Red Hat SummitQuesto contenuto non è disponibile nella lingua selezionata.
B.12. Guest is Unable to Start with Error: warning: could not open /dev/net/tun
- Symptom
- The guest virtual machine does not start after configuring a
type='ethernet'(also known as 'generic ethernet') interface in the host system. An error appears either inlibvirtd.log,/var/log/libvirt/qemu/name_of_guest.log, or in both, similar to the below message:warning: could not open /dev/net/tun: no virtual network emulation qemu-kvm: -netdev tap,script=/etc/my-qemu-ifup,id=hostnet0: Device 'tap' could not be initialized
- Investigation
- Use of the generic ethernet interface type (
<interface type='ethernet'>) is discouraged, because using it requires lowering the level of host protection against potential security flaws in QEMU and its guests. However, it is sometimes necessary to use this type of interface to take advantage of some other facility that is not yet supported directly in libvirt. For example, openvswitch was not supported in libvirt until libvirt-0.9.11, so in older versions of libvirt,<interface type='ethernet'>was the only way to connect a guest to an openvswitch bridge.However, if you configure a<interface type='ethernet'>interface without making any other changes to the host system, the guest virtual machine will not start successfully.The reason for this failure is that for this type of interface, a script called by QEMU needs to manipulate the tap device. However, withtype='ethernet'configured, in an attempt to lock down QEMU, libvirt and SELinux have put in place several checks to prevent this. (Normally, libvirt performs all of the tap device creation and manipulation, and passes an open file descriptor for the tap device to QEMU.) - Solution
- Reconfigure the host system to be compatible with the generic ethernet interface.
Procedure B.4. Reconfiguring the host system to use the generic ethernet interface
- Set SELinux to permissive by configuring
SELINUX=permissivein/etc/selinux/config:# This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=permissive # SELINUXTYPE= can take one of these two values: # targeted - Targeted processes are protected, # mls - Multi Level Security protection. SELINUXTYPE=targeted
- From a root shell, run the command
setenforce permissive. - In
/etc/libvirt/qemu.confadd or edit the following lines:clear_emulator_capabilities = 0
user = "root"
group = "root"
cgroup_device_acl = [ "/dev/null", "/dev/full", "/dev/zero", "/dev/random", "/dev/urandom", "/dev/ptmx", "/dev/kvm", "/dev/kqemu", "/dev/rtc", "/dev/hpet", "/dev/net/tun", - Restart
libvirtd.
Important
Since each of these steps significantly decreases the host's security protections against QEMU guest domains, this configuration should only be used if there is no alternative to using<interface type='ethernet'>.
Note
For more information on SELinux, refer to the Red Hat Enterprise Linux 6 Security-Enhanced Linux User Guide.
