Libguestfs - Mar 2018 - Re: virt-v2v 1.38 fails to convert .vmx VM: setfiles ... Multiple same specifications for /.*.

> -----Original Message-----
> From: Richard W.M. Jones [mailto:rjones@redhat.com]
> Sent: Tuesday, March 6, 2018 11:49 AM
> To: Зиновик Игорь Анатольевич <ZinovikIA@nspk.ru>
> Cc: libguestfs@redhat.com
> Subject: Re: [Libguestfs] virt-v2v 1.38 fails to convert .vmx VM: setfiles
...
> Multiple same specifications for /.*.
>
> On Tue, Mar 06, 2018 at 08:40:51AM +0000, Зиновик Игорь Анатольевич
> wrote:
> > > What happens if you run these commands (which should be safe to
run
> > > because they only operate on a throw-away overlay):
> > >
> > >   qemu-img create -f qcow2 throwaway.qcow2
> > > /mnt/knp1-vm-otp02/knp1-vm- otp02.vmdk
>
> I missed out the -b flag:
>
>   qemu-img create -f qcow2 throwaway.qcow2 -b /mnt/knp1-vm-otp02/knp1-
> vm-otp02.vmdk
>
> anyway ...
>
> > setfiles: /sysroot/etc/selinux/targeted/contexts/files/file_contexts:
Multiple
> same specifications for /.*.
> > /sysroot/etc/selinux/targeted/contexts/files/file_contexts: Invalid
> > argument
> > guestfsd: error: Can't stat exclude path
"/sysroot/selinux", No such file or
> directory - ignoring.
> > setfiles: /sysroot/etc/selinux/targeted/contexts/files/file_contexts:
Multiple
> same specifications for /.*.
> > /sysroot/etc/selinux/targeted/contexts/files/file_contexts: Invalid
> > argument
> > libguestfs: trace: selinux_relabel = -1 (error)
>
> I have policycoreutils-2.7-14.fc29.x86_64 but I wasn't able to
reproduce this
> using:
>
>   virt-builder rhel-7.4
>   virt-customize -a rhel-7.4.img --selinux-relabel
>
> Can you send me the /etc/selinux/targeted/contexts/files/file_contexts
> file from within the guest?
See attached file.
Настоящее сообщение, направленное по электронной почте, и любые вложения - это
корреспонденция, содержащая информацию, доступ к которой ограничен в
соответствии с законодательством Российской Федерации и которая предназначена
только для использования уполномоченными АО «НСПК» получателями сообщения
(уполномоченными лицами). Если Вы не являетесь уполномоченным лицом или Вам не
известно, являетесь ли Вы таким уполномоченным получателем сообщения от АО
«НСПК», то уведомляем, что любое раскрытие, распространение или копирование
этого сообщения влечет за собой установленную законом ответственность. Если Вы
не являетесь уполномоченным получателем сообщения, просим Вас незамедлительно
информировать об этом отправителя и удалить полученное сообщение из системы.
This e-mail message together with any attachments hereto contains confidential
information and is intended for recipients authorized by NSPK only. Any
disclosure, distribution or copying of this message entails liability
established by law. If you are not an authorized recipient, please immediately
inform the sender and delete this message from your information system.

On Tue, Mar 06, 2018 at 09:31:33AM +0000, Зиновик Игорь Анатольевич
wrote:
> > Multiple same specifications for /.*.
...
> > > setfiles:
/sysroot/etc/selinux/targeted/contexts/files/file_contexts: Multiple
> > same specifications for /.*.
My idea for reproducing this was:

(1) Download your file_contexts file.

(2) virt-builder fedora-27 \
        --upload
file_contexts:/etc/selinux/targeted/contexts/files/file_contexts \
        --selinux-relabel


However I wasn't able to reproduce it (with
policycoreutils-2.7-15.fc29.x86_64).  Also I don't see multiple ‘/.*’
lines in the file_contexts file.

So I don't know.

But it's still my opinion that it is a bug in policycoreutils.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
Fedora Windows cross-compiler. Compile Windows programs, test, and
build Windows installers. Over 100 libraries supported.
http://fedoraproject.org/wiki/MinGW

On Mon, Mar 19, 2018 at 02:21:24PM +0000, Зиновик Игорь Анатольевич
wrote:
> > -----Original Message-----
> > From: Richard W.M. Jones [mailto:rjones@redhat.com]
> > Sent: Monday, March 19, 2018 3:27 PM
> > To: Зиновик Игорь Анатольевич <ZinovikIA@nspk.ru>
> > Cc: libguestfs@redhat.com
> > Subject: Re: [Libguestfs] virt-v2v 1.38 fails to convert .vmx VM:
setfiles ...
> > Multiple same specifications for /.*.
> >
> > On Tue, Mar 06, 2018 at 09:31:33AM +0000, Зиновик Игорь Анатольевич
> > wrote:
> > > > Multiple same specifications for /.*.
> > ...
> > > > > setfiles:
> > > > >
/sysroot/etc/selinux/targeted/contexts/files/file_contexts:
> > > > > Multiple
> > > > same specifications for /.*.
> >
> > My idea for reproducing this was:
> >
> > (1) Download your file_contexts file.
> >
> > (2) virt-builder fedora-27 \
> >         --upload
file_contexts:/etc/selinux/targeted/contexts/files/file_contexts \
> >         --selinux-relabel
> >
> >
> > However I wasn't able to reproduce it (with
policycoreutils-2.7-15.fc29.x86_64).
> > Also I don't see multiple ‘/.*’
> > lines in the file_contexts file.
> >
> > So I don't know.
> >
> > But it's still my opinion that it is a bug in policycoreutils.
> 
> Thanks for investigation, Richard. Is it somehow possible to disable
`setfiles' invocation
> during virt-v2v conversion run? E.g. via environment variable?
You can do --no-selinux-relabel, but that disables relabelling
completely, which may mean that your VM won't boot.

Have you tried making edits to the file_contexts file to work
out exactly which part setfiles is complaining about?  That may
give some clues about a better workaround.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.
http://libguestfs.org/virt-v2v

С уважением,
Зиновик Игорь |  ДИТ | вн. 1569 |

> -----Original Message-----
> From: Richard W.M. Jones [mailto:rjones@redhat.com]
> Sent: Monday, March 19, 2018 5:42 PM
> To: Зиновик Игорь Анатольевич <ZinovikIA@nspk.ru>
> Cc: libguestfs@redhat.com
> Subject: Re: [Libguestfs] virt-v2v 1.38 fails to convert .vmx VM: setfiles
...
> Multiple same specifications for /.*.
>
> On Mon, Mar 19, 2018 at 02:21:24PM +0000, Зиновик Игорь Анатольевич
> wrote:
> > > -----Original Message-----
> > > From: Richard W.M. Jones [mailto:rjones@redhat.com]
> > > Sent: Monday, March 19, 2018 3:27 PM
> > > To: Зиновик Игорь Анатольевич <ZinovikIA@nspk.ru>
> > > Cc: libguestfs@redhat.com
> > > Subject: Re: [Libguestfs] virt-v2v 1.38 fails to convert .vmx VM:
setfiles ...
> > > Multiple same specifications for /.*.
> > >
> > > On Tue, Mar 06, 2018 at 09:31:33AM +0000, Зиновик Игорь
Анатольевич
> > > wrote:
> > > > > Multiple same specifications for /.*.
> > > ...
> > > > > > setfiles:
> > > > > >
/sysroot/etc/selinux/targeted/contexts/files/file_contexts:
> > > > > > Multiple
> > > > > same specifications for /.*.
> > >
> > > My idea for reproducing this was:
> > >
> > > (1) Download your file_contexts file.
> > >
> > > (2) virt-builder fedora-27 \
> > >         --upload
> file_contexts:/etc/selinux/targeted/contexts/files/file_contexts \
> > >         --selinux-relabel
> > >
> > >
> > > However I wasn't able to reproduce it (with
policycoreutils-2.7-
> 15.fc29.x86_64).
> > > Also I don't see multiple ‘/.*’
> > > lines in the file_contexts file.
> > >
> > > So I don't know.
> > >
> > > But it's still my opinion that it is a bug in
policycoreutils.
> >
> > Thanks for investigation, Richard. Is it somehow possible to disable
> > `setfiles' invocation during virt-v2v conversion run? E.g. via
environment
> variable?
>
> You can do --no-selinux-relabel, but that disables relabelling completely,
which
> may mean that your VM won't boot.
My virt-v2v does not recognize --no-selinux-relabel option.
> Have you tried making edits to the file_contexts file to work out exactly
which
> part setfiles is complaining about?  That may give some clues about a
better
> workaround.
I found the root cause - some of my CentOS 7.3 VMs has
/etc/selinux/targeted/contexts/files/file_contexts.pre (leftover?) which mimics
/etc/selinux/targeted/contexts/files/file_contexts:
$ sudo LIBGUESTFS_BACKEND=direct guestfish --ro -a vm-lbmgr01.vmdk -i head
/etc/selinux/targeted/contexts/files/file_contexts.pre
/.*     system_u:object_r:default_t:s0
/[^/]+  --      system_u:object_r:etc_runtime_t:s0
/a?quota\.(user|group)  --      system_u:object_r:quota_db_t:s0
/nsr(/.*)?      system_u:object_r:var_t:s0
/sys(/.*)?      system_u:object_r:sysfs_t:s0
/xen(/.*)?      system_u:object_r:xen_image_t:s0

$ sudo LIBGUESTFS_BACKEND=direct guestfish --ro -a vm-lbmgr01.vmdk -i head
/etc/selinux/targeted/contexts/files/file_contexts
/.*     system_u:object_r:default_t:s0
/[^/]+  --      system_u:object_r:etc_runtime_t:s0
/a?quota\.(user|group)  --      system_u:object_r:quota_db_t:s0
/nsr(/.*)?      system_u:object_r:var_t:s0
/sys(/.*)?      system_u:object_r:sysfs_t:s0
/xen(/.*)?      system_u:object_r:xen_image_t:s0

I moved file to file_contexts.pre to /root directory and successfully managed to
convert guest. rpm tool says that this does not belong to
any package. Maybe it is some kind of leftover after upgrade (7.2->7.3), just
an assumption from top of my head.
Настоящее сообщение, направленное по электронной почте, и любые вложения - это
корреспонденция, содержащая информацию, доступ к которой ограничен в
соответствии с законодательством Российской Федерации и которая предназначена
только для использования уполномоченными АО «НСПК» получателями сообщения
(уполномоченными лицами). Если Вы не являетесь уполномоченным лицом или Вам не
известно, являетесь ли Вы таким уполномоченным получателем сообщения от АО
«НСПК», то уведомляем, что любое раскрытие, распространение или копирование
этого сообщения влечет за собой установленную законом ответственность. Если Вы
не являетесь уполномоченным получателем сообщения, просим Вас незамедлительно
информировать об этом отправителя и удалить полученное сообщение из системы.
This e-mail message together with any attachments hereto contains confidential
information and is intended for recipients authorized by NSPK only. Any
disclosure, distribution or copying of this message entails liability
established by law. If you are not an authorized recipient, please immediately
inform the sender and delete this message from your information system.