Bug 2053425
| Summary: | qemu-system-x86 dev="anon_inodefs" | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Germano Massullo (Thetra) <germano.massullo> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 35 | CC: | dwalsh, grepl.miroslav, lvrabec, mmalik, omosnace, pkoncity, vmojzis, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-02-11 11:28:39 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 2025714 *** |
Good day, using qemu-system-x86-6.1.0-10.fc35.x86_64 (through libvirt/virt-manager in my case) triggers the following SELinux alert SELinux impedisce a qemu-system-x86 un accesso map su anon_inode anon_inode. ⏎ ⏎ ***** Plugin catchall(100. confidenza) suggerisce************************** Se ci credi qemu-system-x86 dovrebbe essere consentito map accesso al anon_inode anon_inode per impostazione predefinita. Quindi si dovrebbe riportare il problema come bug. E' possibile generare un modulo di politica locale per consentire questo accesso. Fai consentire questo accesso per ora eseguendo: # ausearch -c 'qemu-system-x86' --raw | audit2allow -M my-$MODULE_NOME # semodule -X 300 -i miei-qemusystemx86.pp Informazioni addizionali: Contesto della sorgente system_u:system_r:svirt_t:s0:c613,c748 Contesto target system_u:object_r:svirt_t:s0:c613,c748 Oggetti target anon_inode [ anon_inode ] Sorgente qemu-system-x86 Percorso della sorgente qemu-system-x86 Porta <Sconosciuto> Sorgente Pacchetti RPM Pacchetti RPM target SELinux Policy RPM selinux-policy-targeted-35.13-1.fc35.noarch Local Policy RPM selinux-policy-targeted-35.13-1.fc35.noarch Selinux abilitato True Tipo di politica targeted Modalità Enforcing Enforcing Host Name Magic-5 Piattaforma Linux Magic-5 5.16.7-200.fc35.x86_64 #1 SMP PREEMPT Sun Feb 6 19:53:54 UTC 2022 x86_64 x86_64 Conteggio avvisi 3 Primo visto 2022-02-11 10:38:15 CET Ultimo visto 2022-02-11 10:38:15 CET Messaggi Raw Audit type=AVC msg=audit(1644572295.475:431): avc: denied { map } for pid=10114 comm="qemu-system-x86" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=255855 scontext=system_u:system_r:svirt_t:s0:c613,c748 tcontext=system_u:object_r:svirt_t:s0:c613,c748 tclass=anon_inode permissive=0 Hash: qemu-system-x86,svirt_t,svirt_t,anon_inode,map