Bug 1459875 - the xen_image plugin should also match AVCs where source type = virsh_t
the xen_image plugin should also match AVCs where source type = virsh_t
Status: NEW
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: setroubleshoot-plugins (Show other bugs)
7.4
All Linux
medium Severity medium
: rc
: ---
Assigned To: Petr Lautrbach
Milos Malik
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-06-08 08:29 EDT by Milos Malik
Modified: 2017-08-08 03:53 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1459835
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Milos Malik 2017-06-08 08:29:11 EDT
Description of problem:
* the xen_image plugin matches only AVCs where source type is xend_t or xm_t, but xm_t is an alias for virsh_t on RHEL-7
* as a result the xen_image plugin only matches AVCs caused by processes running under xend_t

# seinfo -txm_t -x
   TypeName virsh_t
   Aliases
      xm_t
#

Version-Release number of selected component (if applicable):
setroubleshoot-server-3.2.28-3.el7.x86_64
setroubleshoot-plugins-3.0.65-1.el7.noarch

How reproducible:
* always

Steps to Reproduce:
1. get a RHEL-7.3 or RHEL-7.4 machine (targeted policy is active)
2. run following automated TC:
 * /CoreOS/setroubleshoot-plugins/Sanity/xen_image
3. sealert -l '*'

Actual results:
 * the xen_image plugin report does NOT appear in the output of sealert

Expected results:
 * the xen_image plugin report appears in the output of sealert

Note You need to log in before you can comment on or make changes to this bug.