Bug 523956 - Starting libvirtd by hand causes denials
Starting libvirtd by hand causes denials
Status: CLOSED WONTFIX
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
rawhide
All Linux
high Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
:
Depends On:
Blocks: F12VirtTarget
  Show dependency treegraph
 
Reported: 2009-09-17 08:03 EDT by Chris Lalancette
Modified: 2009-09-17 15:14 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-09-17 15:14:31 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Chris Lalancette 2009-09-17 08:03:40 EDT
Description of problem:
I'm doing some debugging as part of the virtualization test day.  While trying to debug an issue with libvirtd, I shutdown the service (service libvirtd stop), and started it by hand:

[root@intel2 ~]# /usr/sbin/libvirtd --verbose --listen

And it starts up as expected.  However, when trying to start a qemu-kvm guest with it like this, I get:

[root@intel2 ~]# virsh start f12
error: Failed to start domain f12
error: internal error unable to start guest: 11:55:45.547: error : __virExec:567 : cannot execute binary /usr/bin/qemu-kvm: Permission denied
libvir: error : cannot execute binary /usr/bin/qemu-kvm: Permission denied

Setting selinux to Permissive mode solves the problem, as does killing the process and starting the service back up.  I get the following denials in /var/log/audit/audit.log:

type=ANOM_PROMISCUOUS msg=audit(1253203387.033:96): dev=vnet0 prom=256 old_prom=0 auid=0 uid=0 gid=0 ses=3
type=SYSCALL msg=audit(1253203387.033:96): arch=c000003e syscall=16 success=yes exit=0 a0=11 a1=89a2 a2=7f8836d73dc0 a3=7f8836d73b50 items=0 ppid=2932 pid=3611 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=3 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1253203387.041:97): avc:  denied  { transition } for  pid=3615 comm="libvirtd" path="/usr/bin/qemu-kvm" dev=dm-0 ino=16894 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:system_r:svirt_t:s0:c32,c306 tclass=process
type=SYSCALL msg=audit(1253203387.041:97): arch=c000003e syscall=59 success=no exit=-13 a0=7f8824000d50 a1=7f8824001490 a2=7f8824000a00 a3=7f8836d75e20 items=0 ppid=3614 pid=3615 auid=0 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=3 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=ANOM_PROMISCUOUS msg=audit(1253203387.051:98): dev=vnet0 prom=0 old_prom=256 auid=0 uid=0 gid=0 ses=3
type=SYSCALL msg=audit(1253203387.051:98): arch=c000003e syscall=3 success=yes exit=0 a0=12 a1=0 a2=0 a3=1 items=0 ppid=2932 pid=3611 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=3 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
Comment 1 Daniel Walsh 2009-09-17 15:14:31 EDT
Sorry if you are running in debug mode you are pretty much on your own.  It is better to debug these by connecting to the PID.  THat way it matches the way the system will run in an SELinux environment.

Or you could execute runcon -t virtd_t libvirtd, which may or may not work.

Note You need to log in before you can comment on or make changes to this bug.