Bug 452103

Summary: libvirt-0.4.3 needs set/getsched
Product: [Fedora] Fedora Reporter: Alan Pevec <apevec>
Component: selinux-policy-targetedAssignee: Daniel Walsh <dwalsh>
Status: CLOSED CURRENTRELEASE QA Contact: Ben Levenson <benl>
Severity: low Docs Contact:
Priority: low    
Version: 9CC: berrange
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-11-17 22:04:42 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Compled SELinux policy module for libvirt-0.4.3-1 none

Description Alan Pevec 2008-06-19 12:39:34 UTC 
Description of problem:
libvirt-0.4.3 added support for NUMA and vCPU pinning in QEmu
http://git.et.redhat.com/?p=libvirt.git;a=commit;h=6aaea11636ba5674d30c94b8ff8659736ca78248

running with SELinux enabled gives:
avc: denied { getsched } for pid=6231 comm="libvirtd"
scontext=unconfined_u:system_r:virtd_t:s0
tcontext=unconfined_u:system_r:virtd_t:s0 tclass=process 

avc: denied { setsched } for pid=6231 comm="libvirtd"
scontext=unconfined_u:system_r:virtd_t:s0
tcontext=unconfined_u:system_r:qemu_t:s0 tclass=process

Version-Release number of selected component (if applicable):
libvirt-0.4.3-1
selinux-policy-targeted-3.3.1-64

How reproducible:
always

Steps to Reproduce:
1. setenforce 1
2. virsh start node3 (for example)
3.
  
Actual results:
libvir: QEMU error : internal error failed to set CPU affinity Permission denied

error: Failed to start domain node3



Expected results:
Domain node3 started



Additional info:
Comment 1 Alan Pevec 2008-06-20 08:02:27 UTC 
Created attachment 309910 [details]
Compled SELinux policy module for libvirt-0.4.3-1

audit2allow generated SELinux policy module:

module libvirt043 1.0;
require {
	type virtd_t;
	type qemu_t;
	class process { setsched getsched };
}
#============= virtd_t ==============
allow virtd_t qemu_t:process setsched;
allow virtd_t self:process getsched;

Attached is compiled module which you can install with:
semodule -i libvirt043.pp
Comment 2 Daniel Walsh 2008-06-22 10:53:30 UTC 
Fixed in selinux-policy-3.3.1-68.fc9.noarch
Comment 3 Daniel Walsh 2008-11-17 22:04:42 UTC 
Closing all bugs that have been in modified for over a month.  Please reopen if the bug is not actually fixed.