Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 691622

Summary: AVC denied to create a channel with socket type
Product: Red Hat Enterprise Linux 6 Reporter: zhanghaiyan <yoyzhang>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED WONTFIX QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 6.1CC: dwalsh, dyuan, mgrepl, mmalik, veillard
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-03-30 02:18:03 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description zhanghaiyan 2011-03-29 03:08:09 UTC 
Description of problem:
In enforing selinux status, failed to create a channel with socket-virtconsole type

Version-Release number of selected component (if applicable):
- selinux-policy-3.7.19-80.el6.noarch
- 2.6.32-125.el6.x86_64
- qemu-kvm-0.12.1.2-2.152.el6.x86_64
- libvirt-0.8.7-14.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1. Define a guest containing the following xml info in config file
    <controller type='virtio-serial' index='0'/>
    <console type='unix'>
      <source mode='bind' path='/tmp/serial.sock'/>
      <target type='virtio' port='0'/>
    </console>
2. # getenforce 
Enforcing
3. # virsh start rhel6-qcow2
error: Failed to start domain rhel6-qcow2
error: internal error process exited while connecting to monitor: bind(unix:/tmp/serial.sock): Address already in use
chardev: opening backend "socket" failed
  
Actual results:
3. Failed to start the guest in enforing selinux
If #setenforce 0, then could start the guest

Expected results:
3. Succeed to start the guest in enforing selinux

Additional info:
# tail -f /var/log/messages
Mar 28 22:56:55 dhcp-65-132 kernel: device vnet1 entered promiscuous mode
Mar 28 22:56:55 dhcp-65-132 kernel: virbr0: topology change detected, propagating
Mar 28 22:56:55 dhcp-65-132 kernel: virbr0: port 3(vnet1) entering forwarding state
Mar 28 22:56:55 dhcp-65-132 libvirtd: 22:56:55.338: 7076: warning : qemudStartVMDaemon:3282 : Executing /usr/libexec/qemu-kvm
Mar 28 22:56:55 dhcp-65-132 libvirtd: 22:56:55.343: 7076: warning : qemudStartVMDaemon:3292 : Executing done /usr/libexec/qemu-kvm
Mar 28 22:56:55 dhcp-65-132 NetworkManager[1452]: <warn> /sys/devices/virtual/net/vnet1: couldn't determine device driver; ignoring...
Mar 28 22:56:55 dhcp-65-132 kernel: type=1400 audit(1301367415.390:23): avc:  denied  { unlink } for  pid=7313 comm="qemu-kvm" name="serial.sock" dev=sda1 ino=2768962 scontext=system_u:system_r:svirt_t:s0:c168,c532 tcontext=system_u:object_r:tmp_t:s0:c184,c486 tclass=sock_file
Mar 28 22:56:55 dhcp-65-132 kernel: virbr0: port 3(vnet1) entering disabled state
Mar 28 22:56:55 dhcp-65-132 kernel: device vnet1 left promiscuous mode
Mar 28 22:56:55 dhcp-65-132 kernel: virbr0: port 3(vnet1) entering disabled state
Comment 2 zhanghaiyan 2011-03-29 03:25:13 UTC 
Also failed to create a guest with socket-virtioserial channel
The guest contains the following xml info in its guest config file
   <controller type='virtio-serial' index='0'/>
    <channel type='unix'>
      <source mode='bind' path='/tmp/guestfwd'/>
      <target type='virtio' name='org.linux-kvm.port.1'/>
    </channel>
# virsh start rhel6-qcow2
error: Failed to start domain rhel6-qcow2
error: internal error process exited while connecting to monitor: bind(unix:/tmp/guestfwd): Address already in use
chardev: opening backend "socket" failed
# tail -f /var/log/messages
Mar 28 23:23:57 dhcp-65-132 kernel: device vnet0 entered promiscuous mode
Mar 28 23:23:57 dhcp-65-132 kernel: virbr0: topology change detected, propagating
Mar 28 23:23:57 dhcp-65-132 kernel: virbr0: port 2(vnet0) entering forwarding state
Mar 28 23:23:57 dhcp-65-132 libvirtd: 23:23:57.768: 1933: info : libvirt version: 0.8.7, package: 14.el6 (Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>, 2011-03-22-07:21:03, x86-002.build.bos.redhat.com)
Mar 28 23:23:57 dhcp-65-132 libvirtd: 23:23:57.768: 1933: warning : qemudStartVMDaemon:3282 : Executing /usr/libexec/qemu-kvm
Mar 28 23:23:57 dhcp-65-132 libvirtd: 23:23:57.773: 1933: warning : qemudStartVMDaemon:3292 : Executing done /usr/libexec/qemu-kvm
Mar 28 23:23:57 dhcp-65-132 NetworkManager[1480]: <warn> /sys/devices/virtual/net/vnet0: couldn't determine device driver; ignoring...
Mar 28 23:23:57 dhcp-65-132 kernel: type=1400 audit(1301369037.819:9): avc:  denied  { unlink } for  pid=2604 comm="qemu-kvm" name="guestfwd" dev=sda1 ino=2768982 scontext=system_u:system_r:svirt_t:s0:c662,c884 tcontext=system_u:object_r:tmp_t:s0:c225,c503 tclass=sock_file
Mar 28 23:23:57 dhcp-65-132 kernel: virbr0: port 2(vnet0) entering disabled state
Mar 28 23:23:57 dhcp-65-132 kernel: device vnet0 left promiscuous mode
Mar 28 23:23:57 dhcp-65-132 kernel: virbr0: port 2(vnet0) entering disabled state
Comment 3 Miroslav Grepl 2011-03-29 08:07:26 UTC 
Which AVC messages are you seeing in /var/log/audit/audit.log in permissive mode?
Comment 4 zhanghaiyan 2011-03-29 10:10:31 UTC 
In permissive mode, # virsh start rhel6-qcow2
Domain rhel6-qcow2 started

#tail -f /var/log/audit/audit.log
type=VIRT_MACHINE_ID msg=audit(1301393382.064:153): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 vm-ctx=system_u:system_r:svirt_t:s0:c681,c744 img-ctx=system_u:object_r:svirt_image_t:s0:c681,c744: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1301393382.157:154): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=cgroup reason=deny vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 cgroup="/cgroup/devices/libvirt/qemu/rhel6-qcow2/" class=all: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1301393382.157:155): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=cgroup reason=allow vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 cgroup="/cgroup/devices/libvirt/qemu/rhel6-qcow2/" class=major category=pty maj=88 acl=rw: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1301393382.158:156): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=cgroup reason=allow vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 cgroup="/cgroup/devices/libvirt/qemu/rhel6-qcow2/" class=path path=/dev/null rdev=01:03 acl=rw: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1301393382.158:157): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=cgroup reason=allow vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 cgroup="/cgroup/devices/libvirt/qemu/rhel6-qcow2/" class=path path=/dev/full rdev=01:07 acl=rw: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1301393382.158:158): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=cgroup reason=allow vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 cgroup="/cgroup/devices/libvirt/qemu/rhel6-qcow2/" class=path path=/dev/zero rdev=01:05 acl=rw: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1301393382.158:159): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=cgroup reason=allow vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 cgroup="/cgroup/devices/libvirt/qemu/rhel6-qcow2/" class=path path=/dev/random rdev=01:08 acl=rw: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1301393382.158:160): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=cgroup reason=allow vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 cgroup="/cgroup/devices/libvirt/qemu/rhel6-qcow2/" class=path path=/dev/urandom rdev=01:09 acl=rw: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1301393382.158:161): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=cgroup reason=allow vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 cgroup="/cgroup/devices/libvirt/qemu/rhel6-qcow2/" class=path path=/dev/ptmx rdev=05:02 acl=rw: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1301393382.158:162): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=cgroup reason=allow vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 cgroup="/cgroup/devices/libvirt/qemu/rhel6-qcow2/" class=path path=/dev/kvm rdev=0A:E8 acl=rw: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1301393382.158:163): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=cgroup reason=allow vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 cgroup="/cgroup/devices/libvirt/qemu/rhel6-qcow2/" class=path path=/dev/kqemu rdev=? acl=rw: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=failed'
type=VIRT_RESOURCE msg=audit(1301393382.158:164): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=cgroup reason=allow vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 cgroup="/cgroup/devices/libvirt/qemu/rhel6-qcow2/" class=path path=/dev/rtc rdev=FE:00 acl=rw: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1301393382.158:165): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=cgroup reason=allow vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 cgroup="/cgroup/devices/libvirt/qemu/rhel6-qcow2/" class=path path=/dev/hpet rdev=0A:E4 acl=rw: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=ANOM_PROMISCUOUS msg=audit(1301393382.160:166): dev=vnet0 prom=256 old_prom=0 auid=4294967295 uid=0 gid=0 ses=4294967295
type=VIRT_RESOURCE msg=audit(1301393382.161:167): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=net reason=open vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 net='52:54:00:AC:0B:F8' path="/dev/net/tun" rdev=0A:C8: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=AVC msg=audit(1301393382.201:168): avc:  denied  { unlink } for  pid=19112 comm="qemu-kvm" name="serial.sock" dev=sda1 ino=2768962 scontext=system_u:system_r:svirt_t:s0:c681,c744 tcontext=system_u:object_r:tmp_t:s0:c552,c840 tclass=sock_file
type=SYSCALL msg=audit(1301393382.201:168): arch=c000003e syscall=87 success=yes exit=0 a0=7fff0d2908c2 a1=64c9e9 a2=7fff0d2908d2 a3=fffffff0 items=0 ppid=1 pid=19112 auid=4294967295 uid=500 gid=501 euid=500 suid=500 fsuid=500 egid=501 sgid=501 fsgid=501 tty=(none) ses=4294967295 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c681,c744 key=(null)
type=AVC msg=audit(1301393382.201:169): avc:  denied  { create } for  pid=19112 comm="qemu-kvm" name="serial.sock" scontext=system_u:system_r:svirt_t:s0:c681,c744 tcontext=system_u:object_r:tmp_t:s0:c681,c744 tclass=sock_file
type=SYSCALL msg=audit(1301393382.201:169): arch=c000003e syscall=49 success=yes exit=0 a0=4 a1=7fff0d2908c0 a2=6e a3=fffffff0 items=0 ppid=1 pid=19112 auid=4294967295 uid=500 gid=501 euid=500 suid=500 fsuid=500 egid=501 sgid=501 fsgid=501 tty=(none) ses=4294967295 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c681,c744 key=(null)
type=VIRT_RESOURCE msg=audit(1301393382.371:170): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=disk reason=start vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 old-disk="?" new-disk="/var/lib/libvirt/images/rhel6-qcow2.img": exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1301393382.371:171): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=net reason=start vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 old-net='?' new-net='52:54:00:AC:0B:F8': exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1301393382.371:172): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=mem reason=start vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 old-mem=0 new-mem=1048576: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1301393382.371:173): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='resrc=vcpu reason=start vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7 old-vcpu=0 new-vcpu=1: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_CONTROL msg=audit(1301393382.371:174): user pid=1903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=start reason=booted vm="rhel6-qcow2" uuid=59c272be-74d5-72e5-11c5-b86196fafdd7: exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
Comment 5 Daniel Walsh 2011-03-29 18:04:11 UTC 
We currently don't allow svirt_t to work in /tmp.  It would have been allowed to do this in a directory labeled qemu_var_run_t.

/var/lib/libvirt/qemu
or
/var/run/libvirt/qemu

If you feal it should be allowed in /tmp, I guess we can add it.