Bug 886639
| Summary: | SELinux is preventing /usr/bin/qemu-kvm from 'create' accesses on the netlink_route_socket . | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Dean Hunter <deanhunter> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 18 | CC: | awilliam, bkoz, dominick.grift, dwalsh, eblake, jlayton, joshua, jsmith.fedora, mgrepl, mikhail.v.gavrilov, mjg59, niki.guldbrand, pschindl, Reinhard.Scheck, stickster |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | abrt_hash:e40c12a61f0f4bb225c3ec16e6f623af24cdfa368be07c748bf3a1da51bb1c98 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-12-18 06:53:24 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
using virt-manager to create a new VM using the Fedora 18 beta live dvd iso; not sure if this bug is in policy, qemu, or libvirt Package: (null) OS Release: Fedora release 18 (Spherical Cow) Happens when booting a VM with an F18 live image in the 'drive' on an F18 host, selinux-policy -62. Package: (null) OS Release: Fedora release 18 (Spherical Cow) I just started a guest machine in kvm. when this happened. Package: (null) OS Release: Fedora release 18 (Spherical Cow) Please raise the Severity of this bug report from the Automatic Bug Reporting Tools' default setting of unspecified to high or urgent as it is not possible to create a new box with gnome-boxes. This makes it impossible to do any further testing of the product. Done. most developers pay very little attention to the severity field, btw. besides, since it's an selinux denial, there's a perfectly obvious workaround: set selinux to permissive. Fixed in selinux-policy-3.11.1-65.fc18 Trying to create a new VM in GNOME Boxes Package: (null) OS Release: Fedora release 18 (Spherical Cow) (In reply to comment #7) > Fixed in selinux-policy-3.11.1-65.fc18 Thank you for the update. Simply started virt-manager, and created a VM Package: (null) OS Release: Fedora release 18 (Spherical Cow) Started an virtual machine in virt-manager Package: (null) OS Release: Fedora release 18 (Spherical Cow) Installation of Windows Vista into QEMU as a KVM guest Package: (null) OS Release: Fedora release 18 (Spherical Cow) Started up a windows KVM guest. Package: (null) OS Release: Fedora release 18 (Spherical Cow) selinux-policy-3.11.1-66.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-66.fc18 Allocated new machine with defaults (other than pointing to install URL) and this SELinux error appeared at startup. Package: (null) OS Release: Fedora release 18 (Spherical Cow) Looks fixed with -66. Thanks. Started an Ubuntu image in Boxes. Package: (null) OS Release: Fedora release 18 (Spherical Cow) selinux-policy-3.11.1-66.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: The alert was raised while using gnome-boxes to create a new local box from the Fedora 18 beta x86_64 Live Desktop ISO file. SELinux is preventing /usr/bin/qemu-kvm from 'create' accesses on the netlink_route_socket . ***** Plugin catchall (100. confidence) suggests *************************** If you believe that qemu-kvm should be allowed create access on the netlink_route_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep qemu-kvm /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:system_r:svirt_t:s0:c524,c817 Target Context unconfined_u:system_r:svirt_t:s0:c524,c817 Target Objects [ netlink_route_socket ] Source qemu-kvm Source Path /usr/bin/qemu-kvm Port <Unknown> Host (removed) Source RPM Packages qemu-system-x86-1.2.0-24.fc18.x86_64 Target RPM Packages Policy RPM selinux-policy-3.11.1-62.fc18.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.6.10-4.fc18.x86_64 #1 SMP Tue Dec 11 18:01:27 UTC 2012 x86_64 x86_64 Alert Count 1 First Seen 2012-12-12 11:56:29 CST Last Seen 2012-12-12 11:56:29 CST Local ID 826d1006-8f9a-4b46-b6cf-317a3272d155 Raw Audit Messages type=AVC msg=audit(1355334989.409:697): avc: denied { create } for pid=6529 comm="qemu-kvm" scontext=unconfined_u:system_r:svirt_t:s0:c524,c817 tcontext=unconfined_u:system_r:svirt_t:s0:c524,c817 tclass=netlink_route_socket type=SYSCALL msg=audit(1355334989.409:697): arch=x86_64 syscall=socket success=no exit=EACCES a0=10 a1=3 a2=0 a3=7fffe1e26670 items=0 ppid=1 pid=6529 auid=997000001 uid=997000001 gid=997000001 euid=997000001 suid=997000001 fsuid=997000001 egid=997000001 sgid=997000001 fsgid=997000001 tty=(none) ses=5 comm=qemu-kvm exe=/usr/bin/qemu-kvm subj=unconfined_u:system_r:svirt_t:s0:c524,c817 key=(null) Hash: qemu-kvm,svirt_t,svirt_t,netlink_route_socket,create audit2allow audit2allow -R Additional info: hashmarkername: setroubleshoot kernel: 3.6.10-4.fc18.x86_64 type: libreport