Bug 231750 - selinux SETroubleshooting is triggered using QEMU - Creating Virtual System
Summary: selinux SETroubleshooting is triggered using QEMU - Creating Virtual System
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: i686
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-03-11 04:21 UTC by Bill Jones
Modified: 2007-11-30 22:11 UTC (History)
1 user (show)

Fixed In Version: Current
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-08-22 14:16:22 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Bill Jones 2007-03-11 04:21:22 UTC
selinux SETroubleshooting is triggered using QEMU - Creating Virtual System -
Each time I try to run Virtual Machine Manager it hangs; along with this error:

Summary
    SELinux is preventing /usr/sbin/console-kit-daemon (consolekit_t) "ptrace"
    access to <Unknown> (unconfined_t).

Detailed Description
    SELinux denied access requested by /usr/sbin/console-kit-daemon. It is not
    expected that this access is required by /usr/sbin/console-kit-daemon and
    this access may signal an intrusion attempt. It is also possible that the
    specific version or configuration of the application is causing it to
    require additional access. Please file a
    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.

Allowing Access
    Sometimes labeling problems can cause SELinux denials.  You could try to
    restore the default system file context for <Unknown>, restorecon -v
    <Unknown>. There is currently no automatic way to allow this access.
    Instead, you can generate a local policy module to allow this access - see
    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 - or you can
    disable SELinux protection entirely for the application. Disabling SELinux
    protection is not recommended. Please file a
    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
    Changing the "consolekit_disable_trans" boolean to true will disable SELinux
    protection this application: "setsebool -P consolekit_disable_trans=1."

    The following command will allow this access:
    setsebool -P consolekit_disable_trans=1

Additional Information        

Source Context                system_u:system_r:consolekit_t
Target Context                root:system_r:unconfined_t:SystemLow-SystemHigh
Target Objects                None [ process ]
Affected RPM Packages         ConsoleKit-0.1.3-0.git20070301.1.fc7 [application]
Policy RPM                    selinux-policy-2.5.6-1.fc7
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Permissive
Plugin Name                   plugins.disable_trans
Host Name                     fedora
Platform                      Linux fedora 2.6.19-1.2914.fc7 #1 SMP Fri Jan 26
                              18:42:25 EST 2007 i686 i686
Alert Count                   3
First Seen                    Sat 10 Mar 2007 07:57:16 PM EST
Last Seen                     Sat 10 Mar 2007 11:11:22 PM EST
Local ID                      af261170-d0fe-4bd1-82ca-4e3f98411c5c
Line Numbers                  

Raw Audit Messages            

avc: denied { ptrace } for comm="console-kit-dae" egid=0 euid=0 exe="/usr/sbin
/console-kit-daemon" exit=1137 fsgid=0 fsuid=0 gid=0 items=0 pid=2288
scontext=system_u:system_r:consolekit_t:s0 sgid=0
subj=system_u:system_r:consolekit_t:s0 suid=0 tclass=process
tcontext=root:system_r:unconfined_t:s0-s0:c0.c1023 tty=(none) uid=0


Also, please note that I am seeing a ton of exim errors as well.
PPS -- Linux fedora 2.6.19-1.2914.fc7 #1 SMP Fri Jan 26 18:42:25 EST 2007 i686
i686 i386 GNU/Linux

None of the more recent kernel will run on this system -- they hang on boot just
at vesafb ...

Comment 1 Daniel Walsh 2007-03-12 12:45:11 UTC
Fixed in selinux-policy-2.5.8-1.fc7

Comment 2 Daniel Walsh 2007-08-22 14:16:22 UTC
Should be fixed in the current release



Note You need to log in before you can comment on or make changes to this bug.