Guest with Fedora or Centos will not shutdown

[Kei]

Hi all,
I've noticed that I cannot gracefully power off any of my Centos 7 or Fedora 28 vm's with "right click -> Shutdown" from the WEB UI. If I do this, it's like I havent done anything and the VM just stays up. I've installed the Qemu drivers with "yum install qemu-guest-agent" and I've enable the flag for "Qemu Agent = Yes". Ubuntu and Debian VM's dont have any issue. I'm running PVE 4.4

Thanks for the help!

 

[janos]

Hello,

When Qemu Agent enabled in PVE, it try to shutdown VM via the agent (when not enabled, it send ACPI event).

Please check if your communication beetwen your node and VM via the agent working well with

qm agent <vmid> ping

command.

 

[Kei]

Hi Janos, I tried your test and it responded with an empty prompt, no error or no message whatsoever. Does it mean the communication is ok?

 

[janos]

Hi Janos, I tried your test and it responded with an empty prompt, no error or no message whatsoever. Does it mean the communication is ok?

Hi,

Yes, this is the expected result.

https://pve.proxmox.com/wiki/Qemu-g...communication_with_the_guest_agent_is_working

In this case, please check your syslogs inside the VM qemu-agent will log if it received the shutdown command, and what it doing, or not doing.

 

[Kei]

Hi Janos, I've looked at journalctl and indeed I got this message:

qemu-ga[481]: info: guest-shutdown called, mode: (null)
audit[483]: USER_AVC pid=483 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.fre>
                                                      exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
audit[483]: USER_AVC pid=483 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.fre>
                                                      exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'

At this point I belive there is some misconfiguration on the VM side, right?

 

[Kei]

Ok, I belive this is due to Selinux... I will need to understand how to configure it properly to enable shutdown on the guest.

 

[janos]

What kind of CentOS is this? What is the version?

 

[Kei]

What kind of CentOS is this? What is the version?

This is Fedora 28 actually, but I recall when I used Centos7, to have the same exact issue.

 

[janos]

Sorry dude, i don't have any idea, im not using selinux. Maybe you can add the required permission using selinux tools to this app.

 

[ikogan]

It is indeed an SELinux issue, the following policy solved this for me:

module fedora_proxmox 1.0;

require {
    type virt_qemu_ga_t;
    type systemd_logind_t;
    class dbus { send_msg };
}

allow virt_qemu_ga_t systemd_logind_t:dbus send_msg;
allow systemd_logind_t virt_qemu_ga_t:dbus send_msg;

I noticed that on Fedora, qemu agent is also unable to read the network configuration, adding a type of `proc_net_t`, the class `file { read open }`, and the policy `allow virt_qemu_ga_t proc_net_t:file { read open };` solved that as well.

 

[mueslo]

It is indeed an SELinux issue, the following policy solved this for me:

module fedora_proxmox 1.0;

require {
    type virt_qemu_ga_t;
    type systemd_logind_t;
    class dbus { send_msg };
}

allow virt_qemu_ga_t systemd_logind_t:dbus send_msg;
allow systemd_logind_t virt_qemu_ga_t:dbus send_msg;

I noticed that on Fedora, qemu agent is also unable to read the network configuration, adding a type of `proc_net_t`, the class `file { read open }`, and the policy `allow virt_qemu_ga_t proc_net_t:file { read open };` solved that as well.

For other people that have no idea what to do with this, it seems the following is necessary:

1. yum install policycoreutils-devel
2. save above module definition as fedora_proxmox.te
3. run make -f /usr/share/selinux/devel/Makefile fedora_proxmox.pp to compile the module
4. load module using semodule -i fedora_proxmox.pp, it will be automatically reloaded after reboots