Description of problem: SELinux is preventing qemu-system-x86 from 'search' accesses on the directory 2857. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that qemu-system-x86 should be allowed search access on the 2857 directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'qemu-system-x86' --raw | audit2allow -M my-qemusystemx86 # semodule -X 300 -i my-qemusystemx86.pp Additional Information: Source Context unconfined_u:unconfined_r:svirt_t:s0:c549,c774 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects 2857 [ dir ] Source qemu-system-x86 Source Path qemu-system-x86 Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-235.fc26.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.10.0-0.rc4.git4.1.fc26.x86_64 #1 SMP Fri Jan 20 20:41:19 UTC 2017 x86_64 x86_64 Alert Count 1 First Seen 2017-01-24 10:45:56 CET Last Seen 2017-01-24 10:45:56 CET Local ID ff569795-4319-4ab7-81b3-72a981c81830 Raw Audit Messages type=AVC msg=audit(1485251156.175:474): avc: denied { search } for pid=3491 comm="qemu-system-x86" name="2857" dev="proc" ino=143538 scontext=unconfined_u:unconfined_r:svirt_t:s0:c549,c774 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir permissive=0 Hash: qemu-system-x86,svirt_t,unconfined_t,dir,search Version-Release number of selected component: selinux-policy-3.13.1-235.fc26.noarch Additional info: component: selinux-policy reporter: libreport-2.9.0 hashmarkername: setroubleshoot kernel: 4.10.0-0.rc4.git4.1.fc26.x86_64 type: libreport
This bug appears to have been reported against 'rawhide' during the Fedora 26 development cycle. Changing version to '26'.
Description of problem: Was trying to install an F26 alpha VM using boxes. Version-Release number of selected component: selinux-policy-3.13.1-251.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.0-0.rc8.git0.1.fc26.x86_64 type: libreport
Joachim, Do you know when this happened? Thanks, Lukas.
(In reply to Lukas Vrabec from comment #3) This alert occurs typically when launching or after shutting a virtual machine in gnome-boxes.
Description of problem: running boxes Version-Release number of selected component: selinux-policy-3.13.1-259.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.8-300.fc26.x86_64 type: libreport
Description of problem: running existing gnome-boxes VM Version-Release number of selected component: selinux-policy-3.13.1-259.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.8-300.fc26.x86_64 type: libreport
Description of problem: Running Fedora Rawhide inside Gnome Boxes Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.9-20170605.amdmainhyb.fc26.x86_64 type: libreport
Description of problem: I shutdown a Windows 10 VM running in Gnome Boxes. Version-Release number of selected component: selinux-policy-3.13.1-259.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.8-300.fc26.x86_64 type: libreport
Description of problem: On virtual machine shutdown. It runs on QEMU/KVM User session using a disk image on an external drive (virt_use_fusefs is on) The directory number is always different. Version-Release number of selected component: selinux-policy-3.13.1-259.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.8-300.fc26.x86_64 type: libreport
(In reply to Alexandre Fournier from comment #9) > Description of problem: > On virtual machine shutdown. > It runs on QEMU/KVM User session using a disk image on an external drive > (virt_use_fusefs is on) > The directory number is always different. > > Version-Release number of selected component: > selinux-policy-3.13.1-259.fc26.noarch > > Additional info: > reporter: libreport-2.9.1 > hashmarkername: setroubleshoot > kernel: 4.11.8-300.fc26.x86_64 > type: libreport I forgot to add, I use virt-manager so it's not specific to gnome-boxes.
Description of problem: Starting virtual machine in gnome-boxes Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.9-200.fc25.x86_64 type: libreport
Description of problem: I closed GNOME Boxes after creating and using a virtualized system. As soon as I closed it, the alert appeared. Version-Release number of selected component: selinux-policy-3.13.1-259.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.9-300.fc26.x86_64 type: libreport
Description of problem: After closing a virtual machine in GNOME Boxes, but this time it gave a different directory name "26404". Version-Release number of selected component: selinux-policy-3.13.1-259.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.9-300.fc26.x86_64 type: libreport
Description of problem: powered off a virtual machine with gnome-boxes Version-Release number of selected component: selinux-policy-3.13.1-260.1.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.10-300.fc26.x86_64 type: libreport
Description of problem: I shut down a VM via virt-manager. Version-Release number of selected component: selinux-policy-3.13.1-260.1.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.10-300.fc26.x86_64 type: libreport
Description of problem: el error salió cuando cerré una máquina virtual del programa cajas. Version-Release number of selected component: selinux-policy-3.13.1-260.1.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.10-300.fc26.x86_64 type: libreport
Description of problem: I was opening gnome-boxes Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: Open main overview of gnome-boxes. Version-Release number of selected component: selinux-policy-3.13.1-260.1.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: It happened after shutting down a virtual machine and returning to main overview of gnome-boxes. Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: Using Boxes to run two centos 7 machines. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: I guess this alert was because I tried to delete a VM via GNOME Boxes. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: I was trying to use gnome-boxes to virtualize an ArchLinux ISO. The ISO file is located at /home/renich/Downloads/. Boxes finds them there automatically. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: Shutdown a boxes VM Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: Cuando apago una máquina virtual. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: I shut down a VM in Virt Manager. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: Got this SELinux warning when running GNOME Boxes. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: Deleted a VM (which was in the process of booking F26 Workstation Live ISO) in Boxes. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: I am trying to open Gnome-boxes and always is closed when is called to start. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
*** Bug 1479033 has been marked as a duplicate of this bug. ***
Description of problem: I started a Boxes VM. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: Running a VM in virt-manager and clicking "refresh" button in OS information tab in VM dialog. Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: When I using box installing Badstore iso ... Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: Did a "poweroff" in the VM Version-Release number of selected component: selinux-policy-3.13.1-260.4.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.5-300.fc26.x86_64 type: libreport
Description of problem: running boxes Version-Release number of selected component: selinux-policy-3.13.1-260.4.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.5-300.fc26.x86_64 type: libreport
Description of problem: running cockpit-project/cockpit tests Version-Release number of selected component: selinux-policy-3.13.1-260.4.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.5-300.fc26.x86_64 type: libreport
Description of problem: A running VM was suddenly closed, not sure what caused it, I was closing firefox inside that VM with ALT+F4 key. Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
Description of problem: Running guest os Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.9-300.fc26.x86_64 type: libreport
Description of problem: This issue happens when I shut down my Windows 10 VM that's running in Boxes. Version-Release number of selected component: selinux-policy-3.13.1-260.6.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.9-300.fc26.x86_64 type: libreport
Description of problem: While running 'virt-filesystems -a ~/Downloads/xxx.qcow2' Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.9-300.fc26.x86_64 type: libreport
Description of problem: SELinux alert when closing Gnome Boxes on Fedora Cinnamon Spin Version-Release number of selected component: selinux-policy-3.13.1-260.8.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.9-300.fc26.x86_64 type: libreport
Description of problem: I shutdown a win7 virtual machine in gnome-boxes Version-Release number of selected component: selinux-policy-3.13.1-260.8.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.9-300.fc26.x86_64 type: libreport
Note: Looks like these directories are subdirs of /proc, which means they represent PIDs and that would be the reason users report different ones. I confirm I hit this one when shutting down a libvirt domain. It was a Windows 10 VM, and it happened when using virt-manager the last time. It happened two times before though, and it's very likely I might have been using virsh -- so I don't think it's related to any frontend either.
Description of problem: Not sure, when this exactly appeared, but I have downloaded Windows 10 N .iso and installed it in Gnome boxes (slow install without licence key). Than I have installe Firefox Nightly, run it, and than suspended the whole VM. Version-Release number of selected component: selinux-policy-3.13.1-260.8.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.13-300.fc26.x86_64 type: libreport
*** Bug 1493855 has been marked as a duplicate of this bug. ***
Description of problem: Just normal use of GNOME Boxes Version-Release number of selected component: selinux-policy-3.13.1-260.6.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.13-300.fc26.x86_64 type: libreport
Does it break anything or you just see this AVC denial? Lukas.
(In reply to Lukas Vrabec from comment #46) > Does it break anything or you just see this AVC denial? > > Lukas. I'm genuinely not sure. My VM is not working, but I have no clue if it's related to this denial.
(In reply to Lukas Vrabec from comment #46) > Does it break anything or you just see this AVC denial? > > Lukas. I haven't noticed any issue when using the VM.
Hello. Exact same issue since upgrade F25->F26, with gnome-boxes or virt-manager. By the way VMs don't work at all, stuck on boot screen. Solution provided in troubleshoot does nothing: # ausearch -c 'qemu-system-x86' --raw | audit2allow -M my-qemusystemx86 # semodule -X 300 -i my-qemusystemx86.pp Tried to turn on some related booleans, no success.
(In reply to Lukas Vrabec from comment #46) > Does it break anything or you just see this AVC denial? > > Lukas. Similar to Alexandre, VM booting is unreliable, sometimes the same VM boots, sometimes it doesn't start at all, sometimes it hangs midway. Currently I cant reliably get Boxes to start at all. It's possible this isn't all related, I certainly haven't been able to isolate it to SELinux.
Description of problem: I've got this error when I shut down the Windows 10 Pro Virtual Machine (GNOME Boxes). I don't know what this is, but still I preffered to report it in case it's a bug. Version-Release number of selected component: selinux-policy-3.13.1-260.9.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.13-300.fc26.x86_64 type: libreport
Description of problem: I get this error every time I shut down Windows 10 GNOME Box Version-Release number of selected component: selinux-policy-3.13.1-260.9.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.13-300.fc26.x86_64 type: libreport
Description of problem: The error popped up while running dnf upgrade -y Version-Release number of selected component: selinux-policy-3.13.1-260.8.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.13-300.fc26.x86_64 type: libreport
Adding on to my comment, I ran the "dnf upgrade" after closing a Windows 10 VM in GNOME Boxes, so I think it is related to the other reports.
Description of problem: The error occures every time I shut down a GNOME Box with Windows 10 Pro Version-Release number of selected component: selinux-policy-3.13.1-260.9.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.14-300.fc26.x86_64 type: libreport
I would figure this is some relationship between the process that started the VM, gnome-boxes, and the qemu process running the VM. For some attempting to traverse /proc/pid of the calling starting process I would figure. Another assumption would be the qemu process is walking through the processes in /proc and triggered this AVC. I would just dontaudit this AVC. We already these dontaudit rules dontaudit svirt_t init_t:dir { getattr open search }; dontaudit svirt_t virtd_t:dir { getattr open search }; Which looks like the qemu process trying to search the directory of the tools that started the VM.
I agree, it looks like dontaudit rule si fine here. Moving to POST.
Description of problem: Hi, I get this warning everytime a VM is shutdown. Only tested with Windows 10 VM. Host is Fedora 26 with all updates installed. "qemu-system-x86 search access to directory 4072 was denied" $ ls -l /proc/4072/exe lrwxrwxrwx. 1 user domänen-benutzer 0 5. Okt 13:55 /proc/4072/exe -> /usr/sbin/libvirtd Version-Release number of selected component: selinux-policy-3.13.1-260.10.fc26.noarch Additional info: reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.13.4-200.fc26.x86_64 type: libreport
selinux-policy-3.13.1-260.14.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-d312739a4e
*** Bug 1507855 has been marked as a duplicate of this bug. ***
selinux-policy-3.13.1-260.14.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.