RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1558121 - not able to install vms on rhel 7.4 with selinux mls enabled
Summary: not able to install vms on rhel 7.4 with selinux mls enabled
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.4
Hardware: Unspecified
OS: Linux
high
medium
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks: 1653106
TreeView+ depends on / blocked
 
Reported: 2018-03-19 16:48 UTC by Marian Jankular
Modified: 2021-06-10 15:24 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-08-06 12:51:45 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:2127 0 None None None 2019-08-06 12:52:06 UTC

Description Marian Jankular 2018-03-19 16:48:18 UTC 
Description of problem:
not able to install vms on rhel 7.4 with selinux mls enabled

Version-Release number of selected component (if applicable):


How reproducible:
always

Steps to Reproduce:
1.install rhel 7.4 with kvm
2. enable mls 
3. try to create vm 

Actual results:
vm will be installed

Expected results:
-bash-4.2# chmod +x create-vm.sh 
-bash-4.2# ./create-vm.sh 
WARNING  CDROM media does not print to the text console by default, so you likely will not see text install output. You might want to use --location. See the man page for examples of using --location with CDROM media

Starting install...
Allocating 'fedora_atomic.img'                                                                                                                                                                                                                          | 6.0 GB  00:00:00     
ERROR    unable to set security context 'system_u:object_r:virt_image_t:s0:c562,c828' on '/var/lib/libvirt/qemu/domain-1-fedora_atomic': Permission denied
Removing disk 'fedora_atomic.img'                                                                                                                                                                                                                       |    0 B  00:00:00     
Domain installation does not appear to have been successful.
If it was, you can restart your domain by running:
  virsh --connect qemu:///system start fedora_atomic
otherwise, please restart your installation.


bash-4.2# ausearch -m AVC -ts boot -se virt
----
time->Mon Mar 19 16:38:38 2018
type=PROCTITLE msg=audit(1521477518.884:63): proctitle=2F7573722F62696E2F707974686F6E002F7573722F73686172652F6F766972742D67756573742D6167656E742F6F766972742D67756573742D6167656E742E7079
type=SYSCALL msg=audit(1521477518.884:63): arch=c000003e syscall=2 success=no exit=-13 a0=105c560 a1=2 a2=1ff a3=65722e6d6f632f73 items=0 ppid=1 pid=727 auid=4294967295 uid=175 gid=175 euid=175 suid=175 fsuid=175 egid=175 sgid=175 fsgid=175 tty=(none) ses=4294967295 comm="python" exe="/usr/bin/python2.7" subj=system_u:system_r:init_t:s0-s15:c0.c1023 key=(null)
type=AVC msg=audit(1521477518.884:63): avc:  denied  { read write } for  pid=727 comm="python" name="vport2p1" dev="devtmpfs" ino=1802 scontext=system_u:system_r:init_t:s0-s15:c0.c1023 tcontext=system_u:object_r:virtio_device_t:s0 tclass=chr_file
----
time->Mon Mar 19 16:44:01 2018
type=PROCTITLE msg=audit(1521477841.945:342): proctitle="/usr/sbin/libvirtd"
type=SYSCALL msg=audit(1521477841.945:342): arch=c000003e syscall=188 success=no exit=-13 a0=7f7cf0002ed0 a1=7f7d1b376f8a a2=7f7cf0003540 a3=2c items=0 ppid=1 pid=1139 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0-s15:c0.c1023 key=(null)
type=AVC msg=audit(1521477841.945:342): avc:  denied  { relabelfrom } for  pid=1139 comm="libvirtd" name="domain-1-fedora_atomic" dev="dm-0" ino=101133452 scontext=system_u:system_r:virtd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:virt_var_lib_t:s0 tclass=dir

Mar 19 16:43:59 localhost libvirtd: 2018-03-19 16:43:59.378+0000: 1230: error : virNodeSuspendSupportsTarget:336 : internal error: Cannot probe for supported suspend types
Mar 19 16:43:59 localhost libvirtd: 2018-03-19 16:43:59.379+0000: 1230: warning : virQEMUCapsInit:1143 : Failed to get host power management capabilities
Mar 19 16:44:01 localhost libvirtd: 2018-03-19 16:44:01.946+0000: 1228: error : virSecuritySELinuxSetFileconHelper:1182 : unable to set security context 'system_u:object_r:virt_image_t:s0:c562,c828' on '/var/lib/libvirt/qemu/domain-1-fedora_atomic': Permission denied
Mar 19 16:44:01 localhost systemd: Started Virtual machine log manager.
Mar 19 16:44:01 localhost systemd: Starting Virtual machine log manager...


Additional info:
install is failing with virt-install and virt-manager as well
Comment 2 h0neybadger 2018-04-08 09:00:53 UTC 
I managed to find a solution.
The main issue was the following message 
----
type=PROCTITLE msg=audit(04/08/2018 09:53:23.959:34954) : proctitle=/usr/sbin/libvirtd 
type=SYSCALL msg=audit(04/08/2018 09:53:23.959:34954) : arch=x86_64 syscall=setxattr success=no exit=EPERM(Operation not permitted) a0=0x7f50b0001070 a1=0x7f50de458f8a a2=0x7f50b0007520 a3=0x2c items=0 ppid=1 pid=1266 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=libvirtd exe=/usr/sbin/libvirtd subj=system_u:system_r:virtd_t:s0-s15:c0.c1023 key=(null) 
type=SELINUX_ERR msg=audit(04/08/2018 09:53:23.959:34954) : op=security_validate_transition seresult=denied oldcontext=system_u:object_r:qemu_var_run_t:s0 newcontext=system_u:object_r:virt_image_t:s0:c267,c728 taskcontext=system_u:system_r:virtd_t:s0-s15:c0.c1023 tclass=dir 
----

I fixed it with the following custom module:

# custom_virt.te ############################# 
policy_module(custom_virt, 0.0.1)

gen_require(`
    type virtd_t;
    type qemu_var_run_t;
    type virt_image_t;
    type virtlogd_t;
')

# type=SELINUX_ERR msg=audit(04/07/2018 08:52:14.344:34391) :
# op=security_validate_transition
# seresult=denied
# oldcontext=system_u:object_r:qemu_var_run_t:s0
# newcontext=system_u:object_r:virt_image_t:s0:c92,c644
# taskcontext=system_u:system_r:virtd_t:s0-s15:c0.c1023
# tclass=dir

ifdef(`enable_mls',`
    mls_file_upgrade(virtd_t)
')

allow virtd_t qemu_var_run_t:dir relabelfrom;
allow virtd_t virt_image_t:dir relabelto;

# ERROR    Failed to recv file descriptor: Permission denied
# Removing disk 'fedora_server.img'

ifdef(`enable_mls',`
    mls_file_write_to_clearance(virtd_t)
')

allow virtd_t virt_image_t:dir rmdir;
allow virtd_t virtlogd_t:fifo_file write;

# custom_virt.te #############################
##############################################

I hope this helps,
Comment 12 errata-xmlrpc 2019-08-06 12:51:45 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2127
Note You need to log in before you can comment on or make changes to this bug.