Bug 1369011

Summary: unable to start virt guest with selinux enabled
Product: [Fedora] Fedora Reporter: Jeff Layton <jlayton>
Component: selinux-policy-targetedAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED DUPLICATE QA Contact: Ben Levenson <benl>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 24CC: bex, dwalsh, jlayton, okozina
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-08-24 17:18:29 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Jeff Layton 2016-08-22 10:35:49 UTC 
I updated my f24 machine to selinux-policy-targeted-3.13.1-191.12.fc24.noarch last night and was unable to start KVM guests afterward:

$ virsh start rawhide
error: Failed to start domain rawhide
error: SELinux policy denies access.

Downgrading the selinux-policy* packages to 3.13.1-190.fc24 corrected the problem. I currently have:

# rpm -qa selinux-policy\*
selinux-policy-targeted-3.13.1-190.fc24.noarch
selinux-policy-3.13.1-190.fc24.noarch
selinux-policy-devel-3.13.1-190.fc24.noarch
selinux-policy-doc-3.13.1-190.fc24.noarch

...and all four packages were updated to the new version.
Comment 1 Jeff Layton 2016-08-22 10:51:26 UTC 
Erm, downgrading corrected that problem, but totally broke firewalld. Unfortunately, I don't get an AVC denial in the audit log here so I can't use audit2allow to enable this.
Comment 2 Miroslav Grepl 2016-08-22 16:12:41 UTC 
Could you search for user_avc?

re-test it and run

# ausearch -m user_avc -ts recent


Thank you.
Comment 3 Jeff Layton 2016-08-22 16:16:07 UTC 
$ sudo ausearch -m user_avc -ts recent
----
time->Mon Aug 22 12:15:25 2016
type=USER_AVC msg=audit(1471882525.271:937): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { start } for auid=n/a uid=0 gid=0 cmdline="/usr/lib/systemd/systemd-machined" scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=system  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
Comment 4 Brian Exelbierd 2016-08-24 11:35:57 UTC 
The line below from /var/log/audit/audit.log seems related as well.

type=VIRT_CONTROL msg=audit(1472038484.578:364): pid=1222 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm op=start reason=booted vm="test_default" uuid=8263c965-612a-49c9-8000-877e17ce48a6 vm-pid=-1 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=failed'
Comment 5 Daniel Walsh 2016-08-24 17:18:29 UTC 

*** This bug has been marked as a duplicate of bug 1368745 ***