Bug 1359927

Summary:	SELinux is preventing vboxdrv.sh from 'open' accesses on the file /etc/udev/rules.d/60-vboxdrv.rules.
Product:	[Fedora] Fedora	Reporter:	mrummuka <mrummuka>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	24	CC:	alfedoraso, awrhodes9723, devin, dominick.grift, dwalsh, iv.istvan.varga, joelesalas, lvrabec, mgrepl, plautrba, raffaellobertini
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Unspecified
Whiteboard:	abrt_hash:0b601b4a27aad2fd83abfe469d8a6a1f904d3398d71a036f7b8280aa969b1180;VARIANT_ID=workstation;
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-08-30 12:12:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description mrummuka 2016-07-25 19:44:39 UTC

Description of problem:
Installation of VirtualBox 5.1 / installing kernel module with
/sbin/vboxconfig
after completing all the steps from https://forums.virtualbox.org/viewtopic.php?f=7&t=77363&start=15#p361135
SELinux is preventing vboxdrv.sh from 'open' accesses on the file /etc/udev/rules.d/60-vboxdrv.rules.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that vboxdrv.sh should be allowed open access on the 60-vboxdrv.rules file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'vboxdrv.sh' --raw | audit2allow -M my-vboxdrvsh
# semodule -X 300 -i my-vboxdrvsh.pp

Additional Information:
Source Context                system_u:system_r:init_t:s0
Target Context                unconfined_u:object_r:udev_rules_t:s0
Target Objects                /etc/udev/rules.d/60-vboxdrv.rules [ file ]
Source                        vboxdrv.sh
Source Path                   vboxdrv.sh
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-191.5.fc24.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.6.4-301.fc24.x86_64 #1 SMP Tue
                              Jul 12 11:50:00 UTC 2016 x86_64 x86_64
Alert Count                   2
First Seen                    2016-07-25 22:39:00 EEST
Last Seen                     2016-07-25 22:39:00 EEST
Local ID                      157e467e-ea41-4886-aa21-259d844641bf

Raw Audit Messages
type=AVC msg=audit(1469475540.950:289): avc:  denied  { open } for  pid=13417 comm="vboxdrv.sh" path="/etc/udev/rules.d/60-vboxdrv.rules" dev="dm-1" ino=414773 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:udev_rules_t:s0 tclass=file permissive=0


Hash: vboxdrv.sh,init_t,udev_rules_t,file,open

Version-Release number of selected component:
selinux-policy-3.13.1-191.5.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.6.4-301.fc24.x86_64
type:           libreport

Comment 1 István Varga 2016-07-26 06:33:19 UTC

*** Bug 1360153 has been marked as a duplicate of this bug. ***

Comment 2 Alex Rhodes 2016-08-04 19:47:50 UTC

Description of problem:
I downloaded virtualbox from Oracle's website and installed via gnome software center. 
After opening it, I set up an arch vm and tried to run it. SELinux threw an error preventing virtual box from reading or 
writing a config file. 
SELinux gave a workaround that I followed:
# ausearch -c 'vboxdrv.sh' --raw | audit2allow -M my-vboxdrvsh
# semodule -X 300 -i my-vboxdrvsh.pp
However it fails everytime I try it (as root) and I cannot get virtualbox to reconfigure the file.

Version-Release number of selected component:
selinux-policy-3.13.1-191.8.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.6.4-301.fc24.x86_64
type:           libreport

Comment 3 Joel Salas 2016-08-11 19:38:53 UTC

Description of problem:
Attempted to install VirtualBox 5.1 from the Oracle yum repositories. The driver/module setup seems to trigger this SELinux problem.

Version-Release number of selected component:
selinux-policy-3.13.1-191.8.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.6.5-300.fc24.x86_64
type:           libreport

Comment 4 Joel Salas 2016-08-11 19:40:41 UTC

(In reply to Alex Rhodes from comment #2)
> Description of problem:
> I downloaded virtualbox from Oracle's website and installed via gnome
> software center. 
> After opening it, I set up an arch vm and tried to run it. SELinux threw an
> error preventing virtual box from reading or 
> writing a config file. 
> SELinux gave a workaround that I followed:
> # ausearch -c 'vboxdrv.sh' --raw | audit2allow -M my-vboxdrvsh
> # semodule -X 300 -i my-vboxdrvsh.pp
> However it fails everytime I try it (as root) and I cannot get virtualbox to
> reconfigure the file.
> 
> Version-Release number of selected component:
> selinux-policy-3.13.1-191.8.fc24.noarch
> 
> Additional info:
> reporter:       libreport-2.7.2
> hashmarkername: setroubleshoot
> kernel:         4.6.4-301.fc24.x86_64
> type:           libreport

Try `dnf remove -y VirtualBox-5.1` then set SELinux to permissive with `setenforce 0`. Now reinstall with `dnf install -y path/to/rpm` and it'll create the file.

Comment 5 xavier 2016-08-11 20:26:32 UTC

Description of problem:
I can't run one S.O. in VirtualBox when I run a S.O. SELinux stop it

Version-Release number of selected component:
selinux-policy-3.13.1-191.8.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.5.5-300.fc24.x86_64
type:           libreport

Comment 6 Raffaello Bertini 2016-08-27 15:52:49 UTC

Description of problem:
the rpm package should set up the required policy for vboxdrv.sh

Version-Release number of selected component:
selinux-policy-3.13.1-191.13.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.6.7-300.fc24.x86_64
type:           libreport

Comment 7 Raffaello Bertini 2016-08-29 19:08:20 UTC

Description of problem:
/sbin/vbconfigure

Version-Release number of selected component:
selinux-policy-3.13.1-191.13.fc24.noarch

Additional info:
reporter:       libreport-2.7.2
hashmarkername: setroubleshoot
kernel:         4.6.7-300.fc24.x86_64
type:           libreport

Comment 8 Lukas Vrabec 2016-08-30 12:12:09 UTC


*** This bug has been marked as a duplicate of bug 1358950 ***