Bug 2276956
| Summary: | SELinux is preventing rpc-virtqemud from 'setattr' accesses on the chr_file userfaultfd. | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Kevin Agwaze <kevin-agwaze> | ||||||
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | ||||||
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | unspecified | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 40 | CC: | dwalsh, kevin-agwaze, knazekovan, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | x86_64 | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | abrt_hash:90090ae507295eec608bd519bfa61ef28b4208acc28ad6f8b6c1beac224a8d3e;VARIANT_ID=workstation; | ||||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2024-04-30 19:19:51 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
Created attachment 2028933 [details]
File: description
Created attachment 2028934 [details]
File: os_info
*** This bug has been marked as a duplicate of bug 2276778 *** |
Description of problem: Hi, Since upgrading to Fedora 40, I'm consistently encountering this when staring a vm from virtual machine manager. SELinux is preventing rpc-virtqemud from 'setattr' accesses on the chr_file userfaultfd. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that rpc-virtqemud should be allowed setattr access on the userfaultfd chr_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'rpc-virtqemud' --raw | audit2allow -M my-rpcvirtqemud # semodule -X 300 -i my-rpcvirtqemud.pp Additional Information: Source Context system_u:system_r:virtqemud_t:s0 Target Context system_u:object_r:svirt_image_t:s0:c24,c824 Target Objects userfaultfd [ chr_file ] Source rpc-virtqemud Source Path rpc-virtqemud Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-40.16-1.fc40.noarch Local Policy RPM selinux-policy-targeted-40.16-1.fc40.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.8.7-300.fc40.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Apr 17 19:21:08 UTC 2024 x86_64 Alert Count 1 First Seen 2024-04-24 19:23:54 BST Last Seen 2024-04-24 19:23:54 BST Local ID a60f2765-fe17-4a2b-86c0-f0adc8326f56 Raw Audit Messages type=AVC msg=audit(1713983034.120:357): avc: denied { setattr } for pid=12045 comm="rpc-virtqemud" name="userfaultfd" dev="tmpfs" ino=7 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:svirt_image_t:s0:c24,c824 tclass=chr_file permissive=1 Hash: rpc-virtqemud,virtqemud_t,svirt_image_t,chr_file,setattr Version-Release number of selected component: selinux-policy-targeted-40.16-1.fc40.noarch Additional info: reporter: libreport-2.17.15 reason: SELinux is preventing rpc-virtqemud from 'setattr' accesses on the chr_file userfaultfd. package: selinux-policy-targeted-40.16-1.fc40.noarch component: selinux-policy hashmarkername: setroubleshoot type: libreport kernel: 6.8.7-300.fc40.x86_64 component: selinux-policy