Bug 499551 - AVC denial from virsh dominfo - libvirtd (virtd_t) "getattr" svirt_t.
Summary: AVC denial from virsh dominfo - libvirtd (virtd_t) "getattr" svirt_t.
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: libvirt
Version: rawhide
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Daniel Veillard
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: F11VirtTarget
TreeView+ depends on / blocked
 
Reported: 2009-05-07 06:50 UTC by Charles Rose
Modified: 2009-05-07 14:25 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-05-07 14:25:29 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
SELinux alert message (2.46 KB, text/plain)
2009-05-07 06:50 UTC, Charles Rose
no flags Details

Description Charles Rose 2009-05-07 06:50:58 UTC
Created attachment 342776 [details]
SELinux alert message

Description of problem:
Running:

  # virsh dominfo vfedora11

Id:             5
Name:           vfedora11
UUID:           b364fa20-349e-e604-94b5-40ca98952b04
OS Type:        hvm
State:          running
CPU(s):         1
CPU time:       10.9s
Max memory:     524288 kB
Used memory:    524288 kB
Autostart:      disable
Security model: selinux
Security DOI:   0
Security label: system_u:system_r:svirt_t:s0:c413,c668 (enforcing)

shows the domaininfo, but also results in an AVC denial:

SELinux is preventing libvirtd (virtd_t) "getattr" svirt_t.

Version-Release number of selected component (if applicable):
libvirt-0.6.2-4.f11.x86_64
selinux-policy-targetted-3.6.12-28.fc11.noarch

How reproducible:
Occurs the first three times "virsh dominfo" is run. Restarting libvirtd and running "virsh dominfo" causes the issue to happen again.

Steps to Reproduce:
1. Install Fedora Rawhide (7 May) with libvirt
2. Create a fedora 11 beta vm.
3. Run
       # virsh dominfo vfedora11
  
Actual results:
virsh shows the domain info

Expected results:
virsh shows the domain info, but an SELinux alert is seen.

Additional info:
SELinux alert attached.

Comment 1 Mark McLoughlin 2009-05-07 07:04:22 UTC
Could be from looking at /proc/$pid/stat ?

Comment 2 Daniel Walsh 2009-05-07 14:25:29 UTC
Fixed in selinux-policy-3.6.12-31.fc11.noarch


Note You need to log in before you can comment on or make changes to this bug.