Bug 501194 - Selinux policy prevents correct setup of vibr0 network by libvirt
Selinux policy prevents correct setup of vibr0 network by libvirt
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
11
All Linux
medium Severity high
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-05-17 16:06 EDT by Simo Sorce
Modified: 2009-10-20 18:44 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-10-20 18:44:42 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Simo Sorce 2009-05-17 16:06:43 EDT
Description of problem:
vibr0 is not setup because of selinux denies, and all VMs are prevented to start because they cannot setup their network interface.

Version-Release number of selected component (if applicable):
selinux policy 3.6.12-34.fc11

How reproducible:
always reproducible on my machine.

I worked around it by setting selinux in permissive mode and restarting libvirtd
Once libvirtd is started selinux can be safely set back to enforcing and all works as expected

Here's the audit.log with the actual denies.

type=MAC_STATUS msg=audit(1242590267.454:1024): enforcing=0 old_enforcing=1 auid=500 ses=1
type=SYSCALL msg=audit(1242590267.454:1024): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff153f4930 a2=1 a3=fffffff8 items=0 ppid=4850 pid=5849 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts5 ses=1 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1242590274.187:1025): avc:  denied  { write } for  pid=5901 comm="dnsmasq" name="network" dev=dm-0 ino=19136540 scontext=unconfined_u:system_r:dnsmasq_t:s0-s0:c0.c1023 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir
type=AVC msg=audit(1242590274.187:1025): avc:  denied  { add_name } for  pid=5901 comm="dnsmasq" name="default.pid" scontext=unconfined_u:system_r:dnsmasq_t:s0-s0:c0.c1023 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=dir
type=AVC msg=audit(1242590274.187:1025): avc:  denied  { create } for  pid=5901 comm="dnsmasq" name="default.pid" scontext=unconfined_u:system_r:dnsmasq_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:virt_var_run_t:s0 tclass=file
type=AVC msg=audit(1242590274.187:1025): avc:  denied  { write } for  pid=5901 comm="dnsmasq" name="default.pid" dev=dm-0 ino=19136541 scontext=unconfined_u:system_r:dnsmasq_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:virt_var_run_t:s0 tclass=file
type=SYSCALL msg=audit(1242590274.187:1025): arch=c000003e syscall=2 success=no exit=127549400 a0=1d45a50 a1=241 a2=1b6 a3=238 items=0 ppid=5900 pid=5901 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="dnsmasq" exe="/usr/sbin/dnsmasq" subj=unconfined_u:system_r:dnsmasq_t:s0-s0:c0.c1023 key=(null)
type=MAC_STATUS msg=audit(1242590351.020:1026): enforcing=1 old_enforcing=0 auid=500 ses=1


HTH
Comment 1 Daniel Walsh 2009-05-18 12:33:30 EDT
THe problem is your /var/run/libvirt/network/ directory is mislabeled.

restorecon -R -v /var/run to fix.


This directory should have been labeled like this at install.  Any chance this directory is getting deleted?

It was mislabeled at one time and during rawhide we fixed the label. maybe for some reason the policy upgrade did not fix the label.
Comment 2 Simo Sorce 2009-05-18 13:23:42 EDT
Thanks,
restorecon fixed it, and this looks really like a bug in the upgrade procedure.
I did a restorecon -R / after my first upgrade from F9 to F11 preview.
(This is the same machine that had problems with mislabeled init scripts)
Comment 3 Bug Zapper 2009-06-09 11:59:42 EDT
This bug appears to have been reported against 'rawhide' during the Fedora 11 development cycle.
Changing version to '11'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Note You need to log in before you can comment on or make changes to this bug.