Attachment 852993 Details for Bug 1046598 – sealert analyses result

sealert analyses result

sealert-analyse-result (text/plain), 2.45 KB, created by Xuesong Zhang on 2014-01-21 07:00:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Xuesong Zhang

Created: 2014-01-21 07:00:09 UTC

Size: 2.45 KB

patch

obsolete

>SELinux is preventing /usr/libexec/qemu-kvm from 'read, write' accesses on the chr_file 2.
>
>*****  Plugin device (91.4 confidence) suggests   ****************************
>
>If you want to allow qemu-kvm to have read write access on the 2 chr_file
>Then you need to change the label on 2 to a type of a similar device.
>Do
># semanage fcontext -a -t SIMILAR_TYPE '2'
># restorecon -v '2'
>
>*****  Plugin catchall (9.59 confidence) suggests   **************************
>
>If you believe that qemu-kvm should be allowed read write access on the 2 chr_file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep qemu-kvm /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:svirt_t:s0:c489,c878
>Target Context                system_u:object_r:device_t:s0
>Target Objects                2 [ chr_file ]
>Source                        qemu-kvm
>Source Path                   /usr/libexec/qemu-kvm
>Port                          <Unknown>
>Host                          xuzhangtest2
>Source RPM Packages           qemu-kvm-rhev-1.5.3-38.el7.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.12.1-118.el7.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Enforcing
>Host Name                     xuzhangtest2
>Platform                      Linux xuzhangtest2 3.10.0-73.el7.x86_64 #1 SMP Thu
>                              Jan 16 14:24:39 EST 2014 x86_64 x86_64
>Alert Count                   1
>First Seen                    2014-01-21 14:46:43 CST
>Last Seen                     2014-01-21 14:46:43 CST
>Local ID                      dfbc1052-fc6f-4c1f-af00-dc9760fe5272
>
>Raw Audit Messages
>type=AVC msg=audit(1390286803.4:1233): avc:  denied  { read write } for  pid=26105 comm="qemu-kvm" name="2" dev="devtmpfs" ino=67428 scontext=system_u:system_r:svirt_t:s0:c489,c878 tcontext=system_u:object_r:device_t:s0 tclass=chr_file
>
>
>type=SYSCALL msg=audit(1390286803.4:1233): arch=x86_64 syscall=open success=no exit=EACCES a0=7fffad2c3480 a1=80002 a2=0 a3=0 items=0 ppid=1 pid=26105 auid=4294967295 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=4294967295 comm=qemu-kvm exe=/usr/libexec/qemu-kvm subj=system_u:system_r:svirt_t:s0:c489,c878 key=(null)
>
>Hash: qemu-kvm,svirt_t,device_t,chr_file,read,write

Actions: View

Attachments on bug 1046598: 852993 | 853824 | 853825 | 853826 | 854209 | 854210