Red Hat Bugzilla – Bug 1019003
SELinux is preventing /usr/bin/qemu-system-x86_64 from 'search' accesses on the directory net.
Last modified: 2013-11-04 21:52:08 EST
Description of problem: I'm trying to set up libvirt to use gluster for disk image storage. I validated that I can set up the gluster volume: # mount -t glusterfs red:/vol1 /mnt/sysroot/ # truncate --size 10M /mnt/sysroot/img # ls /mnt/sysroot/ img # umount /mnt/sysroot Then added this to the libvirt domainXML: <disk type='network' device='disk'> <driver name='qemu' type='raw'/> <source protocol='gluster' name='vol1/img'> <host name='red'/> </source> <target dev='vdb' bus='virtio'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> </disk> which results in attempting this qemu command line: LC_ALL=C PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin QEMU_AUDIO_DRV=spice /usr/bin/qemu-kvm -name f18-live -S -machine pc-i440fx-1.6,accel=kvm,usb=off -m 1024 -realtime mlock=off -smp 1,sockets=1,cores=1,threads=1 -uuid 6f47e00c-0342-4df9-87a2-824585d1b5d5 -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/f18-live.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x5 -drive file=/home/eblake/Downloads/Fedora-18-x86_64-netinst.iso,if=none,id=drive-virtio-disk0,readonly=on,format=raw -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x6,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 -drive file=gluster://red/vol1/img,if=none,id=drive-virtio-disk1,format=raw -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x8,drive=drive-virtio-disk1,id=virtio-disk1 -netdev tap,fd=25,id=hostnet0,vhost=on,vhostfd=26 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:56:7f:f0,bus=pci.0,addr=0x3 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -chardev spicevmc,id=charchannel0,name=vdagent -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=com.redhat.spice.0 -device usb-tablet,id=input0 -spice port=5900,addr=127.0.0.1,disable-ticketing,seamless-migration=on -device qxl-vga,id=video0,ram_size=67108864,vram_size=67108864,bus=pci.0,addr=0x2 -device intel-hda,id=sound0,bus=pci.0,addr=0x4 -device hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x7 and this error message: # virsh start f18-live error: Failed to start domain f18-live error: internal error: early end of file from monitor: possible problem: qemu-system-x86_64: -drive file=gluster://red/vol1/img,if=none,id=drive-virtio-disk1,format=raw: Gluster connection failed for server=red port=0 volume=vol1 image=img transport=tcp qemu-system-x86_64: -drive file=gluster://red/vol1/img,if=none,id=drive-virtio-disk1,format=raw: could not open disk image gluster://red/vol1/img: Transport endpoint is not connected as well as the AVC. Obviously, I've still got something wrong with my XML to not be able to connect to gluster properly; but I also don't think an AVC should be happening. Oddly enough, I get the same AVC plus two others even when re-testing in permissive mode. SELinux is preventing /usr/bin/qemu-system-x86_64 from 'search' accesses on the directory net. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that qemu-system-x86_64 should be allowed search access on the net directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep qemu-system-x86 /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:svirt_t:s0:c427,c614 Target Context system_u:object_r:sysctl_net_t:s0 Target Objects net [ dir ] Source qemu-system-x86 Source Path /usr/bin/qemu-system-x86_64 Port <Unknown> Host (removed) Source RPM Packages qemu-system-x86-1.6.0-10.fc19.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-74.9.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.10.7-200.fc19.x86_64 #1 SMP Thu Aug 15 23:19:45 UTC 2013 x86_64 x86_64 Alert Count 2 First Seen 2013-10-14 16:29:53 MDT Last Seen 2013-10-14 16:29:56 MDT Local ID 503b1f62-7bdb-4f21-9101-5b0aa4624560 Raw Audit Messages type=AVC msg=audit(1381789796.114:1255): avc: denied { search } for pid=25361 comm="qemu-system-x86" name="net" dev="proc" ino=12331 scontext=system_u:system_r:svirt_t:s0:c427,c614 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir type=SYSCALL msg=audit(1381789796.114:1255): arch=x86_64 syscall=open success=no exit=EACCES a0=7f7a2a214748 a1=0 a2=10 a3=0 items=0 ppid=1 pid=25361 auid=4294967295 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 ses=4294967295 tty=(none) comm=qemu-system-x86 exe=/usr/bin/qemu-system-x86_64 subj=system_u:system_r:svirt_t:s0:c427,c614 key=(null) Hash: qemu-system-x86,svirt_t,sysctl_net_t,dir,search Additional info: reporter: libreport-2.1.8 hashmarkername: setroubleshoot kernel: 3.10.7-200.fc19.x86_64 type: libreport
Description of problem: successfully set up libvirt to use a gluster <disk>, but got the AVC while starting the domain. # mount -t glusterfs red:/vol1 /mnt/sysroot # ls -l /mnt/sysroot/ total 0 -rw-r--r--. 1 qemu qemu 10485760 Oct 14 16:00 img # umount /mnt/sysroot domain XML includes: <disk type='network' device='disk'> <driver name='qemu' type='raw'/> <source protocol='gluster' name='vol1/img'> <host name='red'/> </source> <target dev='vdb' bus='virtio'/> <alias name='virtio-disk1'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> </disk> Additional info: reporter: libreport-2.1.8 hashmarkername: setroubleshoot kernel: 3.10.7-200.fc19.x86_64 type: libreport
Hmm - odd that the same AVC happens even when I changed gluster configuration per http://www.ovirt.org/Features/GlusterFS_Storage_Domain so that the domain actually boots. Don't know what the AVC is blocking since the domain still booted.
c1041a266f26e80a6de479c38dc4ee36711592e1 allows this in git.
back ported.
selinux-policy-3.12.1-74.11.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-74.11.fc19
Package selinux-policy-3.12.1-74.11.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-74.11.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-19794/selinux-policy-3.12.1-74.11.fc19 then log in and leave karma (feedback).
selinux-policy-3.12.1-74.11.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.