[Users] ovirt VM start fails - Perm Denied error

[Dan Kenigsberg]

On Wed, Feb 15, 2012 at 12:13:39PM +0530, Deepak C Shetty wrote:
> On 02/14/2012 02:55 PM, Dan Kenigsberg wrote:
> >On Tue, Feb 14, 2012 at 10:36:39AM +0530, Deepak C Shetty wrote:
> >>On 02/13/2012 03:16 PM, Dan Kenigsberg wrote:
> >>>On Sun, Feb 12, 2012 at 11:58:05PM +0530, Deepak C Shetty wrote:
> >>>>Hi,
> >>>>    I have tried this multiple times and i hit the same error.
> >>>>
> >>>>I have 3 storage domains  created (iso, data and export) all
> >>>>connected to the DC with DC status as Up and
> >>>>1 host with status as Up and the same (only) host acting as SPM.
> >>>>
> >>>>I used the engine-iso-uploader utility to upload my .iso to the iso domain.
> >>>>Created a new VM and attached a vdisk of type sparse (thin-prov) and
> >>>>click on "Run Once",
> >>>>where i select "Attach CD" and select my .iso, and change boot order
> >>>>to boot from CD, then disk.
> >>>>
> >>>>But i get this error...
> >>>>
> >>>>VM first-ovirt-vm is down. Exit message internal error process
> >>>>exited while connecting to monitor: qemu-kvm: -drive file=/rhev/data-center/4087fea7-b54a-4318-8d5c-828eff8846f4/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso,if=none,media=cdrom,id=drive-ide0-1-0,readonly=on,format=raw:
> >>>>could not open disk image /rhev/data-center/4087fea7-b54a-4318-8d5c-828eff8846f4/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso:
> >>>>Permission denied .
> >>>>
> >>>>I am unable to figure out why.. bcos the user.group perms for the
> >>>>.iso are fine.
> >>>>In fact i logged into the system serving the nfs share and added 0777 perms
> >>>>still i get the same error. Here is the snip of how the perms for
> >>>>.iso look like...
> >>>>
> >>>>ll /tmp/iso1-domain/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso
> >>>>-rwxr-xr-x. 1 vdsm kvm 3757047808 Feb 13 04:24 /tmp/iso1-domain/35f880f8-bd0c-4063-b171-2ddaa59e1212/images/11111111-1111-1111-1111-111111111111/Fedora-16-x86_64-DVD.iso
> >>>would you try `ls -lZ` ? Does your /var/log/audit/audit.log shows an
> >>>selinux problem? What's `getenforce`? And `getsebool virt_use_nfs`?
> >>Hi Dan,
> >>     Thanks for the hint, after setting virt_use_nfs, it worked for me.
> >>Strangely VDSM should have set it, not sure why it didn't.
> >I suppose this is related to the fact that your `semanage` hangs. Please
> >help us understand why.
> >
> Hello Dan,
>     This is what strace dumped, when i attached to the semanage process.
> Note that i am only pasting the last few lines.. as the dump was large...
> Let me know if you need to entire dump...

I'd better know if strace seems to be advancing anywhere. Is there a
blocking system call? For how long did you wait? (I guess I should have
asked for `strace -t`)


> 
> write(6, "/usr/share/system-config-netboot"..., 89) = 89
> write(6, "/usr/share/system-config-soundca"..., 89) = 89
> write(6, "/usr/share/system-config-kdump/s"..., 103) = 103
> write(6, "/usr/share/system-config-selinux"..., 104) = 104
> write(6, "/usr/share/system-config-rootpas"..., 95) = 95
> write(6, "/usr/share/system-config-securit"..., 101) = 101
> write(6, "/usr/share/system-config-service"..., 109) = 109
> read(5, "", 4096)                       = 0
> close(5)                                = 0
> munmap(0x7f8291b3d000, 4096)            = 0
> close(6)                                = 0
> close(7)                                = 0
> open("/etc/selinux/targeted/modules/tmp/seusers.final",
> O_WRONLY|O_CREAT|O_TRUNC, 0600) = 5
> write(5, "system_u:system_u:s0-s0:c0.c1023"..., 106) = 106
> close(5)                                = 0
> open("/etc/selinux/targeted/modules/tmp/users_extra",
> O_WRONLY|O_CREAT|O_TRUNC, 0600) = 5
> write(5, "user user_u prefix user;\nuser st"..., 101) = 101
> close(5)                                = 0
> open("/etc/selinux/targeted/modules/tmp/netfilter_contexts",
> O_WRONLY|O_CREAT|O_TRUNC, 0600) = 5
> write(5, "", 0)                         = 0
> close(5)                                = 0
> 
> 
>