Bug 1161217
| Summary: | missing selinux policy to allow syscall connectto for svirt_t | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Pavel Hrdina <phrdina> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.1 | CC: | dyuan, honzhang, jiahu, lvrabec, mgrepl, mmalik, mprivozn, plautrba, pvrabec |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.13.1-8.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-03-05 10:46:44 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
(In reply to Pavel Hrdina from comment #0) > Description of problem: > Libvirt can create network connection between two guests using > unix_stream_socket but it is denied by selinux. Please add: > > allow svirt_t svirt_t : unix_stream_socket { connectto } ; > This will only allow one VM connect to another. But VMs can be configured to connect to something different, e.g. a tcp console. That would imply allowing svirt_t to connect to any other type. But saying that aloud looks like too wide policy, right? commit 6a877f34ad53909a89b7780b28e584b159e894a2
Author: Miroslav Grepl <mgrepl>
Date: Thu Nov 6 18:32:05 2014 +0100
- Allow guest to connect to libvirt using unix_stream_socket.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0458.html |
Description of problem: Libvirt can create network connection between two guests using unix_stream_socket but it is denied by selinux. Please add: allow svirt_t svirt_t : unix_stream_socket { connectto } ; Version-Release number of selected component (if applicable): selinux-policy-3.13.1-7.el7.noarch