Bug 1415975
| Summary: | SELinux is preventing qemu-system-x86 from 'search' accesses on the directory 2857. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Joachim Frieben <jfrieben> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 26 | CC: | 2284577490, acc-bugz-redhat, adam, adrianosoxav, akurtako, albertoortega2002, alciregi, alexandrefournier2008, alexdws101, amaurygodoy30, angiolucci, atoakadebug, bedny, chmelarz, chrissharp123, davidaquites, david, deanhunter, dominick.grift, doug.hs, drlamb, dwalsh, fedora, fran, goodmirek, grazianemileo, horsenounaway, hx, jan.public, jan.vesely, jniederm, kristian.frantti, ld, luan.cestari, luya, lvrabec, mail, matthias.eliasson, mcatanzaro, me, mgrepl, petr.malik, pickeringw, plautrba, pmoore, prd-fedora, recker.chris, redhat, renich, rhbugzilla, sanjay.ankur, sheepdestroyer, siddhartha.ghosh.in, ssekidde, thelints, tn, ToFabricio_90, tpypta |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:068c10f78e3c23c919a52ff97cf1fe924a60ef6e60abf4b3abd3726e9f3ca9d5;VARIANT_ID=workstation; | ||
| Fixed In Version: | selinux-policy-3.13.1-260.14.fc26 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-11-15 20:12:21 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
This bug appears to have been reported against 'rawhide' during the Fedora 26 development cycle. Changing version to '26'. Description of problem: Was trying to install an F26 alpha VM using boxes. Version-Release number of selected component: selinux-policy-3.13.1-251.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.0-0.rc8.git0.1.fc26.x86_64 type: libreport Joachim, Do you know when this happened? Thanks, Lukas. (In reply to Lukas Vrabec from comment #3) This alert occurs typically when launching or after shutting a virtual machine in gnome-boxes. Description of problem: running boxes Version-Release number of selected component: selinux-policy-3.13.1-259.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.8-300.fc26.x86_64 type: libreport Description of problem: running existing gnome-boxes VM Version-Release number of selected component: selinux-policy-3.13.1-259.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.8-300.fc26.x86_64 type: libreport Description of problem: Running Fedora Rawhide inside Gnome Boxes Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.9-20170605.amdmainhyb.fc26.x86_64 type: libreport Description of problem: I shutdown a Windows 10 VM running in Gnome Boxes. Version-Release number of selected component: selinux-policy-3.13.1-259.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.8-300.fc26.x86_64 type: libreport Description of problem: On virtual machine shutdown. It runs on QEMU/KVM User session using a disk image on an external drive (virt_use_fusefs is on) The directory number is always different. Version-Release number of selected component: selinux-policy-3.13.1-259.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.8-300.fc26.x86_64 type: libreport (In reply to Alexandre Fournier from comment #9) > Description of problem: > On virtual machine shutdown. > It runs on QEMU/KVM User session using a disk image on an external drive > (virt_use_fusefs is on) > The directory number is always different. > > Version-Release number of selected component: > selinux-policy-3.13.1-259.fc26.noarch > > Additional info: > reporter: libreport-2.9.1 > hashmarkername: setroubleshoot > kernel: 4.11.8-300.fc26.x86_64 > type: libreport I forgot to add, I use virt-manager so it's not specific to gnome-boxes. Description of problem: Starting virtual machine in gnome-boxes Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.9-200.fc25.x86_64 type: libreport Description of problem: I closed GNOME Boxes after creating and using a virtualized system. As soon as I closed it, the alert appeared. Version-Release number of selected component: selinux-policy-3.13.1-259.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.9-300.fc26.x86_64 type: libreport Description of problem: After closing a virtual machine in GNOME Boxes, but this time it gave a different directory name "26404". Version-Release number of selected component: selinux-policy-3.13.1-259.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.9-300.fc26.x86_64 type: libreport Description of problem: powered off a virtual machine with gnome-boxes Version-Release number of selected component: selinux-policy-3.13.1-260.1.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.10-300.fc26.x86_64 type: libreport Description of problem: I shut down a VM via virt-manager. Version-Release number of selected component: selinux-policy-3.13.1-260.1.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.10-300.fc26.x86_64 type: libreport Description of problem: el error salió cuando cerré una máquina virtual del programa cajas. Version-Release number of selected component: selinux-policy-3.13.1-260.1.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.10-300.fc26.x86_64 type: libreport Description of problem: I was opening gnome-boxes Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: Open main overview of gnome-boxes. Version-Release number of selected component: selinux-policy-3.13.1-260.1.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: It happened after shutting down a virtual machine and returning to main overview of gnome-boxes. Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: Using Boxes to run two centos 7 machines. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: I guess this alert was because I tried to delete a VM via GNOME Boxes. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: I was trying to use gnome-boxes to virtualize an ArchLinux ISO. The ISO file is located at /home/renich/Downloads/. Boxes finds them there automatically. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: Shutdown a boxes VM Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: Cuando apago una máquina virtual. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: I shut down a VM in Virt Manager. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: Got this SELinux warning when running GNOME Boxes. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: Deleted a VM (which was in the process of booking F26 Workstation Live ISO) in Boxes. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: I am trying to open Gnome-boxes and always is closed when is called to start. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport *** Bug 1479033 has been marked as a duplicate of this bug. *** Description of problem: I started a Boxes VM. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: Running a VM in virt-manager and clicking "refresh" button in OS information tab in VM dialog. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: When I using box installing Badstore iso ... Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: Did a "poweroff" in the VM Version-Release number of selected component: selinux-policy-3.13.1-260.4.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.5-300.fc26.x86_64 type: libreport Description of problem: running boxes Version-Release number of selected component: selinux-policy-3.13.1-260.4.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.5-300.fc26.x86_64 type: libreport Description of problem: running cockpit-project/cockpit tests Version-Release number of selected component: selinux-policy-3.13.1-260.4.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.5-300.fc26.x86_64 type: libreport Description of problem: A running VM was suddenly closed, not sure what caused it, I was closing firefox inside that VM with ALT+F4 key. Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport Description of problem: Running guest os Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.9-300.fc26.x86_64 type: libreport Description of problem: This issue happens when I shut down my Windows 10 VM that's running in Boxes. Version-Release number of selected component: selinux-policy-3.13.1-260.6.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.9-300.fc26.x86_64 type: libreport Description of problem: While running 'virt-filesystems -a ~/Downloads/xxx.qcow2' Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.9-300.fc26.x86_64 type: libreport Description of problem: SELinux alert when closing Gnome Boxes on Fedora Cinnamon Spin Version-Release number of selected component: selinux-policy-3.13.1-260.8.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.9-300.fc26.x86_64 type: libreport Description of problem: I shutdown a win7 virtual machine in gnome-boxes Version-Release number of selected component: selinux-policy-3.13.1-260.8.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.9-300.fc26.x86_64 type: libreport Note: Looks like these directories are subdirs of /proc, which means they represent PIDs and that would be the reason users report different ones. I confirm I hit this one when shutting down a libvirt domain. It was a Windows 10 VM, and it happened when using virt-manager the last time. It happened two times before though, and it's very likely I might have been using virsh -- so I don't think it's related to any frontend either. Description of problem: Not sure, when this exactly appeared, but I have downloaded Windows 10 N .iso and installed it in Gnome boxes (slow install without licence key). Than I have installe Firefox Nightly, run it, and than suspended the whole VM. Version-Release number of selected component: selinux-policy-3.13.1-260.8.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.13-300.fc26.x86_64 type: libreport *** Bug 1493855 has been marked as a duplicate of this bug. *** Description of problem: Just normal use of GNOME Boxes Version-Release number of selected component: selinux-policy-3.13.1-260.6.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.13-300.fc26.x86_64 type: libreport Does it break anything or you just see this AVC denial? Lukas. (In reply to Lukas Vrabec from comment #46) > Does it break anything or you just see this AVC denial? > > Lukas. I'm genuinely not sure. My VM is not working, but I have no clue if it's related to this denial. (In reply to Lukas Vrabec from comment #46) > Does it break anything or you just see this AVC denial? > > Lukas. I haven't noticed any issue when using the VM. Hello. Exact same issue since upgrade F25->F26, with gnome-boxes or virt-manager. By the way VMs don't work at all, stuck on boot screen. Solution provided in troubleshoot does nothing: # ausearch -c 'qemu-system-x86' --raw | audit2allow -M my-qemusystemx86 # semodule -X 300 -i my-qemusystemx86.pp Tried to turn on some related booleans, no success. (In reply to Lukas Vrabec from comment #46) > Does it break anything or you just see this AVC denial? > > Lukas. Similar to Alexandre, VM booting is unreliable, sometimes the same VM boots, sometimes it doesn't start at all, sometimes it hangs midway. Currently I cant reliably get Boxes to start at all. It's possible this isn't all related, I certainly haven't been able to isolate it to SELinux. Description of problem: I've got this error when I shut down the Windows 10 Pro Virtual Machine (GNOME Boxes). I don't know what this is, but still I preffered to report it in case it's a bug. Version-Release number of selected component: selinux-policy-3.13.1-260.9.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.13-300.fc26.x86_64 type: libreport Description of problem: I get this error every time I shut down Windows 10 GNOME Box Version-Release number of selected component: selinux-policy-3.13.1-260.9.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.13-300.fc26.x86_64 type: libreport Description of problem: The error popped up while running dnf upgrade -y Version-Release number of selected component: selinux-policy-3.13.1-260.8.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.13-300.fc26.x86_64 type: libreport Adding on to my comment, I ran the "dnf upgrade" after closing a Windows 10 VM in GNOME Boxes, so I think it is related to the other reports. Description of problem: The error occures every time I shut down a GNOME Box with Windows 10 Pro Version-Release number of selected component: selinux-policy-3.13.1-260.9.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.14-300.fc26.x86_64 type: libreport I would figure this is some relationship between the process that started the VM, gnome-boxes, and the qemu process running the VM. For some attempting to traverse /proc/pid of the calling starting process I would figure. Another assumption would be the qemu process is walking through the processes in /proc and triggered this AVC.
I would just dontaudit this AVC.
We already these dontaudit rules
dontaudit svirt_t init_t:dir { getattr open search };
dontaudit svirt_t virtd_t:dir { getattr open search };
Which looks like the qemu process trying to search the directory of the tools that started the VM.
I agree, it looks like dontaudit rule si fine here. Moving to POST. Description of problem: Hi, I get this warning everytime a VM is shutdown. Only tested with Windows 10 VM. Host is Fedora 26 with all updates installed. "qemu-system-x86 search access to directory 4072 was denied" $ ls -l /proc/4072/exe lrwxrwxrwx. 1 user domänen-benutzer 0 5. Okt 13:55 /proc/4072/exe -> /usr/sbin/libvirtd Version-Release number of selected component: selinux-policy-3.13.1-260.10.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.13.4-200.fc26.x86_64 type: libreport selinux-policy-3.13.1-260.14.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-d312739a4e *** Bug 1507855 has been marked as a duplicate of this bug. *** selinux-policy-3.13.1-260.14.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: SELinux is preventing qemu-system-x86 from 'search' accesses on the directory 2857. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that qemu-system-x86 should be allowed search access on the 2857 directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'qemu-system-x86' --raw | audit2allow -M my-qemusystemx86 # semodule -X 300 -i my-qemusystemx86.pp Additional Information: Source Context unconfined_u:unconfined_r:svirt_t:s0:c549,c774 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects 2857 [ dir ] Source qemu-system-x86 Source Path qemu-system-x86 Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-235.fc26.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.10.0-0.rc4.git4.1.fc26.x86_64 #1 SMP Fri Jan 20 20:41:19 UTC 2017 x86_64 x86_64 Alert Count 1 First Seen 2017-01-24 10:45:56 CET Last Seen 2017-01-24 10:45:56 CET Local ID ff569795-4319-4ab7-81b3-72a981c81830 Raw Audit Messages type=AVC msg=audit(1485251156.175:474): avc: denied { search } for pid=3491 comm="qemu-system-x86" name="2857" dev="proc" ino=143538 scontext=unconfined_u:unconfined_r:svirt_t:s0:c549,c774 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir permissive=0 Hash: qemu-system-x86,svirt_t,unconfined_t,dir,search Version-Release number of selected component: selinux-policy-3.13.1-235.fc26.noarch Additional info: component: selinux-policy reporter: libreport-2.9.0 hashmarkername: setroubleshoot kernel: 4.10.0-0.rc4.git4.1.fc26.x86_64 type: libreport