libvirt users - Jan 2014 - Re: libvirt on armhf with selinux driver

hi,

recently i've been busy with libvirt(d) v1.2.0 on armhf and i see, even
if selinux sec driver is enabled on the configure stage, the driver is
not finally created. these configure parameters are:

--with-selinux
--with-secdriver-selinux
--with-selinux-mount=/sys/fs/selinux

the /sys/fs/selinux is valid, selinux is running in permissive mode, got
also libselinux DEV package installed, so no missing req. headers here.

when trying to run libvirtd, i'm getting:

error : virSecurityDriverLookup:78 : unsupported configuration: Security
driver selinux not enabled
error : lxcSecurityInit:1461 : Failed to initialise security drivers
error : virStateInitialize:854 : Initialisation of LXC state driver
failed: unsupported configuration: Security driver selinux not enabled
error : daemonRunStateInit:909 : Driver state initialisation failed

someone got any clue what may be causing this?

thanks,
ivan gooten

On Mon, Jan 13, 2014 at 04:10:35PM +0100, Ivan Gooten
wrote:
> hi,
> 
> recently i've been busy with libvirt(d) v1.2.0 on armhf and i see, even
> if selinux sec driver is enabled on the configure stage, the driver is
> not finally created. these configure parameters are:
> 
> --with-selinux
> --with-secdriver-selinux
> --with-selinux-mount=/sys/fs/selinux
> 
> the /sys/fs/selinux is valid, selinux is running in permissive mode, got
> also libselinux DEV package installed, so no missing req. headers here.
> 
> when trying to run libvirtd, i'm getting:
> 
> error : virSecurityDriverLookup:78 : unsupported configuration: Security
> driver selinux not enabled
> error : lxcSecurityInit:1461 : Failed to initialise security drivers
> error : virStateInitialize:854 : Initialisation of LXC state driver
> failed: unsupported configuration: Security driver selinux not enabled
> error : daemonRunStateInit:909 : Driver state initialisation failed
> 
> someone got any clue what may be causing this?
This likely means that 'configure' failed to detect selinux support.
Look for any messages it prints in this regard. At the end, it will
summarize whether it succesfully found it or not.

Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|

On 13.01.2014 16:10, Ivan Gooten wrote:
> hi,
> 
> recently i've been busy with libvirt(d) v1.2.0 on armhf and i see, even
> if selinux sec driver is enabled on the configure stage, the driver is
> not finally created. these configure parameters are:
> 
> --with-selinux
> --with-secdriver-selinux
> --with-selinux-mount=/sys/fs/selinux
> 
> the /sys/fs/selinux is valid, selinux is running in permissive mode, got
> also libselinux DEV package installed, so no missing req. headers here.
> 
> when trying to run libvirtd, i'm getting:
> 
> error : virSecurityDriverLookup:78 : unsupported configuration: Security
> driver selinux not enabled
> error : lxcSecurityInit:1461 : Failed to initialise security drivers
> error : virStateInitialize:854 : Initialisation of LXC state driver
> failed: unsupported configuration: Security driver selinux not enabled
> error : daemonRunStateInit:909 : Driver state initialisation failed
> 
> someone got any clue what may be causing this?
> 
> thanks,
> ivan gooten
> 
Are you sure selinux is enabled? Not enforcing, just enabled.

Michal

On 01/13/2014 04:50 PM, Michal Privoznik wrote:
> On 13.01.2014 16:10, Ivan Gooten wrote:
>> hi,
>>
>> recently i've been busy with libvirt(d) v1.2.0 on armhf and i see,
even
>> if selinux sec driver is enabled on the configure stage, the driver is
>> not finally created. these configure parameters are:
>>
>> --with-selinux
>> --with-secdriver-selinux
>> --with-selinux-mount=/sys/fs/selinux
>>
>> the /sys/fs/selinux is valid, selinux is running in permissive mode,
got
>> also libselinux DEV package installed, so no missing req. headers here.
>>
>> when trying to run libvirtd, i'm getting:
>>
>> error : virSecurityDriverLookup:78 : unsupported configuration:
Security
>> driver selinux not enabled
>> error : lxcSecurityInit:1461 : Failed to initialise security drivers
>> error : virStateInitialize:854 : Initialisation of LXC state driver
>> failed: unsupported configuration: Security driver selinux not enabled
>> error : daemonRunStateInit:909 : Driver state initialisation failed
>>
>> someone got any clue what may be causing this?
>>
>> thanks,
>> ivan gooten
>>
> Are you sure selinux is enabled? Not enforcing, just enabled.
>
> Michal
>
hi,

thank Michal and Daniel for your answers.

so here i provide the configure summary:
http://pastebin.com/un0UnFCP

for me it looks okay, and below is is the sestatus:

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             default
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28

this is custom kernel 3.10 with debian testing a.k.a. jessie.
also, my friend with the same configuration on rpi, except for his newer
kernel, is having same stranginess.

ivan