Bug 609658
| Summary: | No selinux labelling for ~/.libvirt, used by qemu:///session | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Cole Robinson <crobinso> |
| Component: | libvirt | Assignee: | Daniel Veillard <veillard> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 13 | CC: | berrange, clalance, crobinso, itamar, jforbes, oliver.henshaw, veillard, virt-maint |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-06-07 15:57:53 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
This would be a libvirt issue, It needs to relabel any content that svirt_t needs write access to. Hmm, but doesn't the selinux policy have hardcoded labelling for things like /var/log/libvirt/qemu? So any file placed there gets the correct label, restorecon works, etc? We basically need that for the hierarchy created in ~/.libvirt/qemu/* This message is a reminder that Fedora 13 is nearing its end of life. Approximately 30 (thirty) days from now Fedora will stop maintaining and issuing updates for Fedora 13. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '13'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 13's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 13 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora please change the 'version' of this bug to the applicable version. If you are unable to change the version, please add a comment here and someone will do it for you. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping I think this is fixed in latest fedora. |
If using libvirt's qemu:///session, the libvirt daemon and all VMs are launched as the regular user, and the libvirt folder heirarchy typically under /var is under ~/.libvirt: /var/lib/libvirt/qemu -> ~/.libvirt/qemu/lib /var/log/libvirt/qemu -> ~/.libvirt/qemu/log ... Unfortunately there doesn't seem to be any selinux rules for these directories, and they get user_home_t by default, which causes issues writing out log files, creating sockets, etc. Some AVC: type=AVC msg=audit(1277923896.237:36914): avc: denied { write } for pid=11797 comm="qemu-kvm" path="/home/cole/.libvirt/qemu/log/livetest.log" dev=dm-2 ino=1561895 scontext=system_u:system_r:svirt_t:s0:c282,c441 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=AVC msg=audit(1277923896.237:36914): avc: denied { write } for pid=11797 comm="qemu-kvm" path="/home/cole/.libvirt/qemu/log/livetest.log" dev=dm-2 ino=1561895 scontext=system_u:system_r:svirt_t:s0:c282,c441 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file type=SYSCALL msg=audit(1277923896.237:36914): arch=c000003e syscall=59 success=yes exit=0 a0=7f57b4001320 a1=7f57b4004660 a2=7f57b4001130 a3=7f57bb5fbfc0 items=0 ppid=1 pid=11797 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c282,c441 key=(null) type=AVC msg=audit(1277923896.241:36915): avc: denied { write } for pid=11797 comm="qemu-kvm" name="lib" dev=dm-2 ino=1561789 scontext=system_u:system_r:svirt_t:s0:c282,c441 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir type=SYSCALL msg=audit(1277923896.241:36915): arch=c000003e syscall=49 success=no exit=-13 a0=3 a1=7fff2e0d41b0 a2=6e a3=76696c2f62696c2f items=0 ppid=1 pid=11797 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c282,c441 key=(null) This is probably also relevant for Fedora 12.