Description of problem: Version-Release number of selected component (if applicable): kmod-kvm-83-207.el5 kvm-83-207.el5 kvm-tools-83-207.el5 selinux-policy-2.4.6-292.el5 selinux-policy-devel-2.4.6-292.el5 selinux-policy-minimum-2.4.6-292.el5 selinux-policy-mls-2.4.6-292.el5 selinux-policy-strict-2.4.6-292.el5 selinux-policy-targeted-2.4.6-292.el5 How reproducible: always Steps to Reproduce: Run following automated test on x86_64 machine which supports virtualization: /CoreOS/selinux-policy/Regression/bz530552-virDomainSave-and-dd-execution Actual results: ---- time->Fri Nov 12 07:32:36 2010 type=SYSCALL msg=audit(1289565156.823:74): arch=c000003e syscall=87 success=no exit=-13 a0=9ae3dd0 a1=c2 a2=7 a3=0 items=0 ppid=1 pid=31143 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c668,c792 key=(null) type=AVC msg=audit(1289565156.823:74): avc: denied { unlink } for pid=31143 comm="qemu-kvm" name="kvm.MhzoQ3" dev=hugetlbfs ino=118439 scontext=system_u:system_r:svirt_t:s0:c668,c792 tcontext=system_u:object_r:hugetlbfs_t:s0 tclass=file ---- time->Fri Nov 12 07:32:36 2010 type=SYSCALL msg=audit(1289565156.823:75): arch=c000003e syscall=77 success=no exit=-13 a0=8 a1=21600000 a2=ffe00000 a3=0 items=0 ppid=1 pid=31143 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c668,c792 key=(null) type=AVC msg=audit(1289565156.823:75): avc: denied { write } for pid=31143 comm="qemu-kvm" name="kvm.MhzoQ3" dev=hugetlbfs ino=118439 scontext=system_u:system_r:svirt_t:s0:c668,c792 tcontext=system_u:object_r:hugetlbfs_t:s0 tclass=file ---- time->Fri Nov 12 07:32:36 2010 type=SYSCALL msg=audit(1289565156.823:76): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=21600000 a2=3 a3=2 items=0 ppid=1 pid=31143 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c668,c792 key=(null) type=AVC msg=audit(1289565156.823:76): avc: denied { read } for pid=31143 comm="qemu-kvm" path="/mnt/huge/libvirt/qemu/kvm.MhzoQ3" dev=hugetlbfs ino=118439 scontext=system_u:system_r:svirt_t:s0:c668,c792 tcontext=system_u:object_r:hugetlbfs_t:s0 tclass=file ---- Expected results: no AVCs
I am not sure hugetlbfs supports labeling in RHEL5, so you might need to allow svirt_t to manage this file system.
*** Bug 638161 has been marked as a duplicate of this bug. ***
Fixed in selinux-policy-2.4.6-294.el5.noarch
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Due to an error in the SELinux policy, SELinux prevented the qemu-kvm command from accessing HugeTLBfs devices. This update corrects the SELinux rules to allow this access.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0026.html