vm fails to be define virsh by the user who is member of group configured in qemu.conf
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| libvirt (Ubuntu) |
New
|
Undecided
|
Unassigned | ||
Bug Description
In the containers environment virsh define run from the host fails. libvirt runs in the ubuntu container and is exposing /var/lib/libvrti as well as as /var/run to the host, so libvirtd sockets are visible on the host.
libvirt run user nova group nova. User root has been added in libvirtd container into nova group. SO it should have permissions to define vm even when it runs from the host with virs command.
2017-03-26 18:16:07.076840 | + sudo virsh define /home/jenkins/
2017-03-26 18:16:07.232451 | error: Failed to define domain from /home/jenkins/
2017-03-26 18:16:07.232540 | error: internal error: QEMU / QMP failed: 2017-03-26 18:16:07.130+0000: 4815: debug : virFileClose:102 : Closed fd 30
2017-03-26 18:16:07.232570 | 2017-03-26 18:16:07.130+0000: 4815: debug : virFileClose:102 : Closed fd 32
2017-03-26 18:16:07.232608 | 2017-03-26 18:16:07.130+0000: 4815: debug : virFileClose:102 : Closed fd 26
2017-03-26 18:16:07.232649 | 2017-03-26 18:16:07.130+0000: 4815: debug : virExec:736 : Setting child uid:gid to 42436:42436 with caps 0
2017-03-26 18:16:07.232686 | qemu-system-x86_64: could not acquire pid file: Permission denied
Ubuntu 16.04
qemu-system-x86 (1:2.5+
libvirt0:amd64 (1.3.1-1ubuntu10.8)
Attached in the libvirtd.log collected from the libvirtd container.
| Serguei Bezverkhi (sbezverk) wrote | #1 |
| Christian Ehrhardt (paelzer) wrote | #2 |
| Changed in libvirt (Ubuntu): | |
| status: | New → Incomplete |
| Serguei Bezverkhi (sbezverk) wrote | #3 |
| Serguei Bezverkhi (sbezverk) wrote | #4 |
| Changed in libvirt (Ubuntu): | |
| status: | Incomplete → New |
Hi Serguei,
I thank you for your report, but must admit you lost me at the description.
Trying to understand your setup
1. you are running virsh define in a containter but from a host, do you mean like this?
$ lxc exec <containername> -- virsh define <guestname.xml>
2. You are exposing /var/lib/libvirt and /var/run to the host - Don't you usually expose from the Host to the Container. Could you provide the setup you used to do so, like the lxc profile or whatever applies?
3. in your container that runs libvirt, you added UID of root to the group of NOVA?
I guess depending on your answer to #2 a lot of my assumptions might be totally wrong, so please help to clarify those.
4.
From the error I think what happens is that your case is that the libvirt (wherever it is) can't reach qemu for the capability checks on the define. I think there is no need to run a full define to trigger this, could you also report what the following reports in your case (I'd assume it aborts as well):
$ virth capabilities
5.
And if that fails I don't yet see so much why/where this is about user/group permissions except invoking qemu-system-x86_64 but that is done by lobvirts user. The libvirt config might help to understand. Could you attach the config files that are reported (on your container?) when running:
$ sudo dpkg --verify libvirt-bin