Description of problem: During automated testing the starting a of a paravirt guest we get a AVC denial message. Version-Release number of selected component (if applicable): selinux-policy-2.4.6-229.el5.noarch How reproducible: Always Steps to Reproduce: 1. Attached is an RHTS XML that reproduces the issue in RHTS Actual results: time->Tue May 5 14:09:12 2009 type=SYSCALL msg=audit(1241546952.192:31): arch=40000003 syscall=5 success=no exit=-13 a0=b7d76c a1=8000 a2=1b6 a3=9d473e8 items=0 ppid=16827 pid=16828 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="virsh" exe="/usr/bin/virsh" subj=system_u:system_r:xm_t:s0 key=(null) type=AVC msg=audit(1241546952.192:31): avc: denied { search } for pid=16828 comm="virsh" name="/" dev=sysfs ino=1 scontext=system_u:system_r:xm_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir Expected results: This should not get a failure. Additional info:
Fixed in selinux-policy-2.4.6-231.el5
Dan, I ran a test using your package selinux-policy-2.4.6-231.el5 but it is still failing. While it was failing I logged on to the system and grabbed the denied messages from the audit.log file. Is this a similar issue as: [Bug 499888] selinux denials when migration tests over ssh is being done type=AVC msg=audit(1242227643.278:10): avc: denied { search } for pid=3606 comm="dnsmasq" name="libvirt" dev=dm-0 ino=30834950 scontext=system_u:system_r:dnsmasq_t:s0 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir type=AVC msg=audit(1242228164.143:10): avc: denied { search } for pid=3581 comm="dnsmasq" name="libvirt" dev=dm-0 ino=30834950 scontext=system_u:system_r:dnsmasq_t:s0 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir type=AVC msg=audit(1242228547.748:10): avc: denied { search } for pid=3594 comm="dnsmasq" name="libvirt" dev=dm-0 ino=30834950 scontext=system_u:system_r:dnsmasq_t:s0 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir type=AVC msg=audit(1242228814.540:17): avc: denied { read } for pid=5971 comm="virsh" name="capabilities" dev=sysfs ino=2130 scontext=system_u:system_r:xm_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file type=AVC msg=audit(1242228814.548:18): avc: denied { signal } for pid=5971 comm="virsh" scontext=system_u:system_r:xm_t:s0 tcontext=system_u:system_r:xm_t:s0 tclass=process type=AVC msg=audit(1242235823.236:32): avc: denied { read } for pid=16498 comm="virsh" name="capabilities" dev=sysfs ino=2130 scontext=system_u:system_r:xm_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file type=AVC msg=audit(1242235823.236:33): avc: denied { signal } for pid=16498 comm="virsh" scontext=system_u:system_r:xm_t:s0 tcontext=system_u:system_r:xm_t:s0 tclass=process
selinux-policy-2.4.6-236.el5 resolves the issue for me. I can now create and start xen guests again in automation testing. http://rhts.redhat.com/cgi-bin/rhts/recipes.cgi?id=196528 http://rhts.redhat.com/cgi-bin/rhts/jobs.cgi?id=58850&type=Single
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2009-1242.html