Bug 609658

Summary: No selinux labelling for ~/.libvirt, used by qemu:///session
Product: [Fedora] Fedora Reporter: Cole Robinson <crobinso>
Component: libvirtAssignee: Daniel Veillard <veillard>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 13CC: berrange, clalance, crobinso, itamar, jforbes, oliver.henshaw, veillard, virt-maint
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-06-07 11:57:53 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Cole Robinson 2010-06-30 15:07:33 EDT
If using libvirt's qemu:///session, the libvirt daemon and all VMs are launched as the regular user, and the libvirt folder heirarchy typically under /var is under ~/.libvirt:

/var/lib/libvirt/qemu -> ~/.libvirt/qemu/lib
/var/log/libvirt/qemu -> ~/.libvirt/qemu/log
...

Unfortunately there doesn't seem to be any selinux rules for these directories, and they get user_home_t by default, which causes issues writing out log files, creating sockets, etc. Some AVC:

type=AVC msg=audit(1277923896.237:36914): avc:  denied  { write } for  pid=11797 comm="qemu-kvm" path="/home/cole/.libvirt/qemu/log/livetest.log" dev=dm-2 ino=1561895 scontext=system_u:system_r:svirt_t:s0:c282,c441 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
type=AVC msg=audit(1277923896.237:36914): avc:  denied  { write } for  pid=11797 comm="qemu-kvm" path="/home/cole/.libvirt/qemu/log/livetest.log" dev=dm-2 ino=1561895 scontext=system_u:system_r:svirt_t:s0:c282,c441 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
type=SYSCALL msg=audit(1277923896.237:36914): arch=c000003e syscall=59 success=yes exit=0 a0=7f57b4001320 a1=7f57b4004660 a2=7f57b4001130 a3=7f57bb5fbfc0 items=0 ppid=1 pid=11797 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c282,c441 key=(null)
type=AVC msg=audit(1277923896.241:36915): avc:  denied  { write } for  pid=11797 comm="qemu-kvm" name="lib" dev=dm-2 ino=1561789 scontext=system_u:system_r:svirt_t:s0:c282,c441 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1277923896.241:36915): arch=c000003e syscall=49 success=no exit=-13 a0=3 a1=7fff2e0d41b0 a2=6e a3=76696c2f62696c2f items=0 ppid=1 pid=11797 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c282,c441 key=(null)


This is probably also relevant for Fedora 12.
Comment 1 Daniel Walsh 2010-07-12 16:58:01 EDT
This would be a libvirt issue,  It needs to relabel any content that svirt_t needs write access to.
Comment 2 Cole Robinson 2010-07-12 17:13:31 EDT
Hmm, but doesn't the selinux policy have hardcoded labelling for things like /var/log/libvirt/qemu? So any file placed there gets the correct label, restorecon works, etc? We basically need that for the hierarchy created in ~/.libvirt/qemu/*
Comment 3 Bug Zapper 2011-06-01 11:08:38 EDT
This message is a reminder that Fedora 13 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 13.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '13'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 13's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 13 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 4 Cole Robinson 2011-06-07 11:57:53 EDT
I think this is fixed in latest fedora.