Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: SELinux is preventing prio-rpc-virtqe from 'open' accesses on the file /proc/<pid>/stat. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that prio-rpc-virtqe should be allowed open access on the stat file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'prio-rpc-virtqe' --raw | audit2allow -M my-priorpcvirtqe # semodule -X 300 -i my-priorpcvirtqe.pp Additional Information: Source Context system_u:system_r:virtqemud_t:s0 Target Context system_u:system_r:unconfined_service_t:s0 Target Objects /proc/<pid>/stat [ file ] Source prio-rpc-virtqe Source Path prio-rpc-virtqe Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-40.22-1.fc40.noarch Local Policy RPM selinux-policy-targeted-40.22-1.fc40.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.9.4-200.fc40.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Jun 12 13:33:34 UTC 2024 x86_64 Alert Count 9 First Seen 2024-05-08 15:21:12 CEST Last Seen 2024-06-19 15:59:49 CEST Local ID 214d0417-faaa-4ef4-90c4-17c79e986137 Raw Audit Messages type=AVC msg=audit(1718805589.434:2420): avc: denied { open } for pid=38594 comm="rpc-virtqemud" path="/proc/216521/stat" dev="proc" ino=2576601 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=file permissive=1 Hash: prio-rpc-virtqe,virtqemud_t,unconfined_service_t,file,open Version-Release number of selected component: selinux-policy-targeted-40.22-1.fc40.noarch Additional info: reporter: libreport-2.17.15 reason: SELinux is preventing prio-rpc-virtqe from 'open' accesses on the file /proc/<pid>/stat. package: selinux-policy-targeted-40.22-1.fc40.noarch component: selinux-policy hashmarkername: setroubleshoot type: libreport kernel: 6.9.4-200.fc40.x86_64 component: selinux-policy
Created attachment 2037827 [details] File: description
Created attachment 2037828 [details] File: os_info
These occurred while using "cockpit" to list virtual machines on localhost: $ sudo ausearch -ts today -m avc ---- time->Sun Jun 30 11:25:10 2024 type=AVC msg=audit(1719771910.940:2535): avc: denied { search } for pid=66975 comm="prio-rpc-virtqe" name="66961" dev="proc" ino=493209 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=dir permissive=1 ---- time->Sun Jun 30 11:25:10 2024 type=AVC msg=audit(1719771910.940:2536): avc: denied { read } for pid=66975 comm="prio-rpc-virtqe" name="stat" dev="proc" ino=491328 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=file permissive=1 ---- time->Sun Jun 30 11:25:10 2024 type=AVC msg=audit(1719771910.940:2537): avc: denied { open } for pid=66975 comm="prio-rpc-virtqe" path="/proc/66961/stat" dev="proc" ino=491328 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=file permissive=1 More about the processes: $ ps -f -p 66975,66961 UID PID PPID C STIME TTY TIME CMD libvirt+ 66961 1 0 11:25 ? 00:00:00 /usr/sbin/libvirt-dbus --system root 66975 1 0 11:25 ? 00:00:00 /usr/sbin/virtqemud --timeout 120 Packages: selinux-policy-40.23-1.fc40.noarch libvirt-daemon-driver-qemu-10.1.0-2.fc40.x86_64 libvirt-dbus-1.4.1-4.fc40.x86_64 cockpit-319-1.fc40.x86_64 kernel 6.9.6-200.fc40.x86_64
Thanks, this should be resolved in the latest rawhide build, please try that if you can. F40 build will follow soon.
Reproduced and tested in a fully updated F40 Workstation VM. The three AVCs reported in Comment 3 do not occur with: selinux-policy-41.7-1.fc41.noarch selinux-policy-targeted-41.7-1.fc41.noarch However, there is a new AVC*: $ sudo ausearch -ts boot -m avc -se 'virtqemud_t' ---- time->Mon Jul 1 10:21:21 2024 type=AVC msg=audit(1719854481.174:262): avc: denied { connectto } for pid=3467 comm="pool-libvirt-db" path="/run/libvirt/virtqemud-sock" scontext=system_u:system_r:virt_dbus_t:s0 tcontext=system_u:system_r:virtqemud_t:s0 tclass=unix_stream_socket permissive=0 $ ps -f -p 3467 UID PID PPID C STIME TTY TIME CMD libvirt+ 3467 1 0 10:21 ? 00:00:00 /usr/sbin/libvirt-dbus --system * There are also two 'name="memory.pressure"' AVCs, but I am assuming that those are unrelated.
I configured a new F41 Workstation VM with the rawhide selinux-policy packages* and don't see the three AVCs reported in Comment 3. Further, the 'comm="pool-libvirt-db"' AVC reported against F40 in Comment 5 does not occur. * Specifically: selinux-policy-41.7-1.fc41.noarch selinux-policy-targeted-41.7-1.fc41.noarch
Requires backport of: d467723691 Allow virt_driver_domain read virtd-lxc files in /proc
*** Bug 2283716 has been marked as a duplicate of this bug. ***
This message is a reminder that Fedora Linux 40 is nearing its end of life. Fedora will stop maintaining and issuing updates for Fedora Linux 40 on 2025-05-13. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a 'version' of '40'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, change the 'version' to a later Fedora Linux version. Note that the version field may be hidden. Click the "Show advanced fields" button if you do not see it. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora Linux 40 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora Linux, you are encouraged to change the 'version' to a later version prior to this bug being closed.
Fedora Linux 40 entered end-of-life (EOL) status on 2025-05-13. Fedora Linux 40 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora Linux please feel free to reopen this bug against that version. Note that the version field may be hidden. Click the "Show advanced fields" button if you do not see the version field. If you are unable to reopen this bug, please file a new report against an active release. Thank you for reporting this bug and we are sorry it could not be fixed.