Fedora Account System
Red Hat Associate
Red Hat Customer
As the summary. Version: libvirt-10.4.0-2.fc41.x86_64 selinux-policy-41.2-1.fc41.noarch Reproducible: Always Steps to Reproduce: # virt-admin -c virtnetworkd:///system error: Failed to connect to the admin server error: Cannot recv data: Connection reset by peer Audit log: type=AVC msg=audit(1718089217.645:803522): avc: denied { search } for pid=3942531 comm="virtnetworkd" name="3942735" dev="proc" ino=29488503 scontext=system_u:system_r:virtnetworkd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir permissive=0 Actual Results: As above Expected Results: virt-admin login to the shell
It doesn't work on libvirt-10.1.0-2.fc40.x86_64 selinux-policy-40.20-1.fc40.noarch either
The following SELinux denial appeared in enforcing mode: ---- type=PROCTITLE msg=audit(06/11/2024 03:35:58.951:1746) : proctitle=/usr/sbin/virtnetworkd --timeout 120 type=PATH msg=audit(06/11/2024 03:35:58.951:1746) : item=0 name=/proc/5741/stat nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(06/11/2024 03:35:58.951:1746) : cwd=/ type=SYSCALL msg=audit(06/11/2024 03:35:58.951:1746) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x55d5506deb30 a2=O_RDONLY a3=0x0 items=1 ppid=1 pid=5646 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=virtnetworkd exe=/usr/sbin/virtnetworkd subj=system_u:system_r:virtnetworkd_t:s0 key=(null) type=AVC msg=audit(06/11/2024 03:35:58.951:1746) : avc: denied { search } for pid=5646 comm=virtnetworkd name=5741 dev="proc" ino=34144 scontext=system_u:system_r:virtnetworkd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir permissive=0 ---- The following SELinux denials appeared in permissive mode: ---- type=PROCTITLE msg=audit(06/11/2024 03:37:56.377:1776) : proctitle=/usr/sbin/virtnetworkd --timeout 120 type=PATH msg=audit(06/11/2024 03:37:56.377:1776) : item=0 name=/proc/5773/stat inode=35154 dev=00:16 mode=file,444 ouid=root ogid=root rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(06/11/2024 03:37:56.377:1776) : cwd=/ type=SYSCALL msg=audit(06/11/2024 03:37:56.377:1776) : arch=x86_64 syscall=openat success=yes exit=18 a0=AT_FDCWD a1=0x55f3cb26cb90 a2=O_RDONLY a3=0x0 items=1 ppid=1 pid=5775 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=virtnetworkd exe=/usr/sbin/virtnetworkd subj=system_u:system_r:virtnetworkd_t:s0 key=(null) type=AVC msg=audit(06/11/2024 03:37:56.377:1776) : avc: denied { open } for pid=5775 comm=virtnetworkd path=/proc/5773/stat dev="proc" ino=35154 scontext=system_u:system_r:virtnetworkd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file permissive=1 type=AVC msg=audit(06/11/2024 03:37:56.377:1776) : avc: denied { read } for pid=5775 comm=virtnetworkd name=stat dev="proc" ino=35154 scontext=system_u:system_r:virtnetworkd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file permissive=1 type=AVC msg=audit(06/11/2024 03:37:56.377:1776) : avc: denied { search } for pid=5775 comm=virtnetworkd name=5773 dev="proc" ino=35035 scontext=system_u:system_r:virtnetworkd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir permissive=1 ----
Using the virt-admin command, similar issues can be reproduced for other virt* services.
# for I in `find /usr/lib/systemd/system -type f -name virt\*.service | cut -d / -f 6 | cut -d . -f 1` ; do service $I start ; virt-admin -c $I:///system exit ; done When all SELinux denials that appeared in enforcing mode are analyzed by audit2allow, the output looks this way: #============= virtnetworkd_t ============== allow virtnetworkd_t unconfined_t:dir search; allow virtnetworkd_t unconfined_t:file { open read }; #============= virtnodedevd_t ============== allow virtnodedevd_t unconfined_t:dir search; #============= virtnwfilterd_t ============== allow virtnwfilterd_t unconfined_t:dir search; #============= virtsecretd_t ============== allow virtsecretd_t unconfined_t:dir search; allow virtsecretd_t unconfined_t:file { open read }; #============= virtstoraged_t ============== allow virtstoraged_t unconfined_t:dir search; allow virtstoraged_t unconfined_t:file { open read }; #============= virtvboxd_t ============== allow virtvboxd_t unconfined_t:dir search; allow virtvboxd_t unconfined_t:file { open read };
When all SELinux denials that appeared in permissive mode are analyzed by audit2allow, the output looks this way: #============= virtnetworkd_t ============== allow virtnetworkd_t unconfined_t:dir search; allow virtnetworkd_t unconfined_t:file { open read }; #============= virtnodedevd_t ============== allow virtnodedevd_t unconfined_t:dir search; allow virtnodedevd_t unconfined_t:file { open read }; #============= virtnwfilterd_t ============== allow virtnwfilterd_t unconfined_t:dir search; allow virtnwfilterd_t unconfined_t:file { open read }; #============= virtsecretd_t ============== allow virtsecretd_t unconfined_t:dir search; allow virtsecretd_t unconfined_t:file { open read }; #============= virtstoraged_t ============== allow virtstoraged_t unconfined_t:dir search; allow virtstoraged_t unconfined_t:file { open read }; #============= virtvboxd_t ============== allow virtvboxd_t unconfined_t:dir search; allow virtvboxd_t unconfined_t:file { open read };
Test coverage for this bug exists in a form of PR: * https://src.fedoraproject.org/tests/selinux/pull-request/510 The PR waits for a review.