Bug 882258

Description of problem:
SELinux is preventing /usr/bin/qemu-kvm from 'read, write' accesses on the chr_file /dev/tap32.

*****  Plugin restorecon (85.9 confidence) suggests  *************************

If you want to fix the label. 
/dev/tap32 default label should be tun_tap_device_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /dev/tap32

*****  Plugin device (9.04 confidence) suggests  *****************************

If you want to allow qemu-kvm to have read write access on the tap32 chr_file
Then you need to change the label on /dev/tap32 to a type of a similar device.
Do
# semanage fcontext -a -t SIMILAR_TYPE '/dev/tap32'
# restorecon -v '/dev/tap32'

*****  Plugin leaks (5.62 confidence) suggests  ******************************

If you want to ignore qemu-kvm trying to read write access the tap32 chr_file, because you believe it should not need this access.
Then you should report this as a bug.  
You can generate a local policy module to dontaudit this access.
Do
# grep /usr/bin/qemu-kvm /var/log/audit/audit.log | audit2allow -D -M mypol
# semodule -i mypol.pp

*****  Plugin catchall (1.35 confidence) suggests  ***************************

If you believe that qemu-kvm should be allowed read write access on the tap32 chr_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep qemu-kvm /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Additional Information:
Source Context                system_u:system_r:svirt_t:s0:c158,c381
Target Context                system_u:object_r:device_t:s0
Target Objects                /dev/tap32 [ chr_file ]
Source                        qemu-kvm
Source Path                   /usr/bin/qemu-kvm
Port                          <Unknown>
Host                          srv08.kola.fad.ru
Source RPM Packages           qemu-system-x86-1.0.1-2.fc17.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.10.0-161.fc17.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     srv08.kola.fad.ru
Platform                      Linux srv08.kola.fad.ru 3.6.7-4.fc17.x86_64 #1 SMP
                              Tue Nov 20 19:40:01 UTC 2012 x86_64 x86_64
Alert Count                   1
First Seen                    2012-11-30 18:01:45 MSK
Last Seen                     2012-11-30 18:01:45 MSK
Local ID                      8ae6cfcf-c399-4029-ae0a-e82fb43655aa

Raw Audit Messages
type=AVC msg=audit(1354284105.34:2435): avc:  denied  { read write } for  pid=14415 comm="qemu-kvm" path="/dev/tap32" dev="devtmpfs" ino=487270 scontext=system_u:system_r:svirt_t:s0:c158,c381 tcontext=system_u:object_r:device_t:s0 tclass=chr_file


type=SYSCALL msg=audit(1354284105.34:2435): arch=x86_64 syscall=execve success=yes exit=0 a0=7f96840de380 a1=7f96840de610 a2=7f96840ddcc0 a3=0 items=0 ppid=1 pid=14415 auid=4294967295 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=4294967295 comm=qemu-kvm exe=/usr/bin/qemu-kvm subj=system_u:system_r:svirt_t:s0:c158,c381 key=(null)

Hash: qemu-kvm,svirt_t,device_t,chr_file,read,write

audit2allow

#============= svirt_t ==============
allow svirt_t device_t:chr_file { read write };

audit2allow -R

#============= svirt_t ==============
allow svirt_t device_t:chr_file { read write };

How reproducible:
Always.

Steps to Reproduce:
1. Start virt-viewer and create new virtual machine.
2. Set Virtual Network Interface:
  Source: Host device p5p1
  Device model: Hypervisor default
  Source mode: Privte
3. Power on the virtual machine.

Additional info:
$ ls -lZ /dev/tap*
crw-------. root root system_u:object_r:tun_tap_device_t:s0 /dev/tap32