Description of problem: vibr0 is not setup because of selinux denies, and all VMs are prevented to start because they cannot setup their network interface. Version-Release number of selected component (if applicable): selinux policy 3.6.12-34.fc11 How reproducible: always reproducible on my machine. I worked around it by setting selinux in permissive mode and restarting libvirtd Once libvirtd is started selinux can be safely set back to enforcing and all works as expected Here's the audit.log with the actual denies. type=MAC_STATUS msg=audit(1242590267.454:1024): enforcing=0 old_enforcing=1 auid=500 ses=1 type=SYSCALL msg=audit(1242590267.454:1024): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff153f4930 a2=1 a3=fffffff8 items=0 ppid=4850 pid=5849 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts5 ses=1 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1242590274.187:1025): avc: denied { write } for pid=5901 comm="dnsmasq" name="network" dev=dm-0 ino=19136540 scontext=unconfined_u:system_r:dnsmasq_t:s0-s0:c0.c1023 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir type=AVC msg=audit(1242590274.187:1025): avc: denied { add_name } for pid=5901 comm="dnsmasq" name="default.pid" scontext=unconfined_u:system_r:dnsmasq_t:s0-s0:c0.c1023 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir type=AVC msg=audit(1242590274.187:1025): avc: denied { create } for pid=5901 comm="dnsmasq" name="default.pid" scontext=unconfined_u:system_r:dnsmasq_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:virt_var_run_t:s0 tclass=file type=AVC msg=audit(1242590274.187:1025): avc: denied { write } for pid=5901 comm="dnsmasq" name="default.pid" dev=dm-0 ino=19136541 scontext=unconfined_u:system_r:dnsmasq_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:virt_var_run_t:s0 tclass=file type=SYSCALL msg=audit(1242590274.187:1025): arch=c000003e syscall=2 success=no exit=127549400 a0=1d45a50 a1=241 a2=1b6 a3=238 items=0 ppid=5900 pid=5901 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="dnsmasq" exe="/usr/sbin/dnsmasq" subj=unconfined_u:system_r:dnsmasq_t:s0-s0:c0.c1023 key=(null) type=MAC_STATUS msg=audit(1242590351.020:1026): enforcing=1 old_enforcing=0 auid=500 ses=1 HTH
THe problem is your /var/run/libvirt/network/ directory is mislabeled. restorecon -R -v /var/run to fix. This directory should have been labeled like this at install. Any chance this directory is getting deleted? It was mislabeled at one time and during rawhide we fixed the label. maybe for some reason the policy upgrade did not fix the label.
Thanks, restorecon fixed it, and this looks really like a bug in the upgrade procedure. I did a restorecon -R / after my first upgrade from F9 to F11 preview. (This is the same machine that had problems with mislabeled init scripts)
This bug appears to have been reported against 'rawhide' during the Fedora 11 development cycle. Changing version to '11'. More information and reason for this action is here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping