Bug 742704

Summary:	selinux problems accessing xen from libvirt
Product:	[Fedora] Fedora	Reporter:	Michael Young <m.a.young>
Component:	selinux-policy-targeted	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Ben Levenson <benl>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	16	CC:	dwalsh
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	selinux-policy-3.10.0-38.fc16	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-10-09 19:35:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Michael Young 2011-10-01 19:33:50 UTC

selinux seems to be blocking attempts to do things with xen from libvirt. Some of the errors are below. You should be able to reproduce this by installing xen, xen-runtime, xen-libs xen-hypervisor and libvirt then booting the system under the xen hypervisor. I believe the following examples were all generated just by the startup/status/shutdown scripts of libvirt without actually using it. Bug 741042 and Bug 742699 are probably the same issue.

type=AVC msg=audit(1308416554.923:127): avc:  denied  { getattr } for  pid=3298 comm="xl" path="/var/run/xenstored.pid" dev=tmpfs ino=17775 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xenstored_var_run_t:s0 tclass=file

type=AVC msg=audit(1301774644.394:217): avc:  denied  { getattr } for  pid=1774 comm="virsh" path="/var/run/xenstored/socket" dev=tmpfs ino=17857 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=sock_file

type=AVC msg=audit(1301774644.251:206): avc:  denied  { write } for  pid=1740 comm="xm" name="xmlrpc.sock" dev=tmpfs ino=18388 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=sock_file

type=AVC msg=audit(1301773904.850:239): avc:  denied  { write } for  pid=14483 comm="virsh" name="libvirt-sock" dev=tmpfs ino=18252 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=sock_file

type=AVC msg=audit(1282330354.665:26808): avc:  denied  { getattr } for  pid=9891 comm="setfiles" path="/usr/bin/virsh" dev=dm-8 ino=450654 scontext=user_u:user_r:policykit_grant_t:s0 tcontext=system_u:object_r:virsh_exec_t:s0 tclass=file

type=AVC msg=audit(1313519773.784:225): avc:  denied  { setuid } for  pid=4097 comm="xend" capability=7  scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:system_r:virsh_t:s0 tclass=capability

type=AVC msg=audit(1313519773.776:224): avc:  denied  { open } for  pid=4109 comm="ps" name="stat" dev=proc ino=47364 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:system_r:plymouthd_t:s0 tclass=file

type=AVC msg=audit(1301605453.093:279): avc:  denied  { write } for  pid=14788 comm="virsh" name="socket" dev=tmpfs ino=18952 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=sock_file

type=AVC msg=audit(1313519773.580:178): avc:  denied  { open } for  pid=4097 comm="xend" name="xend.pid" dev=tmpfs ino=18346 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_var_run_t:s0 tclass=file

type=AVC msg=audit(1313519773.580:178): avc:  denied  { read } for  pid=4097 comm="xend" name="xend.pid" dev=tmpfs ino=18346 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_var_run_t:s0 tclass=file

type=AVC msg=audit(1313519773.580:177): avc:  denied  { getattr } for  pid=4097 comm="xend" path="/var/run/xend.pid" dev=tmpfs ino=18346 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_var_run_t:s0 tclass=file

type=AVC msg=audit(1313519772.862:173): avc:  denied  { ioctl } for  pid=4097 comm="xend" path="/usr/sbin/xend" dev=dm-5 ino=426324 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_exec_t:s0 tclass=file

type=AVC msg=audit(1313519772.730:169): avc:  denied  { read open } for  pid=4097 comm="virsh" name="xend" dev=dm-5 ino=426324 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_exec_t:s0 tclass=file

Comment 1 Michael Young 2011-10-02 12:22:51 UTC

Sorry, the errors I posted above were older than I realised and may not still be current. Here are some new ones (including some which may be with a xen guest running)
type=AVC msg=audit(1317503403.133:66): avc:  denied  { getattr } for  pid=1248 comm="xl" path="/var/run/xenstored.pid" dev=tmpfs ino=18157 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xenstored_var_run_t:s0 tclass=file
type=AVC msg=audit(1317503850.899:99): avc:  denied  { execute } for  pid=1535 comm="virsh" name="xend" dev=dm-5 ino=431318 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_exec_t:s0 tclass=file
type=AVC msg=audit(1317503850.899:99): avc:  denied  { read open } for  pid=1535 comm="virsh" name="xend" dev=dm-5 ino=431318 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_exec_t:s0 tclass=file
type=AVC msg=audit(1317503850.899:99): avc:  denied  { execute_no_trans } for  pid=1535 comm="virsh" path="/usr/sbin/xend" dev=dm-5 ino=431318 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_exec_t:s0 tclass=file
type=AVC msg=audit(1317503850.949:104): avc:  denied  { getattr } for  pid=1535 comm="xend" path="/usr/sbin/xend" dev=dm-5 ino=431318 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_exec_t:s0 tclass=file
type=AVC msg=audit(1317503850.949:105): avc:  denied  { ioctl } for  pid=1535 comm="xend" path="/usr/sbin/xend" dev=dm-5 ino=431318 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_exec_t:s0 tclass=file
type=AVC msg=audit(1317556148.669:69): avc:  denied  { getattr } for  pid=1248 comm="xl" path="/var/run/xenstored.pid" dev=tmpfs ino=18185 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xenstored_var_run_t:s0 tclass=file
type=AVC msg=audit(1317556624.321:94): avc:  denied  { sys_module } for  pid=2141 comm="brctl" capability=16  scontext=system_u:system_r:brctl_t:s0-s0:c0.c1023 tcontext=system_u:system_r:brctl_t:s0-s0:c0.c1023 tclass=capability

Comment 2 Miroslav Grepl 2011-10-03 08:18:56 UTC

Fixed in selinux-policy-3.10.0-36.fc16

Comment 3 Fedora Update System 2011-10-04 11:16:36 UTC

selinux-policy-3.10.0-36.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-36.fc16

Comment 4 Fedora Update System 2011-10-04 20:49:14 UTC

Package selinux-policy-3.10.0-36.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-36.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-36.fc16
then log in and leave karma (feedback).

Comment 5 Michael Young 2011-10-05 20:00:19 UTC

The problem isn't entirely fixed. I still get messages like
type=AVC msg=audit(1317843757.701:65): avc:  denied  { getattr } for  pid=1246 comm="xl" path="/var/run/xenstored.pid" dev=tmpfs ino=18473 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xenstored_var_run_t:s0 tclass=file

Comment 6 Miroslav Grepl 2011-10-05 20:19:46 UTC

Are you getting more AVC msgs in permissive mode?

#setenforce 0

re-test it.

# ausearch -m avc -ts recent
#setenforce 1

Comment 7 Michael Young 2011-10-05 21:03:20 UTC

These messages were all generated in permissive mode. The message in comment 5 is essentially the same as one in comment 3 (and one in comment 1) so it isn't a new discovery.

Comment 8 Miroslav Grepl 2011-10-05 21:28:10 UTC

Fixed in selinux-policy-3.10.0-38.fc16

Comment 9 Fedora Update System 2011-10-09 19:35:42 UTC

selinux-policy-3.10.0-38.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.