Bug 521652 - selinux policy update needed :: libvirt has moved the location of the qemu monitor socket
Summary: selinux policy update needed :: libvirt has moved the location of the qemu mo...
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
: 522697 524887 (view as bug list)
Depends On:
Blocks: F11VirtBlocker
TreeView+ depends on / blocked
Reported: 2009-09-07 13:01 UTC by Matthew Booth
Modified: 2009-10-27 06:40 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2009-09-08 22:45:41 UTC

Attachments (Terms of Use)

Description Matthew Booth 2009-09-07 13:01:30 UTC
Description of problem:
Logs say:

Sep  7 13:48:48 mbooth libvirtd: 13:48:48.174: error : qemudWaitForMonitor:1199 : internal error unable to start guest: bind(unix:/var/lib/libvirt/qemu/RHEL39FV32.monitor): Permission denied#012qemu: could not open monitor device 'unix:/var/lib/libvirt/qemu/RHEL39FV32.monitor,server,nowait'#012

AVC says:

node=mbooth.laptop type=AVC msg=audit(1252325368.622:35846): avc: denied { write } for pid=12710 comm="qemu-kvm" name="qemu" dev=dm-1 ino=82074 scontext=system_u:system_r:svirt_t:s0:c523,c571 tcontext=system_u:object_r:virt_var_lib_t:s0 tclass=dir node=mbooth.laptop type=SYSCALL msg=audit(1252325368.622:35846): arch=c000003e syscall=49 success=no exit=-13 a0=a a1=7fff3ecd2230 a2=6e a3=7fff3ecd1fc0 items=0 ppid=12709 pid=12710 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c523,c571 key=(null)

Notice how it is trying to open a monitor device under /var/lib/. This doesn't look right, I would expect this to be in /var/run. In fact, the SELinux targeted policy contains the following:

/var/run/libvirt/qemu(/.*)?     gen_context(system_u:object_r:svirt_var_run_t,s0)

Changing the context of /var/lib/libvirt/qemu to system_u:object_r:svirt_var_run_t:s0 allows guests to start again. It would appear that libvirt is putting this monitor file in the wrong place.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Open Virtual Machine Manager
2. Select a guest
3. Click Run

Comment 1 Mark McLoughlin 2009-09-07 13:27:37 UTC
Thanks Matt

The monitor socket has moved to /var/lib/libvirt/qemu because of this:


Comment 2 Daniel Walsh 2009-09-08 22:45:41 UTC
Fixed in selinux-policy-3.6.30-6.fc12.noarch

Comment 3 Mark McLoughlin 2009-09-11 14:06:09 UTC
*** Bug 522697 has been marked as a duplicate of this bug. ***

Comment 4 Mark McLoughlin 2009-10-02 09:25:11 UTC
*** Bug 524887 has been marked as a duplicate of this bug. ***

Comment 5 IBM Bug Proxy 2009-10-27 06:40:46 UTC
------- Comment From santwana.samantray@in.ibm.com 2009-10-27 02:35 EDT-------

I verified this issue in the latest F12 rawhide release(k.v-, and the issue seems to be fixed. When selinux was enabled, the guest installation started without any problems using virt-install.

[root@mx3550 ~]# getenforce

[root@mx3550 ~]# virt-install -n rhel61 -r 500 --vcpus 2 --virt-type=kvm -c /home/RHEL6.0-20091021.0-x86_64-DVD1.iso --disk path=/var/lib/libvirt/images/rhel6.raw --vnc

Starting install...
Creating domain...                                                                                                     |    0 B     00:00
Domain installation still in progress. You can reconnect to
the console to complete the installation process.

Below are the versions installed:


Note You need to log in before you can comment on or make changes to this bug.