Bug 607268 - QEMU not allowed to access fifo files labelled as svirt_image_t
Summary: QEMU not allowed to access fifo files labelled as svirt_image_t
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy   
(Show other bugs)
Version: 6.0
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
Depends On:
TreeView+ depends on / blocked
Reported: 2010-06-23 16:40 UTC by Daniel Berrange
Modified: 2012-10-15 14:27 UTC (History)
3 users (show)

Fixed In Version: selinux-policy-3.7.19-28.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2010-11-10 21:34:52 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

Description Daniel Berrange 2010-06-23 16:40:11 UTC
Description of problem:

I've been working on fixing SELinux labelling in svirt for character devices in QEMU, eg a vmchannel:

    <channel type='pipe'>
      <source path='/var/lib/libvirt/channel-bar'/>
      <target type='virtio' name='org.linux-kvm.port.bar'/>
      <address type='virtio-serial' controller='0' bus='0' port='1'/>

The /var/lib/libvirt/channel-bar is a fifo file (as created by mkfifo).

I have libvirt labelling this with  system_u:object_r:svirt_image_t:s0:c265,c657, but the policy still denies it

type=AVC msg=audit(1277307748.996:31411): avc:  denied  { read write } for  pid=23742 comm="qemu-kvm" name="channel-bar.out" dev=dm-1 ino=12135 scontext=system_u:system_r:svirt_t:s0:c265,c657 tcontext=system_u:object_r:svirt_image_t:s0:c265,c657 tclass=fifo_file

We need to allow access to fifo_file when it is appropriately labeled with the guest's MCS category.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
Actual results:

Expected results:

Additional info:

Comment 2 RHEL Product and Program Management 2010-06-23 16:52:59 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for

Comment 3 Daniel Walsh 2010-06-25 19:29:14 UTC
Miroslav add 
manage_fifo_files_pattern(svirt_t, svirt_image_t, svirt_image_t)

To virt.te

Comment 4 Daniel Walsh 2010-06-25 19:33:07 UTC
Actually we want to add

	manage_fifo_files_pattern($1_t, $1_image_t, $1_image_t)

To virt_domain_template

Comment 5 Miroslav Grepl 2010-06-29 15:32:37 UTC
Fixed in selinux-policy-3.7.19-28.el6.noarch

Comment 9 releng-rhel@redhat.com 2010-11-10 21:34:52 UTC
Red Hat Enterprise Linux 6.0 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.

Note You need to log in before you can comment on or make changes to this bug.