Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: I ran virt-manager. This denial started occurring constantly, every few seconds. Journal messages: Oct 03 15:01:12 xps13a.happyassassin.net systemd[1]: Listening on virtnetworkd-admin.socket - libvirt network daemon admin socket. Oct 03 15:01:12 xps13a.happyassassin.net systemd[1]: Listening on virtnetworkd-ro.socket - libvirt network daemon read-only socket. Oct 03 15:01:12 xps13a.happyassassin.net systemd[1]: Starting virtnetworkd.service - libvirt network daemon... Oct 03 15:01:12 xps13a.happyassassin.net systemd[1]: Started virtnetworkd.service - libvirt network daemon. Oct 03 15:01:12 xps13a.happyassassin.net audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=virtnetworkd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Oct 03 15:01:12 xps13a.happyassassin.net kernel: bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. Oct 03 15:01:12 xps13a.happyassassin.net NetworkManager[2154]: <info> [1727992872.0982] manager: (virbr0): new Bridge device (/org/freedesktop/NetworkManager/Devices/4) Oct 03 15:01:12 xps13a.happyassassin.net audit[48297]: NETFILTER_CFG table=libvirt_network:8 family=2 entries=1 op=nft_register_table pid=48297 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48298]: NETFILTER_CFG table=libvirt_network:9 family=2 entries=1 op=nft_register_chain pid=48298 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48299]: NETFILTER_CFG table=libvirt_network:10 family=2 entries=1 op=nft_register_chain pid=48299 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48300]: NETFILTER_CFG table=libvirt_network:11 family=2 entries=1 op=nft_register_rule pid=48300 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48301]: NETFILTER_CFG table=libvirt_network:12 family=2 entries=1 op=nft_register_chain pid=48301 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48302]: NETFILTER_CFG table=libvirt_network:13 family=2 entries=1 op=nft_register_rule pid=48302 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48303]: NETFILTER_CFG table=libvirt_network:14 family=2 entries=1 op=nft_register_chain pid=48303 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48304]: NETFILTER_CFG table=libvirt_network:15 family=2 entries=1 op=nft_register_rule pid=48304 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48305]: NETFILTER_CFG table=libvirt_network:16 family=2 entries=1 op=nft_register_chain pid=48305 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48307]: NETFILTER_CFG table=libvirt_network:17 family=10 entries=1 op=nft_register_table pid=48307 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48308]: NETFILTER_CFG table=libvirt_network:18 family=10 entries=1 op=nft_register_chain pid=48308 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48309]: NETFILTER_CFG table=libvirt_network:19 family=10 entries=1 op=nft_register_chain pid=48309 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48310]: NETFILTER_CFG table=libvirt_network:20 family=10 entries=1 op=nft_register_rule pid=48310 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48311]: NETFILTER_CFG table=libvirt_network:21 family=10 entries=1 op=nft_register_chain pid=48311 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48312]: NETFILTER_CFG table=libvirt_network:22 family=10 entries=1 op=nft_register_rule pid=48312 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48313]: NETFILTER_CFG table=libvirt_network:23 family=10 entries=1 op=nft_register_chain pid=48313 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48314]: NETFILTER_CFG table=libvirt_network:24 family=10 entries=1 op=nft_register_rule pid=48314 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48315]: NETFILTER_CFG table=libvirt_network:25 family=10 entries=1 op=nft_register_chain pid=48315 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[2131]: NETFILTER_CFG table=firewalld:26 family=1 entries=121 op=nft_register_chain pid=2131 subj=system_u:system_r:firewalld_t:s0 comm="firewalld" Oct 03 15:01:12 xps13a.happyassassin.net audit[48319]: NETFILTER_CFG table=libvirt_network:27 family=2 entries=1 op=nft_register_rule pid=48319 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48321]: NETFILTER_CFG table=libvirt_network:28 family=2 entries=1 op=nft_register_rule pid=48321 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48322]: NETFILTER_CFG table=libvirt_network:29 family=2 entries=1 op=nft_register_rule pid=48322 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48323]: NETFILTER_CFG table=libvirt_network:30 family=2 entries=1 op=nft_register_rule pid=48323 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48324]: NETFILTER_CFG table=libvirt_network:31 family=2 entries=1 op=nft_register_rule pid=48324 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48325]: NETFILTER_CFG table=libvirt_network:32 family=2 entries=1 op=nft_register_rule pid=48325 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48329]: NETFILTER_CFG table=libvirt_network:33 family=2 entries=1 op=nft_register_rule pid=48329 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48330]: NETFILTER_CFG table=libvirt_network:34 family=2 entries=1 op=nft_register_rule pid=48330 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48331]: NETFILTER_CFG table=libvirt_network:35 family=2 entries=1 op=nft_register_rule pid=48331 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net audit[48332]: NETFILTER_CFG table=libvirt_network:36 family=2 entries=1 op=nft_register_rule pid=48332 subj=system_u:system_r:iptables_t:s0 comm="nft" Oct 03 15:01:12 xps13a.happyassassin.net avahi-daemon[1935]: Joining mDNS multicast group on interface virbr0.IPv4 with address 192.168.124.1. Oct 03 15:01:12 xps13a.happyassassin.net avahi-daemon[1935]: New relevant interface virbr0.IPv4 for mDNS. Oct 03 15:01:12 xps13a.happyassassin.net avahi-daemon[1935]: Registering new address record for 192.168.124.1 on virbr0.IPv4. Oct 03 15:01:12 xps13a.happyassassin.net NetworkManager[2154]: <info> [1727992872.3373] device (virbr0): state change: unmanaged -> unavailable (reason 'connection-assumed', sys-iface-state: 'external') Oct 03 15:01:12 xps13a.happyassassin.net NetworkManager[2154]: <info> [1727992872.3387] device (virbr0): state change: unavailable -> disconnected (reason 'connection-assumed', sys-iface-state: 'external') Oct 03 15:01:12 xps13a.happyassassin.net NetworkManager[2154]: <info> [1727992872.3402] device (virbr0): Activation: starting connection 'virbr0' (74f1646a-b4ed-4e13-96be-14d13be7d54a) Oct 03 15:01:12 xps13a.happyassassin.net NetworkManager[2154]: <info> [1727992872.3490] device (virbr0): state change: disconnected -> prepare (reason 'none', sys-iface-state: 'external') Oct 03 15:01:12 xps13a.happyassassin.net NetworkManager[2154]: <info> [1727992872.3494] device (virbr0): state change: prepare -> config (reason 'none', sys-iface-state: 'external') Oct 03 15:01:12 xps13a.happyassassin.net NetworkManager[2154]: <info> [1727992872.3498] device (virbr0): state change: config -> ip-config (reason 'none', sys-iface-state: 'external') Oct 03 15:01:12 xps13a.happyassassin.net NetworkManager[2154]: <info> [1727992872.3502] device (virbr0): state change: ip-config -> ip-check (reason 'none', sys-iface-state: 'external') Oct 03 15:01:12 xps13a.happyassassin.net systemd[1]: Starting NetworkManager-dispatcher.service - Network Manager Script Dispatcher Service... Oct 03 15:01:12 xps13a.happyassassin.net dnsmasq[48351]: started, version 2.90 cachesize 150 Oct 03 15:01:12 xps13a.happyassassin.net dnsmasq[48351]: compile time options: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset no-nftset auth cryptohash DNSSEC loop-detect inotify dumpfile Oct 03 15:01:12 xps13a.happyassassin.net dnsmasq-dhcp[48351]: DHCP, IP range 192.168.124.2 -- 192.168.124.254, lease time 1h Oct 03 15:01:12 xps13a.happyassassin.net dnsmasq-dhcp[48351]: DHCP, sockets bound exclusively to interface virbr0 Oct 03 15:01:12 xps13a.happyassassin.net dnsmasq[48351]: reading /etc/resolv.conf Oct 03 15:01:12 xps13a.happyassassin.net dnsmasq[48351]: using nameserver 127.0.0.53#53 Oct 03 15:01:12 xps13a.happyassassin.net dnsmasq[48351]: read /etc/hosts - 8 names Oct 03 15:01:12 xps13a.happyassassin.net dnsmasq[48351]: read /var/lib/libvirt/dnsmasq/default.addnhosts - 0 names Oct 03 15:01:12 xps13a.happyassassin.net dnsmasq-dhcp[48351]: read /var/lib/libvirt/dnsmasq/default.hostsfile Oct 03 15:01:12 xps13a.happyassassin.net systemd[1]: Listening on virtnodedevd-admin.socket - libvirt nodedev daemon admin socket. Oct 03 15:01:12 xps13a.happyassassin.net systemd[1]: Listening on virtnodedevd-ro.socket - libvirt nodedev daemon read-only socket. Oct 03 15:01:12 xps13a.happyassassin.net systemd[1]: Starting virtnodedevd.service - libvirt nodedev daemon... Oct 03 15:01:12 xps13a.happyassassin.net systemd[1]: Started NetworkManager-dispatcher.service - Network Manager Script Dispatcher Service. Oct 03 15:01:12 xps13a.happyassassin.net audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=NetworkManager-dispatcher comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Oct 03 15:01:12 xps13a.happyassassin.net NetworkManager[2154]: <info> [1727992872.3858] device (virbr0): state change: ip-check -> secondaries (reason 'none', sys-iface-state: 'external') Oct 03 15:01:12 xps13a.happyassassin.net NetworkManager[2154]: <info> [1727992872.3860] device (virbr0): state change: secondaries -> activated (reason 'none', sys-iface-state: 'external') Oct 03 15:01:12 xps13a.happyassassin.net NetworkManager[2154]: <info> [1727992872.3864] device (virbr0): Activation: successful, device activated. Oct 03 15:01:12 xps13a.happyassassin.net systemd[1]: Started virtnodedevd.service - libvirt nodedev daemon. Oct 03 15:01:12 xps13a.happyassassin.net audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=virtnodedevd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Oct 03 15:01:12 xps13a.happyassassin.net systemd[1]: iscsi.service: Unit cannot be reloaded because it is inactive. Oct 03 15:01:12 xps13a.happyassassin.net audit[48353]: AVC avc: denied { watch } for pid=48353 comm="daemon-init" path="/etc/mdevctl.d/scripts.d" dev="dm-0" ino=955 scontext=system_u:system_r:virtnodedevd_t:s0 tcontext=system_u:object_r:mdevctl_conf_t:s0 tclass=dir permissive=0 Oct 03 15:01:14 xps13a.happyassassin.net systemd[1]: Starting setroubleshootd.service - SETroubleshoot daemon for processing new SELinux denial logs... Oct 03 15:01:14 xps13a.happyassassin.net systemd[1]: Started setroubleshootd.service - SETroubleshoot daemon for processing new SELinux denial logs. Oct 03 15:01:14 xps13a.happyassassin.net audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=setroubleshootd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Oct 03 15:01:14 xps13a.happyassassin.net setroubleshoot[48406]: failed to retrieve rpm info for path '/etc/mdevctl.d/scripts.d': Oct 03 15:01:15 xps13a.happyassassin.net systemd[1]: Created slice system-dbus\x2d:1.3\x2dorg.fedoraproject.SetroubleshootPrivileged.slice - Slice /system/dbus-:1.3-org.fedoraproject.SetroubleshootPrivileged. Oct 03 15:01:15 xps13a.happyassassin.net systemd[1]: Started dbus-:1.3-org.fedoraproject.SetroubleshootPrivileged. Oct 03 15:01:15 xps13a.happyassassin.net audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dbus-:1.3-org.fedoraproject.SetroubleshootPrivileged@0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Oct 03 15:01:15 xps13a.happyassassin.net setroubleshoot[48406]: SELinux is preventing daemon-init from watch access on the directory /etc/mdevctl.d/scripts.d. For complete SELinux messages run: sealert -l 8016a592-dee3-46ad-88a0-c0df8ce3ca5e Oct 03 15:01:15 xps13a.happyassassin.net setroubleshoot[48406]: SELinux is preventing daemon-init from watch access on the directory /etc/mdevctl.d/scripts.d. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that daemon-init should be allowed watch access on the scripts.d directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'daemon-init' --raw | audit2allow -M my-daemoninit # semodule -X 300 -i my-daemoninit.pp Oct 03 15:01:16 xps13a.happyassassin.net audit[48353]: AVC avc: denied { watch } for pid=48353 comm="gmain" path="/etc/mdevctl.d/scripts.d" dev="dm-0" ino=955 scontext=system_u:system_r:virtnodedevd_t:s0 tcontext=system_u:object_r:mdevctl_conf_t:s0 tclass=dir permissive=0 Oct 03 15:01:18 xps13a.happyassassin.net setroubleshoot[48406]: SELinux is preventing daemon-init from watch access on the directory /etc/mdevctl.d/scripts.d. For complete SELinux messages run: sealert -l 8016a592-dee3-46ad-88a0-c0df8ce3ca5e Oct 03 15:01:18 xps13a.happyassassin.net setroubleshoot[48406]: SELinux is preventing daemon-init from watch access on the directory /etc/mdevctl.d/scripts.d. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that daemon-init should be allowed watch access on the scripts.d directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'daemon-init' --raw | audit2allow -M my-daemoninit # semodule -X 300 -i my-daemoninit.pp After that it just kept happening constantly until I enabled permissive mode to let it through. SELinux is preventing daemon-init from 'watch' accesses on the directory /etc/mdevctl.d/scripts.d. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that daemon-init should be allowed watch access on the scripts.d directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'daemon-init' --raw | audit2allow -M my-daemoninit # semodule -X 300 -i my-daemoninit.pp Additional Information: Source Context system_u:system_r:virtnodedevd_t:s0 Target Context system_u:object_r:mdevctl_conf_t:s0 Target Objects /etc/mdevctl.d/scripts.d [ dir ] Source daemon-init Source Path daemon-init Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-41.19-1.fc41.noarch Local Policy RPM selinux-policy-targeted-41.19-1.fc41.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.11.0-63.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Sun Sep 15 17:48:54 UTC 2024 x86_64 Alert Count 37 First Seen 2024-10-03 15:01:12 PDT Last Seen 2024-10-03 15:03:36 PDT Local ID 8016a592-dee3-46ad-88a0-c0df8ce3ca5e Raw Audit Messages type=AVC msg=audit(1727993016.699:937): avc: denied { watch } for pid=48353 comm="gmain" path="/etc/mdevctl.d/scripts.d" dev="dm-0" ino=955 scontext=system_u:system_r:virtnodedevd_t:s0 tcontext=system_u:object_r:mdevctl_conf_t:s0 tclass=dir permissive=1 Hash: daemon-init,virtnodedevd_t,mdevctl_conf_t,dir,watch Version-Release number of selected component: selinux-policy-targeted-41.19-1.fc41.noarch Additional info: reporter: libreport-2.17.15 reason: SELinux is preventing daemon-init from 'watch' accesses on the directory /etc/mdevctl.d/scripts.d. package: selinux-policy-targeted-41.19-1.fc41.noarch component: selinux-policy hashmarkername: setroubleshoot type: libreport kernel: 6.11.0-63.fc41.x86_64 component: selinux-policy
Created attachment 2050291 [details] File: description
Created attachment 2050292 [details] File: os_info
*** This bug has been marked as a duplicate of bug 2314826 ***