Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 599146

Summary: set proper selinux context for /dev/vhost-net
Product: Red Hat Enterprise Linux 6 Reporter: Eduardo Habkost <ehabkost>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED CURRENTRELEASE QA Contact: Milos Malik <mmalik>
Severity: urgent Docs Contact:
Priority: high    
Version: 6.0CC: acathrow, amit.shah, dwalsh, hbrock, laine, lihuang, mmalik, mst, mwagner, snagar, tburke, virt-maint
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-11-11 16:29:01 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 596891    
Attachments:
Description Flags
Patch to allow libvirt and svirt to connect to /dev/vhost-net none

Description Eduardo Habkost 2010-06-02 18:26:47 UTC 
Opening this bug for the needed selinux-policy change for /dev/vhost-net. It was first mentioned on Bug #596891, as pasted below.

+++ This bug was initially created as a clone of Bug #596891 +++

The /etc/sysconfig/modules/kvm.modules script is used at bootup to load the kvm module, however we also need to load the vhost-net module, otherwise we'll see greatly reduced network through-put.

libvirt we automagically use vhost if /dev/vhost-net exists.
We need to automate this process

--- Additional comment from mst on 2010-06-02 11:57:04 EDT ---

Just to clarify: since we rely on libvirt and that runs as root,
we do not need to change any used rules at all.
It is enough to load the module (that will pull in tun
and macvtap), and we are done.

--- Additional comment from mst on 2010-06-02 13:10:13 EDT ---

another issue is selinux policy.
some advice from #virt: the quickest work around until we file a BZ and get it fixed in selinux policy might be:   
chcon -t kvm_device_t /dev/vhost-net
Comment 1 Daniel Walsh 2010-06-02 18:44:43 UTC 
Created attachment 419130 [details]
Patch to allow libvirt and svirt to connect to /dev/vhost-net
Comment 2 Daniel Walsh 2010-06-02 18:49:26 UTC 
*** Bug 596968 has been marked as a duplicate of this bug. ***
Comment 3 Miroslav Grepl 2010-06-03 15:32:34 UTC 
Fixed in selinux-policy-3.7.19-23.el6.noarch
Comment 6 Milos Malik 2010-06-07 08:22:18 UTC 
Could you test the real scenario (run the virtual machine in desired environment) ? All proposed SELinux rules are present.
Comment 7 Eduardo Habkost 2010-06-08 22:08:35 UTC 
Something still doesn't look right, using selinux-policy-3.7.19-23.el6.noarch:

(selinux set to permissive mode on my tests)


[root@virtlab7 ~]# rpm -q selinux-policy libvirt
selinux-policy-3.7.19-23.el6.noarch
libvirt-0.8.1-7.el6.x86_64
[root@virtlab7 ~]# ls -lZ /dev/vhost-net 
crw-rw-rw-. root kvm system_u:object_r:vhost_device_t:s0 /dev/vhost-net
[root@virtlab7 ~]# tail -n0 -f /var/log/audit/audit.log &
[1] 2262
[root@virtlab7 ~]# virsh list --all
 Id Name                 State
----------------------------------
  - vm1                  shut off

[root@virtlab7 ~]# virsh start vm1
type=ANOM_PROMISCUOUS msg=audit(1276025845.357:24820): dev=vnet0 prom=256 old_prom=0 auid=4294967295 uid=0 gid=0 ses=4294967295
type=SYSCALL msg=audit(1276025845.357:24820): arch=c000003e syscall=16 success=yes exit=0 a0=10 a1=89a2 a2=7fb722f4ab30 a3=373697a14c items=0 ppid=1 pid=1938 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1276025845.421:24821): avc:  denied  { read write } for  pid=2272 comm="qemu-kvm" path="/dev/vhost-net" dev=devtmpfs ino=10448 scontext=system_u:system_r:svirt_t:s0:c94,c724 tcontext=system_u:object_r:vhost_device_t:s0 tclass=chr_file
type=SYSCALL msg=audit(1276025845.421:24821): arch=c000003e syscall=59 success=yes exit=0 a0=7fb708037200 a1=7fb7083d1df0 a2=7fb7083cf050 a3=7fb722f4be60 items=0 ppid=1 pid=2272 auid=4294967295 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=4294967295 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c94,c724 key=(null)
type=AVC msg=audit(1276025845.468:24822): avc:  denied  { ioctl } for  pid=2272 comm="qemu-kvm" path="/dev/vhost-net" dev=devtmpfs ino=10448 scontext=system_u:system_r:svirt_t:s0:c94,c724 tcontext=system_u:object_r:vhost_device_t:s0 tclass=chr_file
type=SYSCALL msg=audit(1276025845.468:24822): arch=c000003e syscall=16 success=yes exit=0 a0=12 a1=af01 a2=0 a3=128 items=0 ppid=1 pid=2272 auid=4294967295 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=4294967295 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c94,c724 key=(null)
Domain vm1 started
Comment 8 Eduardo Habkost 2010-06-08 22:50:29 UTC 
'tclass=chr_file' seems to be the issue. A rw_chr_files_pattern is missing on dev_rw_vhost.
Comment 11 Miroslav Grepl 2010-06-10 06:40:04 UTC 
Fixed in selinux-policy-3.7.19-24.el6.noarch
Comment 12 Eduardo Habkost 2010-06-10 15:36:46 UTC 
It looks OK, now. I just tested selinux-policy-3.7.19-24.el6.noarch, and I don't see any selinux denials anymore when starting a guest with vhost-net loaded.
Comment 14 Daniel Berrangé 2010-06-14 10:35:20 UTC 
*** Bug 601276 has been marked as a duplicate of this bug. ***
Comment 15 releng-rhel@redhat.com 2010-11-11 16:29:01 UTC 
Red Hat Enterprise Linux 6.0 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.