Bug 2315512 - SELinux is preventing pool-geoclue from 'search' accesses on the directory /var/lib/libvirt.
Summary: SELinux is preventing pool-geoclue from 'search' accesses on the directory /v...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 41
Hardware: x86_64
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:00cdeac2634c47583b74b7c758f...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-09-29 04:39 UTC by Renich Bon Ciric
Modified: 2025-06-04 03:34 UTC (History)
8 users (show)

Fixed In Version: selinux-policy-41.41-1.fc41
Clone Of:
Environment:
Last Closed: 2025-06-04 03:34:51 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: description (1.97 KB, text/plain)
2024-09-29 04:39 UTC, Renich Bon Ciric
no flags Details
File: os_info (756 bytes, text/plain)
2024-09-29 04:39 UTC, Renich Bon Ciric
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 2678 0 None open Allow geoclue search virt lib directory 2025-05-14 14:30:37 UTC
Red Hat Issue Tracker FC-1648 0 None None None 2025-05-06 15:55:28 UTC

Description Renich Bon Ciric 2024-09-29 04:39:22 UTC
Description of problem:
I have virt-manager open. I am trying to start a new guest in Fedora 41 and it is not allowing me. 
SELinux is preventing pool-geoclue from 'search' accesses on the directory /var/lib/libvirt.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that pool-geoclue should be allowed search access on the libvirt directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'pool-geoclue' --raw | audit2allow -M my-poolgeoclue
# semodule -X 300 -i my-poolgeoclue.pp

Additional Information:
Source Context                system_u:system_r:geoclue_t:s0
Target Context                system_u:object_r:virt_var_lib_t:s0
Target Objects                /var/lib/libvirt [ dir ]
Source                        pool-geoclue
Source Path                   pool-geoclue
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           libvirt-daemon-common-10.6.0-5.fc41.x86_64
SELinux Policy RPM            selinux-policy-targeted-41.19-1.fc41.noarch
Local Policy RPM              selinux-policy-targeted-41.19-1.fc41.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 6.11.0-63.fc41.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Sun Sep 15 17:48:54 UTC 2024
                              x86_64
Alert Count                   4
First Seen                    2024-09-28 22:38:19 CST
Last Seen                     2024-09-28 22:38:19 CST
Local ID                      66920ad1-64c5-420f-949e-1fb6debfafe1

Raw Audit Messages
type=AVC msg=audit(1727584699.664:1239): avc:  denied  { search } for  pid=2073 comm="pool-geoclue" name="libvirt" dev="nvme1n1p2" ino=478 scontext=system_u:system_r:geoclue_t:s0 tcontext=system_u:object_r:virt_var_lib_t:s0 tclass=dir permissive=0


Hash: pool-geoclue,geoclue_t,virt_var_lib_t,dir,search

Version-Release number of selected component:
selinux-policy-targeted-41.19-1.fc41.noarch

Additional info:
reporter:       libreport-2.17.15
reason:         SELinux is preventing pool-geoclue from 'search' accesses on the directory /var/lib/libvirt.
package:        selinux-policy-targeted-41.19-1.fc41.noarch
component:      selinux-policy
hashmarkername: setroubleshoot
type:           libreport
kernel:         6.11.0-63.fc41.x86_64
event_log:      2024-09-28-22:38:48> Looking for similar problems in bugzilla
comment:        I have virt-manager open. I am trying to start a new guest in Fedora 41 and it is not allowing me. 
component:      selinux-policy

Comment 1 Renich Bon Ciric 2024-09-29 04:39:24 UTC
Created attachment 2049349 [details]
File: description

Comment 2 Renich Bon Ciric 2024-09-29 04:39:25 UTC
Created attachment 2049350 [details]
File: os_info

Comment 3 Fedora Update System 2025-05-30 14:00:34 UTC
FEDORA-2025-cc4083b3f2 (selinux-policy-41.41-1.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-cc4083b3f2

Comment 4 Fedora Update System 2025-05-31 00:53:29 UTC
FEDORA-2025-cc4083b3f2 has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-cc4083b3f2`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-cc4083b3f2

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2025-06-04 03:34:51 UTC
FEDORA-2025-cc4083b3f2 (selinux-policy-41.41-1.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.