Attachment 838380 Details for Bug 1044561 – selinux denial

selinux denial

selinux-denial (text/plain), 3.00 KB, created by Josh Boyer on 2013-12-18 14:53:55 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Josh Boyer

Created: 2013-12-18 14:53:55 UTC

Size: 3.00 KB

patch

obsolete

>SELinux is preventing /usr/bin/qemu-system-x86_64 from using the dac_override capability.
>
>*****  Plugin dac_override (91.4 confidence) suggests   **********************
>
>If you want to help identify if domain needs this access or you have a file with the wrong permissions on your system
>Then turn on full auditing to get path information about the offending file and generate the error again.
>Do
>
>Turn on full auditing
># auditctl -w /etc/shadow -p w
>Try to recreate AVC. Then execute
># ausearch -m avc -ts recent
>If you see PATH record check ownership/permissions on file, and fix it, 
>otherwise report as a bugzilla.
>
>*****  Plugin catchall (9.59 confidence) suggests   **************************
>
>If you believe that qemu-system-x86_64 should have the dac_override capability by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep qemu-system-x86 /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:svirt_t:s0:c495,c631
>Target Context                system_u:system_r:svirt_t:s0:c495,c631
>Target Objects                 [ capability ]
>Source                        qemu-system-x86
>Source Path                   /usr/bin/qemu-system-x86_64
>Port                          <Unknown>
>Host                          vader
>Source RPM Packages           qemu-system-x86-1.6.1-2.fc20.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.12.1-106.fc20.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Enforcing
>Host Name                     vader
>Platform                      Linux vader 3.13.0-0.rc4.git0.1.fc21.x86_64 #1 SMP
>                              Mon Dec 16 08:36:23 EST 2013 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-12-18 09:25:56 EST
>Last Seen                     2013-12-18 09:25:56 EST
>Local ID                      0e9195eb-06e0-4163-91d4-293b1f4e6cbb
>
>Raw Audit Messages
>type=AVC msg=audit(1387376756.658:112): avc:  denied  { dac_override } for  pid=2196 comm="qemu-system-x86" capability=1  scontext=system_u:system_r:svirt_t:s0:c495,c631 tcontext=system_u:system_r:svirt_t:s0:c495,c631 tclass=capability
>
>
>type=AVC msg=audit(1387376756.658:112): avc:  denied  { dac_read_search } for  pid=2196 comm="qemu-system-x86" capability=2  scontext=system_u:system_r:svirt_t:s0:c495,c631 tcontext=system_u:system_r:svirt_t:s0:c495,c631 tclass=capability
>
>
>type=SYSCALL msg=audit(1387376756.658:112): arch=x86_64 syscall=bind success=no exit=EACCES a0=7 a1=7fff24cfcaf0 a2=6e a3=44 items=0 ppid=1 pid=2196 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=qemu-system-x86 exe=/usr/bin/qemu-system-x86_64 subj=system_u:system_r:svirt_t:s0:c495,c631 key=(null)
>
>Hash: qemu-system-x86,svirt_t,svirt_t,capability,dac_override

Actions: View

Attachments on bug 1044561: 838380 | 838381 | 838383 | 838384 | 838386 | 838387 | 838389