search for: sys_resourc

...t loader didn't return any data!") error: Failed to start domain vm03 /var/log/messages got filled with the following messages: stem_r:xenstored_t:s0 tcontext=system_u:system_r:xenstored_t:s0 tclass=capability Feb 29 10:36:59 gimbli kernel: audit(1204274218.949:2139): avc: denied { sys_resource } for pid=2445 comm="xenstored" capability=24 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:system_r:xenstored_t:s0 tclass=capability Feb 29 10:36:59 gimbli kernel: audit(1204274218.949:2140): avc: denied { sys_resource } for pid=2445 comm="xenstored" capab...

...t; error: Failed to start domain vm03 > > > > /var/log/messages got filled with the following messages: > > stem_r:xenstored_t:s0 tcontext=system_u:system_r:xenstored_t:s0 > tclass=capability > Feb 29 10:36:59 gimbli kernel: audit(1204274218.949:2139): avc: > denied { sys_resource } for pid=2445 comm="xenstored" capability=24 > scontext=system_u:system_r:xenstored_t:s0 > tcontext=system_u:system_r:xenstored_t:s0 tclass=capability > Feb 29 10:36:59 gimbli kernel: audit(1204274218.949:2140): avc: > denied { sys_resource } for pid=2445 comm="x...

...t; error: Failed to start domain vm03 > > > > /var/log/messages got filled with the following messages: > > stem_r:xenstored_t:s0 tcontext=system_u:system_r:xenstored_t:s0 > tclass=capability > Feb 29 10:36:59 gimbli kernel: audit(1204274218.949:2139): avc: > denied { sys_resource } for pid=2445 comm="xenstored" capability=24 > scontext=system_u:system_r:xenstored_t:s0 > tcontext=system_u:system_r:xenstored_t:s0 tclass=capability > Feb 29 10:36:59 gimbli kernel: audit(1204274218.949:2140): avc: > denied { sys_resource } for pid=2445 comm="x...

...d to manage qemu VMs represented as Kubernetes API resources. In this case, libvirtd is running inside an unprivileged pod, with some host mounts / capabilities added to the pod, needed by libvirtd and other services. One of the capabilities libvirtd requires for successful startup inside a pod is SYS_RESOURCE. This capability is used to adjust RLIMIT_MEMLOCK ulimit value depending on devices attached to the managed guest, both on startup and during hotplug. AFAIU the need to lock the memory is to avoid pages being pushed out from RAM into swap. In KubeVirt world, several libvirtd assumptions do not ap...

...I resources. In this case, libvirtd is running inside an > > unprivileged pod, with some host mounts / capabilities added to the > > pod, needed by libvirtd and other services. > > > > One of the capabilities libvirtd requires for successful startup > > inside a pod is SYS_RESOURCE. This capability is used to adjust > > RLIMIT_MEMLOCK ulimit value depending on devices attached to the > > managed guest, both on startup and during hotplug. AFAIU the need to > > lock the memory is to avoid pages being pushed out from RAM into swap. > > Libvirt shouldn...

...> > > > > > > /var/log/messages got filled with the following messages: > > > > stem_r:xenstored_t:s0 tcontext=system_u:system_r:xenstored_t:s0 > > tclass=capability > > Feb 29 10:36:59 gimbli kernel: audit(1204274218.949:2139): avc: > > denied { sys_resource } for pid=2445 comm="xenstored" capability=24 > > scontext=system_u:system_r:xenstored_t:s0 > > tcontext=system_u:system_r:xenstored_t:s0 tclass=capability > > Feb 29 10:36:59 gimbli kernel: audit(1204274218.949:2140): avc: > > denied { sys_resource } for pid=...

...1.7; require { type bin_t; type devpts_t; type httpd_t; type passenger_t; type port_t; type proc_net_t; class process { getattr siginh setexec sigchld noatsecure transition rlimitinh }; class unix_stream_socket { getattr accept read write }; class capability { sys_resource sys_ptrace }; class file { entrypoint open create relabelfrom relabelto getattr setattr read write append ioctl lock rename link unlink }; class lnk_file { getattr read }; class udp_socket name_bind; class dir { getattr setattr add_name remove_name search open read write ioctl lock...

...unning inside an > >>> unprivileged pod, with some host mounts / capabilities added to the > >>> pod, needed by libvirtd and other services. > >>> > >>> One of the capabilities libvirtd requires for successful startup > >>> inside a pod is SYS_RESOURCE. This capability is used to adjust > >>> RLIMIT_MEMLOCK ulimit value depending on devices attached to the > >>> managed guest, both on startup and during hotplug. AFAIU the need to > >>> lock the memory is to avoid pages being pushed out from RAM into swap. >...

...this case, libvirtd is running inside an >>> unprivileged pod, with some host mounts / capabilities added to the >>> pod, needed by libvirtd and other services. >>> >>> One of the capabilities libvirtd requires for successful startup >>> inside a pod is SYS_RESOURCE. This capability is used to adjust >>> RLIMIT_MEMLOCK ulimit value depending on devices attached to the >>> managed guest, both on startup and during hotplug. AFAIU the need to >>> lock the memory is to avoid pages being pushed out from RAM into swap. I recall successf...

...t; unprivileged pod, with some host mounts / capabilities added to the > >>>>> pod, needed by libvirtd and other services. > >>>>> > >>>>> One of the capabilities libvirtd requires for successful startup > >>>>> inside a pod is SYS_RESOURCE. This capability is used to adjust > >>>>> RLIMIT_MEMLOCK ulimit value depending on devices attached to the > >>>>> managed guest, both on startup and during hotplug. AFAIU the need to > >>>>> lock the memory is to avoid pages being pushed out...

...n >>>>> unprivileged pod, with some host mounts / capabilities added to the >>>>> pod, needed by libvirtd and other services. >>>>> >>>>> One of the capabilities libvirtd requires for successful startup >>>>> inside a pod is SYS_RESOURCE. This capability is used to adjust >>>>> RLIMIT_MEMLOCK ulimit value depending on devices attached to the >>>>> managed guest, both on startup and during hotplug. AFAIU the need to >>>>> lock the memory is to avoid pages being pushed out from RAM into s...

..._write', 'secure_mode_insmod', 'kernel_modules', 'samba_export_all_ro', 'httpd_enable_ftp_server', 'allow_postfix_local_write_mail_spool', 'execute', 'privoxy_connect_any', 'use_nfs_home_dirs', 'allow_smbd_anon_write', 'sys_resource', 'allow_ftpd_use_cifs', 'connect_ports', 'swapfile', 'httpd_use_nfs', 'httpd_can_network_relay', 'allow_cvs_read_shadow', 'squid_connect_any', 'mounton', 'qemu_blk_image', 'user_tcp_server', 'restore_source_co...

...ed as Kubernetes > API resources. In this case, libvirtd is running inside an > unprivileged pod, with some host mounts / capabilities added to the > pod, needed by libvirtd and other services. > > One of the capabilities libvirtd requires for successful startup > inside a pod is SYS_RESOURCE. This capability is used to adjust > RLIMIT_MEMLOCK ulimit value depending on devices attached to the > managed guest, both on startup and during hotplug. AFAIU the need to > lock the memory is to avoid pages being pushed out from RAM into swap. Libvirt shouldn't set RLIMIT_MEMLOCK b...

...ax.com/scripts read only = No -------------------- /etc/hosts 127.0.0.1 localhost 192.168.2.3 compumaxdc03.thecompumax.com compumaxdc03 -------------------- /etc/apparmor.d/usr/sbin.named capability net_bind_service, capability setgid, capability setuid, capability sys_chroot, capability sys_resource, /etc/bind/** r, /var/lib/bind/** rw, /var/lib/bind/ rw, /var/cache/bind/** lrw, /var/cache/bind/ rw, # Database file used by allow-new-zones /var/cache/bind/_default.nzd-lock rwk, # gssapi /etc/krb5.keytab kr, /etc/bind/krb5.keytab kr, # gssapi /var/lib/sss/pubconf/krb...

> > > > *named.conf.options* > > > > options { > > > > directory "/var/cache/bind"; > > > > > > > > // If there is a firewall between you and nameservers you want > > > > // to talk to, you may need to fix the firewall to allow > > multiple > > > > // ports to talk.