Bug 521652 - selinux policy update needed :: libvirt has moved the location of the qemu monitor socket
selinux policy update needed :: libvirt has moved the location of the qemu mo...
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
All Linux
high Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
: 522697 524887 (view as bug list)
Depends On:
Blocks: F11VirtBlocker
  Show dependency treegraph
Reported: 2009-09-07 09:01 EDT by Matthew Booth
Modified: 2009-10-27 02:40 EDT (History)
12 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-09-08 18:45:41 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Matthew Booth 2009-09-07 09:01:30 EDT
Description of problem:
Logs say:

Sep  7 13:48:48 mbooth libvirtd: 13:48:48.174: error : qemudWaitForMonitor:1199 : internal error unable to start guest: bind(unix:/var/lib/libvirt/qemu/RHEL39FV32.monitor): Permission denied#012qemu: could not open monitor device 'unix:/var/lib/libvirt/qemu/RHEL39FV32.monitor,server,nowait'#012

AVC says:

node=mbooth.laptop type=AVC msg=audit(1252325368.622:35846): avc: denied { write } for pid=12710 comm="qemu-kvm" name="qemu" dev=dm-1 ino=82074 scontext=system_u:system_r:svirt_t:s0:c523,c571 tcontext=system_u:object_r:virt_var_lib_t:s0 tclass=dir node=mbooth.laptop type=SYSCALL msg=audit(1252325368.622:35846): arch=c000003e syscall=49 success=no exit=-13 a0=a a1=7fff3ecd2230 a2=6e a3=7fff3ecd1fc0 items=0 ppid=12709 pid=12710 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c523,c571 key=(null)

Notice how it is trying to open a monitor device under /var/lib/. This doesn't look right, I would expect this to be in /var/run. In fact, the SELinux targeted policy contains the following:

/var/run/libvirt/qemu(/.*)?     gen_context(system_u:object_r:svirt_var_run_t,s0)

Changing the context of /var/lib/libvirt/qemu to system_u:object_r:svirt_var_run_t:s0 allows guests to start again. It would appear that libvirt is putting this monitor file in the wrong place.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Open Virtual Machine Manager
2. Select a guest
3. Click Run
Comment 1 Mark McLoughlin 2009-09-07 09:27:37 EDT
Thanks Matt

The monitor socket has moved to /var/lib/libvirt/qemu because of this:

Comment 2 Daniel Walsh 2009-09-08 18:45:41 EDT
Fixed in selinux-policy-3.6.30-6.fc12.noarch
Comment 3 Mark McLoughlin 2009-09-11 10:06:09 EDT
*** Bug 522697 has been marked as a duplicate of this bug. ***
Comment 4 Mark McLoughlin 2009-10-02 05:25:11 EDT
*** Bug 524887 has been marked as a duplicate of this bug. ***
Comment 5 IBM Bug Proxy 2009-10-27 02:40:46 EDT
------- Comment From santwana.samantray@in.ibm.com 2009-10-27 02:35 EDT-------

I verified this issue in the latest F12 rawhide release(k.v-, and the issue seems to be fixed. When selinux was enabled, the guest installation started without any problems using virt-install.

[root@mx3550 ~]# getenforce

[root@mx3550 ~]# virt-install -n rhel61 -r 500 --vcpus 2 --virt-type=kvm -c /home/RHEL6.0-20091021.0-x86_64-DVD1.iso --disk path=/var/lib/libvirt/images/rhel6.raw --vnc

Starting install...
Creating domain...                                                                                                     |    0 B     00:00
Domain installation still in progress. You can reconnect to
the console to complete the installation process.

Below are the versions installed:


Note You need to log in before you can comment on or make changes to this bug.