[Users] ovirt VM start fails - Perm Denied error

[Douglas Landgraf]

On 02/13/2012 08:57 AM, Keith Robertson wrote:
> On 02/13/2012 08:33 AM, Deepak C Shetty wrote:
>> On 02/13/2012 03:16 PM, Dan Kenigsberg wrote:
>>> On Sun, Feb 12, 2012 at 11:58:05PM +0530, Deepak C Shetty wrote:
>>>> Hi,
>>>>     I have tried this multiple times and i hit the same error.
>>>>
>>>> I have 3 storage domains  created (iso, data and export) all
>>>> connected to the DC with DC status as Up and
>>>> 1 host with status as Up and the same (only) host acting as SPM.
>>>>
>>>> I used the engine-iso-uploader utility to upload my .iso to the iso 
>>>> domain.
>>>> Created a new VM and attached a vdisk of type sparse (thin-prov) and
>>>> click on "Run Once",
>>>> where i select "Attach CD" and select my .iso, and change boot order
>>>> to boot from CD, then disk.
>>>>
>>>> But i get this error...
>>>>
>>>> VM first-ovirt-vm is down. Exit message internal error process
>>>> exited while connecting to monitor: qemu-kvm: -drive 
>>>> file=/rhev/data-center/4087fea7-b54a-4318-8d5c-828eff8846f4/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso,if=none,media=cdrom,id=drive-ide0-1-0,readonly=on,format=raw:
>>>> could not open disk image 
>>>> /rhev/data-center/4087fea7-b54a-4318-8d5c-828eff8846f4/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso:
>>>> Permission denied .
>>>>
>>>> I am unable to figure out why.. bcos the user.group perms for the
>>>> .iso are fine.
>>>> In fact i logged into the system serving the nfs share and added 
>>>> 0777 perms
>>>> still i get the same error. Here is the snip of how the perms for
>>>> .iso look like...
>>>>
>>>> ll 
>>>> /tmp/iso1-domain/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso
>>>> -rwxr-xr-x. 1 vdsm kvm 3757047808 Feb 13 04:24 
>>>> /tmp/iso1-domain/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso
>>> would you try `ls -lZ` ? Does your /var/log/audit/audit.log shows an
>>> selinux problem? What's `getenforce`? And `getsebool virt_use_nfs`?
>>>
>>> What is `groups qemu`?
>>> Does
>>>     su - qemu -s /bin/bash -c 'strings your.iso'
>>> work for you?
>>>
>>> Regards,
>>> Dan.
>>>
>>>
>>
>> Hello Dan,
>>     Here is the output you requested...
>>
>> [root at llm56 ~]# ls -lZ 
>> /rhev/data-center/4087fea7-b54a-4318-8d5c-828eff8846f4/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso
>> -rwxr-xr-x. vdsm kvm system_u:object_r:nfs_t:s0       
>> /rhev/data-center/4087fea7-b54a-4318-8d5c-828eff8846f4/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso
>>
>> [root at llm56 ~]# getenforce
>> Enforcing
>>
>> [root at llm56 ~]# getsebool virt_use_nfs
>> virt_use_nfs --> off
>>
>> [root at llm56 ~]# groups qemu
>> qemu : qemu kvm
>>
>> Also `su - qemu -s /bin/bash -c 'strings your.iso'`
>>
>> worked for me.. dumped loads of strings on the screen.
>>
>> _______________________________________________
>> Users mailing list
>> Users at ovirt.org
>> http://lists.ovirt.org/mailman/listinfo/users
> Perhaps I missed that snippet of logs, but is llm56 the hyper-visor?
>
> Also, here is another litmus test to help shake out some common NFS 
> issues.  Do the following from the hyper-visor:
> 1. temporarily give user vdsm in /etc/passwd a login shell (e.g. 
> /bin/bash)
> 2. mkdir /mnt/testmount
> 3. mount <nfs server here>:/path/to/iso/storage/domain /mnt/testmount
> 4. su - vdsm <-- Really important.
> 5. cd 
> 35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111
> 6. touch test.txt
> 7. strings Fedora-16-x86_64-DVD.iso
> 8. reset vdsm in /etc/passwd to nologin
>
> Do 6 and 7 work?
>
> Cheers,
> Keith
>
>
Here another suggestion, a tool, nfs-check:

http://gerrit.ovirt.org/gitweb?p=vdsm.git;a=blob_plain;f=contrib/nfs-check.py;h=1b763c66e053eae2c273048879aa98e634b04d7f;hb=578cfe90239d5c3f6f11f1fc063c148606e991dc

-- 
Cheers
Douglas