Bug 1379314

Summary: virt-manager can't use unix_stream_socket with confined users (staff_t)
Product: [Fedora] Fedora Reporter: Jakub Jelen <jjelen>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: 24CC: dominick.grift, dwalsh, lvrabec, mgrepl, plautrba
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: selinux-policy-3.13.1-191.20.fc24 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-11-10 03:30:19 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jakub Jelen 2016-09-26 10:58:09 UTC
Description of problem:
$ sudo ausearch -m AVC -ts 11:51
----
time->Mon Sep 26 12:41:02 2016
type=AVC msg=audit(1474886462.682:349): avc:  denied  { getopt } for  pid=2789 comm="virt-manager" scontext=staff_u:staff_r:staff_t:s0 tcontext=system_u:system_r:svirt_t:s0:c605,c735 tclass=unix_stream_socket permissive=1
----
time->Mon Sep 26 12:41:02 2016
type=AVC msg=audit(1474886462.682:350): avc:  denied  { setopt } for  pid=2789 comm="virt-manager" scontext=staff_u:staff_r:staff_t:s0 tcontext=system_u:system_r:svirt_t:s0:c605,c735 tclass=unix_stream_socket permissive=1
$ sudo ausearch -m AVC -ts 12:48
----
time->Mon Sep 26 12:49:52 2016
type=AVC msg=audit(1474886992.643:417): avc:  denied  { read write } for  pid=2789 comm="virt-manager" path="socket:[62284]" dev="sockfs" ino=62284 scontext=staff_u:staff_r:staff_t:s0 tcontext=system_u:system_r:svirt_t:s0:c605,c735 tclass=unix_stream_socket permissive=0
----


Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-191.16.fc24.noarch
selinux-policy-3.13.1-191.17.fc24.noarch

How reproducible:
deterministic

Steps to Reproduce:
1. Use confined users (staff_t)
2. Run Virtual Machine Manager
3. Open Graphical console of running machine

Actual results:
Error on GUI letting it fail and disconnect from backend and the error in the logs:
libvirtd[1545]: End of file while reading data: Input/output error


Expected results:
Open graphical console.

Additional info:
Can be fixed using:

$ cat my_virt.cil
(allow staff_t svirt_t (unix_stream_socket (getopt setopt read write)))

Comment 1 Fedora Update System 2016-11-04 12:12:30 UTC
selinux-policy-3.13.1-191.20.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-7ce27629b3

Comment 2 Fedora Update System 2016-11-05 03:36:49 UTC
selinux-policy-3.13.1-191.20.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-7ce27629b3

Comment 3 Fedora Update System 2016-11-10 03:30:19 UTC
selinux-policy-3.13.1-191.20.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.