Bug 560347

Summary:

SELinux prevented qemu-kvm from using the terminal 3.

Detailed Description:

SELinux prevented qemu-kvm from using the terminal 3. In most cases daemons do
not need to interact with the terminal, usually these avc messages can be
ignored. All of the confined daemons should have dontaudit rules around using
the terminal. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this selinux-policy.
If you would like to allow all daemons to interact with the terminal, you can
turn on the allow_daemons_use_tty boolean.

Allowing Access:

Changing the "allow_daemons_use_tty" boolean to true will allow this access:
"setsebool -P allow_daemons_use_tty=1."

Fix Command:

setsebool -P allow_daemons_use_tty=1

Additional Information:

Source Context                system_u:system_r:svirt_t:s0:c245,c685
Target Context                system_u:object_r:devpts_t:s0:c245,c685
Target Objects                3 [ chr_file ]
Source                        qemu-kvm
Source Path                   /usr/bin/qemu-kvm
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           qemu-system-x86-0.10.6-5.fc11
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.12-82.fc11
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   allow_daemons_use_tty
Host Name                     (removed)
Platform                      Linux (removed) 2.6.30.5-43.fc11.x86_64 #1 SMP Thu Aug
                              27 21:39:52 EDT 2009 x86_64 x86_64
Alert Count                   1
First Seen                    Tue 29 Sep 2009 09:58:45 PM EDT
Last Seen                     Tue 29 Sep 2009 09:58:45 PM EDT
Local ID                      0871ad98-c5a9-42b4-917e-e3ad360f5dce
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1254275925.861:42789): avc:  denied  { setattr } for  pid=3750 comm="qemu-kvm" name="3" dev=devpts ino=6 scontext=system_u:system_r:svirt_t:s0:c245,c685 tcontext=system_u:object_r:devpts_t:s0:c245,c685 tclass=chr_file

node=(removed) type=SYSCALL msg=audit(1254275925.861:42789): arch=c000003e syscall=92 success=no exit=-13 a0=7fff89fc3a30 a1=0 a2=5 a3=1999999999999999 items=0 ppid=1 pid=3750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c245,c685 key=(null)



Hash String generated from  selinux-policy-3.6.12-82.fc11,allow_daemons_use_tty,qemu-kvm,svirt_t,devpts_t,chr_file,setattr
audit2allow suggests:

#============= svirt_t ==============
allow svirt_t devpts_t:chr_file setattr;