Description of problem:

Since an update last night to selinux-policy-3.13.1-191.17.fc24.noarch and qemu-2.6.2-1.fc24.x86_64 our kvm virtual machine was broken since it count not write to /dev/vdb any more.

I had added a LVM partition as a second disk to a kvm machine. I is available as /dev/vdb in that machine. Since the time of the update on the kvm host I got messages like this on the kvm machine:

kernel: blk_update_request: I/O error, dev vdb, sector 189268992
kernel: EXT4-fs warning (device vdb): ext4_end_bio:315: I/O error -5 writing to inode 2097154 (offset 0 size 249856 starting block 23658685)
kernel: Buffer I/O error on device vdb, logical block 23658624
...
kernel: Aborting journal on device vdb-8.
kernel: Buffer I/O error on dev vdb, logical block 39354368, lost sync page write
kernel: JBD2: Error -5 detected when updating journal superblock for vdb-8.
kernel: blk_update_request: I/O error, dev vdb, sector 0
kernel: Buffer I/O error on dev vdb, logical block 0, lost sync page write
kernel: EXT4-fs error (device vdb): ext4_journal_check_start:56: Detected aborted journal
kernel: EXT4-fs (vdb): Remounting filesystem read-only


On the kvm server I got message like this:


# LANG=C sealert -l ff4b6abf-e9bd-4990-83eb-2040df85b97d
SELinux is preventing worker from write access on the blk_file /dev/dm-18.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that worker should be allowed write access on the dm-18 blk_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'worker' --raw | audit2allow -M my-worker
# semodule -X 300 -i my-worker.pp


Additional Information:
Source Context                system_u:system_r:svirt_t:s0:c338,c965
Target Context                system_u:object_r:fixed_disk_device_t:s0
Target Objects                /dev/dm-18 [ blk_file ]
Source                        worker
Source Path                   worker
Port                          <Unknown>
Host                          myvirtserver.example.com
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-191.17.fc24.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     myvirtserver.example.com
Platform                      Linux myvirtserver.example.com
                              4.6.6-300.fc24.x86_64 #1 SMP Wed Aug 10 21:07:35
                              UTC 2016 x86_64 x86_64
Alert Count                   8
First Seen                    2016-10-04 01:40:16 CEST
Last Seen                     2016-10-04 09:26:36 CEST
Local ID                      ff4b6abf-e9bd-4990-83eb-2040df85b97d

Raw Audit Messages
type=AVC msg=audit(1475565996.397:163980): avc:  denied  { write } for  pid=3789 comm="worker" path="/dev/dm-18" dev="devtmpfs" ino=28889 scontext=system_u:system_r:svirt_t:s0:c338,c965 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=0


Hash: worker,svirt_t,fixed_disk_device_t,blk_file,write



I have created a my-worker.pp module like suggested by the command, and applied it on the server. After reboot of the kvm machine it works again.

But why did someone change the policy that disallows importing raw disk space as block device to a kvm machine? Why did you break our kvm machine?

Here the contents of the selinux module:

# cat my-worker.te

module my-worker 1.0;

require {
	type fixed_disk_device_t;
	type svirt_t;
	class blk_file { read write };
}

#============= svirt_t ==============
allow svirt_t fixed_disk_device_t:blk_file { read write };




Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-191.17.fc24.noarch
qemu-2.6.2-1.fc24.x86_64
kernel-4.6.6-300.fc24.x86_64

(I didn't boot newer kernel on this server because of running processes.)

How reproducible:
Always