Hide Forgot
Description of problem: started vm SELinux is preventing qemu-system-x86 from 'read' accesses on the directory images. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* If you want to allow qemu-system-x86 to have read access on the images directory Then you need to change the label on images Do # semanage fcontext -a -t FILE_TYPE 'images' where FILE_TYPE is one of the following: alsa_etc_rw_t, bin_t, boot_t, cert_t, device_t, devpts_t, dosfs_t, etc_runtime_t, etc_t, fonts_cache_t, fonts_t, home_root_t, hugetlbfs_t, lib_t, locale_t, man_cache_t, man_t, net_conf_t, proc_t, public_content_rw_t, public_content_t, qemu_var_run_t, root_t, shell_exec_t, src_t, svirt_home_t, svirt_image_t, svirt_tmp_t, svirt_tmpfs_t, sysfs_t, system_conf_t, system_db_t, textrel_shlib_t, tmp_t, tmpfs_t, usbfs_t, user_tmp_t, usr_t, var_run_t, var_t, virt_cache_t, virt_content_t, virt_home_t. Then execute: restorecon -v 'images' ***** Plugin catchall (17.1 confidence) suggests ************************** If you believe that qemu-system-x86 should be allowed read access on the images directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep qemu-system-x86 /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:svirt_t:s0:c230,c562 Target Context unconfined_u:object_r:mnt_t:s0 Target Objects images [ dir ] Source qemu-system-x86 Source Path qemu-system-x86 Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-128.21.fc22.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.4.6-201.fc22.x86_64 #1 SMP Wed Mar 30 18:30:16 UTC 2016 x86_64 x86_64 Alert Count 1 First Seen 2016-04-23 20:18:54 BST Last Seen 2016-04-23 20:18:54 BST Local ID fa6c8bee-e17e-4916-8d6d-9f7419e48a1f Raw Audit Messages type=AVC msg=audit(1461439134.862:2488): avc: denied { read } for pid=32675 comm="qemu-system-x86" name="images" dev="dm-3" ino=283912 scontext=system_u:system_r:svirt_t:s0:c230,c562 tcontext=unconfined_u:object_r:mnt_t:s0 tclass=dir permissive=0 Hash: qemu-system-x86,svirt_t,mnt_t,dir,read Version-Release number of selected component: selinux-policy-3.13.1-128.21.fc22.noarch Additional info: reporter: libreport-2.6.4 hashmarkername: setroubleshoot kernel: 4.4.6-201.fc22.x86_64 type: libreport
Hi, Could you attach output of # ls -Z /var/lib/libvirt/ I believe /var/lib/libvirt/images has mnt_t label which is wrong. Could you use # restorecon -Rv /var/lib/libvirt/images to fix wrong labels.
[root@morgansmachine ~]# ls -Z /var/lib/libvirt/ system_u:object_r:virt_content_t:s0 boot system_u:object_r:virt_var_lib_t:s0 lxc system_u:object_r:virt_var_lib_t:s0 dnsmasq system_u:object_r:virt_var_lib_t:s0 network system_u:object_r:virt_var_lib_t:s0 filesystems system_u:object_r:qemu_var_run_t:s0 qemu system_u:object_r:virt_image_t:s0 images system_u:object_r:virt_var_lib_t:s0 uml system_u:object_r:virt_var_lib_t:s0 libxl system_u:object_r:virt_var_lib_t:s0 xen [root@morgansmachine ~]# Many thanks
Description of problem: Starting a f20 virtual machine Version-Release number of selected component: selinux-policy-3.13.1-128.28.fc22.noarch Additional info: reporter: libreport-2.6.4 hashmarkername: setroubleshoot kernel: 4.4.9-200.fc22.x86_64 type: libreport