Bug 1487288 - The qemu-kvm process got an AVC on starting a guest in OVS-dpdk environment [NEEDINFO]
Summary: The qemu-kvm process got an AVC on starting a guest in OVS-dpdk environment
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.4
Hardware: x86_64
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-08-31 14:41 UTC by Jean-Tsung Hsiao
Modified: 2018-04-10 12:42 UTC (History)
15 users (show)

Fixed In Version: selinux-policy-3.13.1-175.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-04-10 12:42:01 UTC
Target Upstream Version:
mmalik: needinfo? (jhsiao)


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:0763 0 None None None 2018-04-10 12:42:56 UTC

Description Jean-Tsung Hsiao 2017-08-31 14:41:28 UTC
Description of problem: The qemu-kvm process got an AVC on starting a guest in OVS-dpdk environment


Version-Release number of selected component (if applicable):
qemu-kvm-rhev-2.9.0-20.el7a.x86_64

openvswitch-selinux-policy-2.8.90-2.fc25.noarch

kernel-3.10.0-693.el7.x86_64

openvswitch-2.8.0-0.1.20170810git3631ed2.el7fdb.x86_64

How reproducible:reproducible


Steps to Reproduce:
0. Set selinux to permissive
1. Create an OVS 2.8.0 OVS-dpdk bridge with vhostusers
2. Start a guest
3. Should a audit message like:
type=AVC msg=audit(1504190214.374:3823): avc:  denied  { connectto } for  pid=8699 comm="qemu-kvm" path="/run/openvswitch/vhost0" scontext=system_u:system_r:svirt_t:s0:c238,c545 tcontext=system_u:system_r:openvswitch_t:s0 tclass=unix_stream_socket

Actual results:
The qemu-kvm process got an AVC.

Expected results:
The qemu-kvm process should not get an AVC.


Additional info:

Comment 6 Milos Malik 2018-01-29 12:57:27 UTC
Could you re-test your scenario with the latest selinux-policy installed? Let us know if you encounter additional SELinux denials. Thanks

Comment 9 errata-xmlrpc 2018-04-10 12:42:01 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0763


Note You need to log in before you can comment on or make changes to this bug.