Use hugepages source type='memfd' to avoid hugetlbfs selinux issues

[crobinso]

Use of <hugepages> with libvirt by default uses hugetlbfs. This provokes some selinux violations with plain container_t, so virt_launcher_t needs to enable extra rules to account for this: https://github.com/kubevirt/kubevirt/blob/master/cmd/virt-handler/virt_launcher.cil

@berrange suggested Kubevirt can avoid these issues by using memfd instead of hugetlbfs. The libvirt XML is:

  <memoryBacking>
    <hugepages/>
    <source type='memfd'/>
  </memoryBacking>

At present this also requires <numa> configuration, the most basic is:

  <cpu>
    <numa>
      <cell cpus='0-$vcpus' memory='$memory'/>
    </numa>
  </cpu>

The numa requirement is a qemu limitation that is fixed in qemu 5.0.0 (see this commit but needs libvirt support before it can be used.

qemu-kvm in av-8.2 libvirt container has memfd support but not the older versions.

/kind enhancement

[rmohr]

Thanks @crobinso .

/assign @jean-edouard

[alicefr]

@crobinso @berrange do you know from which version libvirt started to support memfd as memory backing?

[berrange]

From 4.10.0 onwards - see https://libvirt.org/formatdomain.html#memory-backing

[crobinso]

@alicefr @berrange but the only qemu version build that supports memfd that kubevirt is 4.2.0-27.el8. any other build doesn't have support enabled yet. I'm not sure what kubevirt's test matrix is though so maybe that's not relevant

[alicefr]

@crobinso it is. Some of the tests in the CI are failing because memfd is not supported. I was looking at it with @vladikr and it seems that the testsuite is based on centos 7.

[crobinso]

@alicefr right I believe they use centos7 as the base OS but you'll want to specifically check the qemu package version installed there, because they are are all based on RHEL8 qemu content currently. The question is whether it's version 4.2.0-27 or something older

[alicefr]

@crobinso so, do you think that simply checking libvirtd version doesn't help? I was thinking to simply set memfd only if libvirtd is newer than 4.10.0

[crobinso]

@alicefr in practice for kubevirt it may be sufficient if libvirt 4.10 is always paired with a new enough qemu in their CI, I'm not sure. give it a spin and see if it works.

libvirt should be reporting this in its domcapabilities output though which is meant for reporting these types of features, but unfortunately that support is missing (and kubevirt isn't consuming domcapabilities yet anyways)