Bug 436882 - "qemu-kvm -smb dir" throws AVCs, fails in enforcing mode
Summary: "qemu-kvm -smb dir" throws AVCs, fails in enforcing mode
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: kvm
Version: rawhide
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Jeremy Katz
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-03-10 21:54 UTC by Tom London
Modified: 2008-03-11 21:57 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-03-11 21:57:20 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
/var/log/audit/audit.log with "qemu-kvm -smb" troubles (29.23 KB, text/plain)
2008-03-10 21:55 UTC, Tom London
no flags Details

Description Tom London 2008-03-10 21:54:20 UTC
Description of problem:
Running "qemu-kvm -smb ~/dir" generates lots of AVCs and quickly fails.

Putting system in permissive mode produces (full audit.log attached):

#============= qemu_t ==============
allow qemu_t cupsd_t:unix_stream_socket connectto;
allow qemu_t cupsd_var_run_t:sock_file { write getattr };
allow qemu_t inotifyfs_t:dir read;
allow qemu_t random_device_t:chr_file read;
allow qemu_t self:netlink_route_socket { write getattr read bind create
nlmsg_read };
allow qemu_t smbd_exec_t:file { read execute execute_no_trans };
allow qemu_t sysctl_kernel_t:dir search;
allow qemu_t sysctl_kernel_t:file read;
allow qemu_t tmp_t:dir { write create add_name };
allow qemu_t tmp_t:file { write getattr setattr read lock create append };
allow qemu_t urandom_device_t:chr_file read;
allow qemu_t user_home_t:file { read append };


Version-Release number of selected component (if applicable):
kvm-63-2.fc9.i386
selinux-policy-3.3.1-12.fc9.noarch

How reproducible:
Every time

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 1 Tom London 2008-03-10 21:55:49 UTC
Created attachment 297525 [details]
/var/log/audit/audit.log with "qemu-kvm -smb" troubles

Comment 2 Daniel Walsh 2008-03-11 21:57:20 UTC
I hate this type of thing,   But...
Fixed in selinux-policy-3.3.1-14.fc9


Note You need to log in before you can comment on or make changes to this bug.