由於kvm所在的機器啓用了SELINUX,後來將之關閉,關閉之後,發現kvm的虛擬機無法啓動
現象
虛擬機無法啓動
報錯信息
啓動過程中的報錯信息如下:
[root@ESRoller ~]# virsh start zabbix error: Failed to start domain zabbix error: unsupported configuration: Unable to find security driver for label selinux libvirt中的日誌也提示報錯: [root@ESRoller ~]# tail -f /var/log/libvirt/libvirtd.log 2016-06-20 09:54:41.724+0000: 2388: error : qemuRemoveCgroup:754 : internal error Unable to find cgroup for zabbix 2016-06-20 09:54:41.724+0000: 2388: warning : qemuProcessStop:4403 : Failed to remove cgroup for zabbix 2016-06-20 09:54:41.725+0000: 2388: error : qemuAutostartDomain:284 : Failed to autostart VM 'zabbix': unsupported configuration: Unable to find security driver for label selinux 2016-06-20 09:54:41.734+0000: 2388: error : virSecurityManagerGenLabel:376 : unsupported configuration: Unable to find security driver for label selinux 2016-06-20 09:54:41.741+0000: 2388: error : qemuRemoveCgroup:754 : internal error Unable to find cgroup for roller 2016-06-20 09:54:41.741+0000: 2388: warning : qemuProcessStop:4403 : Failed to remove cgroup for roller 2016-06-20 09:54:41.742+0000: 2388: error : qemuAutostartDomain:284 : Failed to autostart VM 'roller': unsupported configuration: Unable to find security driver for label selinux 2016-06-20 09:59:07.548+0000: 2378: error : virSecurityManagerGenLabel:376 : unsupported configuration: Unable to find security driver for label selinux 2016-06-20 09:59:07.561+0000: 2378: error : qemuRemoveCgroup:754 : internal error Unable to find cgroup for zabbix
造成原因
由於機器開機狀態時,將SElinux的狀態信息save在虛擬機中,導致SElinux關閉之後,虛擬找不到對應的label,從而導致vm啓動失敗。
解決方法
virsh edit domain_name查看虛擬機的配置文件中,是否有selinux標籤的相關設置,如果有,則將其刪除,再啓動vm。如果沒有,則可能已經保存在vm狀態中,將原有的狀態刪除即可(對應路徑/var/lib/libvirt/qemu/save),如下:
[root@ESRoller ~]# virsh managedsave-remove zabbix Removed managedsave image for domain zabbix [root@ESRoller ~]# virsh start zabbix Domain zabbix started [root@ESRoller ~]# virsh list Id Name State ---------------------------------------------------- 4 zabbix running
如果配置配置文件中有selinux相關的配置,將其刪除,期配置類似於:
<seclabel type='dynamic' model='selinux' relabel='yes'> <label>system_u:system_r:svirt_t:s0:c625,c859</label> <imagelabel>system_u:object_r:svirt_image_t:s0:c625,c859</imagelabel> </seclabel>