Bug 523956 - Starting libvirtd by hand causes denials
Summary: Starting libvirtd by hand causes denials
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: All
OS: Linux
high
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: F12VirtTarget
TreeView+ depends on / blocked
 
Reported: 2009-09-17 12:03 UTC by Chris Lalancette
Modified: 2009-09-17 19:14 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-09-17 19:14:31 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Chris Lalancette 2009-09-17 12:03:40 UTC
Description of problem:
I'm doing some debugging as part of the virtualization test day.  While trying to debug an issue with libvirtd, I shutdown the service (service libvirtd stop), and started it by hand:

[root@intel2 ~]# /usr/sbin/libvirtd --verbose --listen

And it starts up as expected.  However, when trying to start a qemu-kvm guest with it like this, I get:

[root@intel2 ~]# virsh start f12
error: Failed to start domain f12
error: internal error unable to start guest: 11:55:45.547: error : __virExec:567 : cannot execute binary /usr/bin/qemu-kvm: Permission denied
libvir: error : cannot execute binary /usr/bin/qemu-kvm: Permission denied

Setting selinux to Permissive mode solves the problem, as does killing the process and starting the service back up.  I get the following denials in /var/log/audit/audit.log:

type=ANOM_PROMISCUOUS msg=audit(1253203387.033:96): dev=vnet0 prom=256 old_prom=0 auid=0 uid=0 gid=0 ses=3
type=SYSCALL msg=audit(1253203387.033:96): arch=c000003e syscall=16 success=yes exit=0 a0=11 a1=89a2 a2=7f8836d73dc0 a3=7f8836d73b50 items=0 ppid=2932 pid=3611 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=3 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1253203387.041:97): avc:  denied  { transition } for  pid=3615 comm="libvirtd" path="/usr/bin/qemu-kvm" dev=dm-0 ino=16894 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:system_r:svirt_t:s0:c32,c306 tclass=process
type=SYSCALL msg=audit(1253203387.041:97): arch=c000003e syscall=59 success=no exit=-13 a0=7f8824000d50 a1=7f8824001490 a2=7f8824000a00 a3=7f8836d75e20 items=0 ppid=3614 pid=3615 auid=0 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=3 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=ANOM_PROMISCUOUS msg=audit(1253203387.051:98): dev=vnet0 prom=0 old_prom=256 auid=0 uid=0 gid=0 ses=3
type=SYSCALL msg=audit(1253203387.051:98): arch=c000003e syscall=3 success=yes exit=0 a0=12 a1=0 a2=0 a3=1 items=0 ppid=2932 pid=3611 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=3 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

Comment 1 Daniel Walsh 2009-09-17 19:14:31 UTC
Sorry if you are running in debug mode you are pretty much on your own.  It is better to debug these by connecting to the PID.  THat way it matches the way the system will run in an SELinux environment.

Or you could execute runcon -t virtd_t libvirtd, which may or may not work.


Note You need to log in before you can comment on or make changes to this bug.