Bug 706987 - Targeted SELinux policy prohibits xend from starting
Summary: Targeted SELinux policy prohibits xend from starting
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 15
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-05-23 17:05 UTC by W. Michael Petullo
Modified: 2011-05-30 21:52 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-05-30 21:52:25 UTC
Type: ---


Attachments (Terms of Use)
Audit log 1 (211 bytes, application/octet-stream)
2011-05-23 17:05 UTC, W. Michael Petullo
no flags Details
Audit log 2 (32.11 KB, text/plain)
2011-05-23 17:06 UTC, W. Michael Petullo
no flags Details

Description W. Michael Petullo 2011-05-23 17:05:41 UTC
Created attachment 500465 [details]
Audit log 1

Description of problem:
The targeted SELinux policy prohibits xend from starting.

Version-Release number of selected component (if applicable):
xen-4.1.0-2.fc15.x86_64
selinux-policy-targeted-3.9.16-23.fc15.noarch

How reproducible:
Every time

Steps to Reproduce:
1. Boot with SELinux enforcing its targeted policy
2. Start xend
  
Actual results:
Xend fails to start, as noted in the log below. Although xend fails to start everytime, the audit log cycles between two possible outputs each time I try to restart xend. These are attached as 1.log and 2.log. 

[2011-05-23 09:49:06 1238] ERROR (SrvDaemon:356) Exception starting xend (ord() expected a character, but string of length 0 found)
Traceback (most recent call last):
  File "/usr/lib64/python2.7/site-packages/xen/xend/server/SrvDaemon.py", line 348, in run
    servers = SrvServer.create()
  File "/usr/lib64/python2.7/site-packages/xen/xend/server/SrvServer.py", line 258, in create
    root.putChild('xend', SrvRoot())
  File "/usr/lib64/python2.7/site-packages/xen/xend/server/SrvRoot.py", line 40, in __init__
    self.get(name)
  File "/usr/lib64/python2.7/site-packages/xen/web/SrvDir.py", line 84, in get
    val = val.getobj()
  File "/usr/lib64/python2.7/site-packages/xen/web/SrvDir.py", line 52, in getobj
    self.obj = klassobj()
  File "/usr/lib64/python2.7/site-packages/xen/xend/server/SrvNode.py", line 30, in __init__
    self.xn = XendNode.instance()
  File "/usr/lib64/python2.7/site-packages/xen/xend/XendNode.py", line 1181, in instance
    inst = XendNode()
  File "/usr/lib64/python2.7/site-packages/xen/xend/XendNode.py", line 159, in __init__
    self._init_PPCIs()
  File "/usr/lib64/python2.7/site-packages/xen/xend/XendNode.py", line 282, in _init_PPCIs
    for pci_dev in PciUtil.get_all_pci_devices():
  File "/usr/lib64/python2.7/site-packages/xen/util/pci.py", line 475, in get_all_pci_devices
    return map(PciDevice, get_all_pci_dict())
  File "/usr/lib64/python2.7/site-packages/xen/util/pci.py", line 696, in __init__
    self.detect_dev_info()
  File "/usr/lib64/python2.7/site-packages/xen/util/pci.py", line 1061, in detect_dev_info
    pos = self.find_cap_offset(PCI_CAP_ID_EXP)
  File "/usr/lib64/python2.7/site-packages/xen/util/pci.py", line 942, in find_cap_offset
    id = ord(os.read(fd, 1))
TypeError: ord() expected a character, but string of length 0 found

Expected results:
Xend should start.

Additional info:
Setting SELinux to permissive mode allows xend to start. I have to restart it twice to get it to finally start. This is probably related to the comment about the two audit log outputs above.

Comment 1 W. Michael Petullo 2011-05-23 17:06:25 UTC
Created attachment 500466 [details]
Audit log 2

Comment 2 Daniel Walsh 2011-05-23 19:26:56 UTC
Fixed in selinux-policy-3.9.16-25.fc15

Comment 3 W. Michael Petullo 2011-05-25 17:01:55 UTC
I don't see a selinux-policy-3.9.16-25.fc15 build in Koji or anything in the Git f15 branch yet.

Comment 4 W. Michael Petullo 2011-05-30 21:52:25 UTC
Confirmed fixed in selinux-policy-3.9.16-26.fc15.noarch (probably -25.fc15 too, but I did not test that version). Thank you, Daniel.


Note You need to log in before you can comment on or make changes to this bug.