Bug 859395

Summary:	$HOME/.cache/libvirt/qemu/log is not labelled correctly
Product:	[Fedora] Fedora	Reporter:	Richard W.M. Jones <rjones>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	18	CC:	dominick.grift, dwalsh, mgrepl
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-12-15 19:17:02 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Richard W.M. Jones 2012-09-21 12:42:45 UTC

Description of problem:

Probably best just to read Dan's description of the problem here:

https://www.redhat.com/archives/libvir-list/2012-September/msg01546.html

Comment 1 Miroslav Grepl 2012-09-21 12:49:42 UTC

# rpm -q selinux-policy

Comment 2 Richard W.M. Jones 2012-09-21 12:55:15 UTC

I'm using:
selinux-policy-3.11.1-7.fc18.noarch

However the question is whether upstream selinux-policy
knows about .cache/libvirt and .config/libvirt.

By the way, I've no idea how these should be labelled,
just that changing the labels makes libvirt logging work
(with Dan's patch).

Comment 3 Daniel Walsh 2012-09-26 20:45:08 UTC

 matchpathcon /home/rjones/.cache/libvirt/qemu/log/guestfs-wd6efsxohmy5jd2s.log
/home/rjones/.cache/libvirt/qemu/log/guestfs-wd6efsxohmy5jd2s.log	unconfined_u:object_r:svirt_home_t:s0


On my F18 box. 

So the proper labels are in place.  The problem is Rawhide not getting the latest policy from F18.

Comment 4 Richard W.M. Jones 2012-09-26 20:57:28 UTC

I found that restorecon -F -R -v ~/.cache fixed this
problem (once I'd manually downloaded and installed the
latest selinux-policy).

Note I had to use the '-F' option.  That wasn't completely
obvious, but it turned out to have something to do with
svirt_home_t being a "customizable type".