Bug 1368923 - [Regression] Error starting domain: SELinux policy denies access.
Summary: [Regression] Error starting domain: SELinux policy denies access.
Keywords:
Status: CLOSED DUPLICATE of bug 1368745
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 24
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Ben Levenson
URL:
Whiteboard:
: 1369040 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-22 06:47 UTC by Joseph D. Wagner
Modified: 2016-08-23 01:19 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-08-23 01:19:15 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Joseph D. Wagner 2016-08-22 06:47:59 UTC
Description of problem:
Cannot start any virtual machine.

Error starting domain: SELinux policy denies access.

Traceback (most recent call last):
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 88, in cb_wrapper
    callback(asyncjob, *args, **kwargs)
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 124, in tmpcb
    callback(*args, **kwargs)
  File "/usr/share/virt-manager/virtManager/libvirtobject.py", line 83, in newfn
    ret = fn(self, *args, **kwargs)
  File "/usr/share/virt-manager/virtManager/domain.py", line 1404, in startup
    self._backend.create()
  File "/usr/lib64/python2.7/site-packages/libvirt.py", line 1035, in create
    if ret == -1: raise libvirtError ('virDomainCreate() failed', dom=self)
libvirtError: SELinux policy denies access.

It was working under selinux-policy.noarch 3.13.1-191.10.fc24, but it broke after updating to selinux-policy.noarch 3.13.1-191.12.fc24.

Switching to permissive mode allows the virtual machines to start.

Relabeling the file system (touch /.autorelabel) had no effect.

From audit.log:
type=USER_AVC msg=audit(1471845662.810:227): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { start } for auid=n/a uid=0 gid=0 cmdline="/usr/lib/systemd/systemd-machined" scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=system  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1471845736.500:290): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { start } for auid=n/a uid=0 gid=0 cmdline="/usr/lib/systemd/systemd-machined" scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=system  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1471847572.100:321): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { stop } for auid=n/a uid=0 gid=0 cmdline="/usr/lib/systemd/systemd-machined" scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=system  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1471847928.072:230): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { start } for auid=n/a uid=0 gid=0 cmdline="/usr/lib/systemd/systemd-machined" scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=system  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'

Comment 1 Alexander Dalloz 2016-08-22 13:16:07 UTC
*** Bug 1369040 has been marked as a duplicate of this bug. ***

Comment 2 Jan Vlug 2016-08-22 14:00:25 UTC
Duplicate of Bug 1368745?

Comment 3 Joseph D. Wagner 2016-08-23 01:19:15 UTC
Looks like it is a duplicate of bug 1368745?.  Sorry I didn't see that before filing this bug report.

*** This bug has been marked as a duplicate of bug 1368745 ***


Note You need to log in before you can comment on or make changes to this bug.