Description of problem:

Dan Walsh has seen full details here, and agrees this is a bug, so the report here will be somewhat abbreviated.

Basically, with the unconfined module disabled:

rlpowell@basti> sudo virsh console vrici
Connected to domain vrici
Escape character is ^]
error: Unable to open stream for '/dev/pts/3': Permission denied

which is bad.

Version-Release number of selected component (if applicable):

3.9.16-32.fc15

How reproducible:

Disable unconfined.  Try to virsh console.

Additional info:

The following module fixes it:


rlpowell@basti> cat myvirt.te

module myvirt 1.0;

require {
        type virtd_t;
        type svirt_devpts_t;
        class chr_file { read write open };
}

#============= virtd_t ==============
#!!!! This avc can be allowed using the boolean 'allow_daemons_use_tty'

allow virtd_t svirt_devpts_t:chr_file open;
#!!!! This avc is allowed in the current policy

allow virtd_t svirt_devpts_t:chr_file { read write };