Bug 205711 - xen guest installation avc messages
xen guest installation avc messages
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: xen (Show other bugs)
rawhide
All Linux
medium Severity medium
: ---
: ---
Assigned To: James Morris
Brian Brock
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-09-07 23:28 EDT by James Morris
Modified: 2007-11-30 17:11 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-09-18 22:23:37 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
audit log during xen guest install (43.53 KB, text/plain)
2006-09-07 23:28 EDT, James Morris
no flags Details

  None (edit)
Description James Morris 2006-09-07 23:28:34 EDT
Description of problem:

Many AVC denials are generated when installing a xen guest under current
rawhide.  We need to fix policy and apps so that there are none, and xen
can be properly tested with SELinux.

Version-Release number of selected component (if applicable):

xen-3.0.2-33

How reproducible:

Always

Steps to Reproduce:
1. Update to current rawhide, with SELinux in enforcing mode.
2. run xenguest-install
3.
  
Actual results:

see logs

Expected results:

no avc messages or errors
Comment 1 James Morris 2006-09-07 23:28:34 EDT
Created attachment 135827 [details]
audit log during xen guest install
Comment 2 James Morris 2006-09-07 23:32:35 EDT
The hotplug log file has the wrong context:

# ls -Z /var/log/xen
-rwxr-xr-x  root root system_u:object_r:xend_var_log_t xend-debug.log
-rw-r--r--  root root system_u:object_r:xend_var_log_t xend.log
-rw-r--r--  root root system_u:object_r:var_log_t      xen-hotplug.log

Leading to:
[2006-09-07 23:14:58 xend 2418] ERROR (SrvBase:87) Request wait_for_devices failed.
Traceback (most recent call last):
  File "/usr/lib/python2.4/site-packages/xen/web/SrvBase.py", line 85, in perform
    return op_method(op, req)
  File "/usr/lib/python2.4/site-packages/xen/xend/server/SrvDomain.py", line 72,
in op_wait_for_devices
    return self.dom.waitForDevices()
  File "/usr/lib/python2.4/site-packages/xen/xend/XendDomainInfo.py", line 1544,
in waitForDevices
    self.waitForDevices_(c)
  File "/usr/lib/python2.4/site-packages/xen/xend/XendDomainInfo.py", line 1075,
in waitForDevices_
    return self.getDeviceController(deviceClass).waitForDevices()
  File "/usr/lib/python2.4/site-packages/xen/xend/server/DevController.py", line
145, in waitForDevices
    return map(self.waitForDevice, self.deviceIDs())
  File "/usr/lib/python2.4/site-packages/xen/xend/server/DevController.py", line
155, in waitForDevice
    raise VmError("Device %s (%s) could not be connected. "
VmError: Device 0 (vif) could not be connected. Hotplug scripts not working.

Comment 3 Daniel Walsh 2006-09-11 09:23:03 EDT
Latest xen logs have been moved to /var/log/xen which has been labeled
appropriately in the latest policy.  Also xend now has permission to ptrace all
domains and the sys_ptrace capability.

Fixed in selinux-policy-2.3.13-3

Note You need to log in before you can comment on or make changes to this bug.