Bug 523956
| Summary: | Starting libvirtd by hand causes denials | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Chris Lalancette <clalance> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED WONTFIX | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | rawhide | CC: | dwalsh, jkubin, markmc, mgrepl, virt-maint |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-09-17 19:14:31 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 498969 | ||
Sorry if you are running in debug mode you are pretty much on your own. It is better to debug these by connecting to the PID. THat way it matches the way the system will run in an SELinux environment. Or you could execute runcon -t virtd_t libvirtd, which may or may not work. |
Description of problem: I'm doing some debugging as part of the virtualization test day. While trying to debug an issue with libvirtd, I shutdown the service (service libvirtd stop), and started it by hand: [root@intel2 ~]# /usr/sbin/libvirtd --verbose --listen And it starts up as expected. However, when trying to start a qemu-kvm guest with it like this, I get: [root@intel2 ~]# virsh start f12 error: Failed to start domain f12 error: internal error unable to start guest: 11:55:45.547: error : __virExec:567 : cannot execute binary /usr/bin/qemu-kvm: Permission denied libvir: error : cannot execute binary /usr/bin/qemu-kvm: Permission denied Setting selinux to Permissive mode solves the problem, as does killing the process and starting the service back up. I get the following denials in /var/log/audit/audit.log: type=ANOM_PROMISCUOUS msg=audit(1253203387.033:96): dev=vnet0 prom=256 old_prom=0 auid=0 uid=0 gid=0 ses=3 type=SYSCALL msg=audit(1253203387.033:96): arch=c000003e syscall=16 success=yes exit=0 a0=11 a1=89a2 a2=7f8836d73dc0 a3=7f8836d73b50 items=0 ppid=2932 pid=3611 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=3 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1253203387.041:97): avc: denied { transition } for pid=3615 comm="libvirtd" path="/usr/bin/qemu-kvm" dev=dm-0 ino=16894 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:system_r:svirt_t:s0:c32,c306 tclass=process type=SYSCALL msg=audit(1253203387.041:97): arch=c000003e syscall=59 success=no exit=-13 a0=7f8824000d50 a1=7f8824001490 a2=7f8824000a00 a3=7f8836d75e20 items=0 ppid=3614 pid=3615 auid=0 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=3 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=ANOM_PROMISCUOUS msg=audit(1253203387.051:98): dev=vnet0 prom=0 old_prom=256 auid=0 uid=0 gid=0 ses=3 type=SYSCALL msg=audit(1253203387.051:98): arch=c000003e syscall=3 success=yes exit=0 a0=12 a1=0 a2=0 a3=1 items=0 ppid=2932 pid=3611 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=3 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)