This service will be undergoing maintenance at 00:00 UTC, 2016-09-28. It is expected to last about 1 hours
Bug 436645 - qemu-kvm cannot access its disk image file
qemu-kvm cannot access its disk image file
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
rawhide
x86_64 Linux
low Severity low
: ---
: ---
Assigned To: Daniel Walsh
Ben Levenson
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-03-08 14:30 EST by Jan Kratochvil
Modified: 2008-03-10 10:10 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-03-10 10:10:52 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Jan Kratochvil 2008-03-08 14:30:20 EST
Description of problem:
Tried to run qemu-kvm on a remote machine and it mysteriously fails, no selinux
message is seen but I cannot explain it otherwise.

Version-Release number of selected component (if applicable):
selinux-policy-3.3.1-9.fc9.noarch
selinux-policy-targeted-3.3.1-9.fc9.noarch

How reproducible:
Always.

Steps to Reproduce:
1. qemu-img create -f qcow2 f9.qcow2 4000M
2. wget
http://sunsite.mff.cuni.cz/MIRRORS/fedora.redhat.com/linux/development/x86_64/os/images/netinst.iso
3. qemu-kvm -hda f9.qcow2 -cdrom netinst.iso -boot d -m 1024
4. strace qemu-kvm -hda f9.qcow2 -cdrom netinst.iso -boot d -m 1024
5. ls -l
6. id

Actual results:
(no output for the first qemu-kvm run)
...
stat("f9.qcow2", 0x7fff87ca2920)        = -1 EACCES (Permission denied)
open("f9.qcow2", O_RDONLY)              = -1 EACCES (Permission denied)
write(2, "qemu: could not open disk image "..., 41) = 41
exit_group(1)                           = ?
-rw-r--r-- 1 root root     28672 2008-03-08 22:34 f9.qcow2
-rw-r--r-- 1 root root 122148864 2008-03-08 11:01 netinst.iso
uid=0(root) gid=0(root)
groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
context=root:unconfined_r:unconfined_t:SystemLow-SystemHigh

Expected results:
qemu-kvm starts and runs and writes the data into `f9.qcow2'.

Additional info:
SELINUX=enforcing
SELINUXTYPE=targeted
SETLOCALDEFS=0

type=AVC msg=audit(1205012582.680:80611): avc:  denied  { read } for  pid=21857
comm="qemu-kvm" name="f9.qcow2" dev=dm-0 ino=31850698
scontext=root:unconfined_r:qemu_t:s0-s0:c0.c1023
tcontext=root:object_r:user_home_t:s0 tclass=file
type=SYSCALL msg=audit(1205012582.680:80611): arch=c000003e syscall=2 success=no
exit=-13 a0=7fff87ca5330 a1=0 a2=1a4 a3=7fff87c9fd70 items=0 ppid=21856
pid=21857 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) ses=102 comm="qemu-kvm" exe="/usr/bin/qemu-kvm"
subj=root:unconfined_r:qemu_t:s0-s0:c0.c1023 key=(null)

There is no setroubleshoot installed remotely, I should not install any new
software there and I do not have selinux locally enabled so
setroubleshoot-server does not locally (F8) start and local `/usr/bin/sealert
-b' as run from the menu aborts with:
Mar  8 20:23:31 host0 setroubleshoot: [root.ERROR] Could not open log file
(/var/log/setroubleshoot/setroubleshootd.log) - using stderr
Mar  8 20:23:51 host0 setroubleshoot: [dbus.ERROR] could not start dbus:
org.freedesktop.DBus.Error.Spawn.ChildExited: Launch helper exited with unknown
return code 0

Machine affected is: rawhide64.englab.brq.redhat.com
Comment 1 Daniel Walsh 2008-03-10 10:10:52 EDT
Fixed in selinux-policy-3.3.1-13.fc9

Note You need to log in before you can comment on or make changes to this bug.