| Summary: | SELinux is preventing /usr/bin/qemu-system-x86_64 from 'getattr' accesses on the netlink_kobject_uevent_socket . | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Cole Robinson <crobinso> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 19 | CC: | dominick.grift, dwalsh, lvrabec, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:6a529d7bb86be4f66d04f64c0697157df1b6800715c24ce1f928273deccb744f | ||
| Fixed In Version: | selinux-policy-3.12.1-74.2.fc19 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-09-12 01:53:24 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
934c35ef00c83636b40ecf385c5dc05a31367118 fixes this in git. Please back port virt.te to F19 Has been added. selinux-policy-3.12.1-74.2.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-74.2.fc19 Package selinux-policy-3.12.1-74.2.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-74.2.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-16231/selinux-policy-3.12.1-74.2.fc19 then log in and leave karma (feedback). selinux-policy-3.12.1-74.2.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: I'm using rawhide qemu 1.6 on F19. Warning comes from starting a VM with an assigned host USB device. Also see warnings about create, setopt, and bind on the same socket. Probably due to qemu's recent switch to using libusb for the host bits. SELinux is preventing /usr/bin/qemu-system-x86_64 from 'getattr' accesses on the netlink_kobject_uevent_socket . ***** Plugin catchall (100. confidence) suggests *************************** If you believe that qemu-system-x86_64 should be allowed getattr access on the netlink_kobject_uevent_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep qemu-system-x86 /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:svirt_t:s0:c144,c227 Target Context system_u:system_r:svirt_t:s0:c144,c227 Target Objects [ netlink_kobject_uevent_socket ] Source qemu-system-x86 Source Path /usr/bin/qemu-system-x86_64 Port <Unknown> Host (removed) Source RPM Packages qemu-system-x86-1.6.0-1.fc19.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-73.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 3.10.7-200.fc19.x86_64 #1 SMP Thu Aug 15 23:19:45 UTC 2013 x86_64 x86_64 Alert Count 1 First Seen 2013-08-31 13:34:03 EDT Last Seen 2013-08-31 13:34:03 EDT Local ID d5040eb2-9ab9-426d-be97-502fe0d4deb8 Raw Audit Messages type=AVC msg=audit(1377970443.799:2749): avc: denied { getattr } for pid=4673 comm="qemu-system-x86" scontext=system_u:system_r:svirt_t:s0:c144,c227 tcontext=system_u:system_r:svirt_t:s0:c144,c227 tclass=netlink_kobject_uevent_socket type=SYSCALL msg=audit(1377970443.799:2749): arch=x86_64 syscall=getsockname success=yes exit=0 a0=19 a1=7fffa8209970 a2=7fffa820996c a3=7fffa8208910 items=0 ppid=1 pid=4673 auid=4294967295 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 ses=4294967295 tty=(none) comm=qemu-system-x86 exe=/usr/bin/qemu-system-x86_64 subj=system_u:system_r:svirt_t:s0:c144,c227 key=(null) Hash: qemu-system-x86,svirt_t,svirt_t,netlink_kobject_uevent_socket,getattr Additional info: reporter: libreport-2.1.6 hashmarkername: setroubleshoot kernel: 3.10.7-200.fc19.x86_64 type: libreport