Bug 205711

Summary: xen guest installation avc messages
Product: [Fedora] Fedora Reporter: James Morris <jmorris>
Component: xenAssignee: James Morris <jmorris>
Status: CLOSED RAWHIDE QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: bstein, dwalsh, katzj, quintela
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-09-18 22:23:37 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Attachments:
Description Flags
audit log during xen guest install none

Description James Morris 2006-09-07 23:28:34 EDT
Description of problem:

Many AVC denials are generated when installing a xen guest under current
rawhide.  We need to fix policy and apps so that there are none, and xen
can be properly tested with SELinux.

Version-Release number of selected component (if applicable):

xen-3.0.2-33

How reproducible:

Always

Steps to Reproduce:
1. Update to current rawhide, with SELinux in enforcing mode.
2. run xenguest-install
3.
  
Actual results:

see logs

Expected results:

no avc messages or errors
Comment 1 James Morris 2006-09-07 23:28:34 EDT
Created attachment 135827 [details]
audit log during xen guest install
Comment 2 James Morris 2006-09-07 23:32:35 EDT
The hotplug log file has the wrong context:

# ls -Z /var/log/xen
-rwxr-xr-x  root root system_u:object_r:xend_var_log_t xend-debug.log
-rw-r--r--  root root system_u:object_r:xend_var_log_t xend.log
-rw-r--r--  root root system_u:object_r:var_log_t      xen-hotplug.log

Leading to:
[2006-09-07 23:14:58 xend 2418] ERROR (SrvBase:87) Request wait_for_devices failed.
Traceback (most recent call last):
  File "/usr/lib/python2.4/site-packages/xen/web/SrvBase.py", line 85, in perform
    return op_method(op, req)
  File "/usr/lib/python2.4/site-packages/xen/xend/server/SrvDomain.py", line 72,
in op_wait_for_devices
    return self.dom.waitForDevices()
  File "/usr/lib/python2.4/site-packages/xen/xend/XendDomainInfo.py", line 1544,
in waitForDevices
    self.waitForDevices_(c)
  File "/usr/lib/python2.4/site-packages/xen/xend/XendDomainInfo.py", line 1075,
in waitForDevices_
    return self.getDeviceController(deviceClass).waitForDevices()
  File "/usr/lib/python2.4/site-packages/xen/xend/server/DevController.py", line
145, in waitForDevices
    return map(self.waitForDevice, self.deviceIDs())
  File "/usr/lib/python2.4/site-packages/xen/xend/server/DevController.py", line
155, in waitForDevice
    raise VmError("Device %s (%s) could not be connected. "
VmError: Device 0 (vif) could not be connected. Hotplug scripts not working.

Comment 3 Daniel Walsh 2006-09-11 09:23:03 EDT
Latest xen logs have been moved to /var/log/xen which has been labeled
appropriately in the latest policy.  Also xend now has permission to ptrace all
domains and the sys_ptrace capability.

Fixed in selinux-policy-2.3.13-3