly=on,format=raw:
>>> could not open disk image 
>>> /rhev/data-center/4087fea7-b54a-4318-8d5c-828eff8846f4/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso:
>>> Permission denied .
>>>
>>> I am unable to figure out why.. bcos the user.group perms for the
>>> .iso are fine.
>>> In fact i logged into the system serving the nfs share and added 
>>> 0777 perms
>>> still i get the same error. Here is the snip of how the perms for
>>> .iso look like...
>>>
>>> ll 
>>> /tmp/iso1-domain/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso
>>> -rwxr-xr-x. 1 vdsm kvm 3757047808 Feb 13 04:24 
>>> /tmp/iso1-domain/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso
>> would you try `ls -lZ` ? Does your /var/log/audit/audit.log shows an
>> selinux problem? What's `getenforce`? And `getsebool virt_use_nfs`?
>>
>> What is `groups qemu`?
>> Does
>>     su - qemu -s /bin/bash -c 'strings your.iso'
>> work for you?
>>
>> Regards,
>> Dan.
>>
>>
>
> Hello Dan,
>     Here is the output you requested...
>
> [root at llm56 ~]# ls -lZ 
> /rhev/data-center/4087fea7-b54a-4318-8d5c-828eff8846f4/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso
> -rwxr-xr-x. vdsm kvm system_u:object_r:nfs_t:s0       
> /rhev/data-center/4087fea7-b54a-4318-8d5c-828eff8846f4/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso
>
> [root at llm56 ~]# getenforce
> Enforcing
>
> [root at llm56 ~]# getsebool virt_use_nfs
> virt_use_nfs --> off
>
> [root at llm56 ~]# groups qemu
> qemu : qemu kvm
>
> Also `su - qemu -s /bin/bash -c 'strings your.iso'`
>
> worked for me.. dumped loads of strings on the screen.
>
> _______________________________________________
> Users mailing list
> Users at ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
Perhaps I missed that snippet of logs, but is llm56 the hyper-visor?

Also, here is another litmus test to help shake out some common NFS 
issues.  Do the following from the hyper-visor:
1. temporarily give user vdsm in /etc/passwd a login shell (e.g. /bin/bash)
2. mkdir /mnt/testmount
3. mount <nfs server here>:/path/to/iso/storage/domain /mnt/testmount
4. su - vdsm <-- Really important.
5. cd 
35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111
6. touch test.txt
7. strings Fedora-16-x86_64-DVD.iso
8. reset vdsm in /etc/passwd to nologin

Do 6 and 7 work?

Cheers,
Keith