Hide Forgot
selinux seems to be blocking attempts to do things with xen from libvirt. Some of the errors are below. You should be able to reproduce this by installing xen, xen-runtime, xen-libs xen-hypervisor and libvirt then booting the system under the xen hypervisor. I believe the following examples were all generated just by the startup/status/shutdown scripts of libvirt without actually using it. Bug 741042 and Bug 742699 are probably the same issue. type=AVC msg=audit(1308416554.923:127): avc: denied { getattr } for pid=3298 comm="xl" path="/var/run/xenstored.pid" dev=tmpfs ino=17775 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xenstored_var_run_t:s0 tclass=file type=AVC msg=audit(1301774644.394:217): avc: denied { getattr } for pid=1774 comm="virsh" path="/var/run/xenstored/socket" dev=tmpfs ino=17857 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=sock_file type=AVC msg=audit(1301774644.251:206): avc: denied { write } for pid=1740 comm="xm" name="xmlrpc.sock" dev=tmpfs ino=18388 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=sock_file type=AVC msg=audit(1301773904.850:239): avc: denied { write } for pid=14483 comm="virsh" name="libvirt-sock" dev=tmpfs ino=18252 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=sock_file type=AVC msg=audit(1282330354.665:26808): avc: denied { getattr } for pid=9891 comm="setfiles" path="/usr/bin/virsh" dev=dm-8 ino=450654 scontext=user_u:user_r:policykit_grant_t:s0 tcontext=system_u:object_r:virsh_exec_t:s0 tclass=file type=AVC msg=audit(1313519773.784:225): avc: denied { setuid } for pid=4097 comm="xend" capability=7 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:system_r:virsh_t:s0 tclass=capability type=AVC msg=audit(1313519773.776:224): avc: denied { open } for pid=4109 comm="ps" name="stat" dev=proc ino=47364 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:system_r:plymouthd_t:s0 tclass=file type=AVC msg=audit(1301605453.093:279): avc: denied { write } for pid=14788 comm="virsh" name="socket" dev=tmpfs ino=18952 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=sock_file type=AVC msg=audit(1313519773.580:178): avc: denied { open } for pid=4097 comm="xend" name="xend.pid" dev=tmpfs ino=18346 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_var_run_t:s0 tclass=file type=AVC msg=audit(1313519773.580:178): avc: denied { read } for pid=4097 comm="xend" name="xend.pid" dev=tmpfs ino=18346 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_var_run_t:s0 tclass=file type=AVC msg=audit(1313519773.580:177): avc: denied { getattr } for pid=4097 comm="xend" path="/var/run/xend.pid" dev=tmpfs ino=18346 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_var_run_t:s0 tclass=file type=AVC msg=audit(1313519772.862:173): avc: denied { ioctl } for pid=4097 comm="xend" path="/usr/sbin/xend" dev=dm-5 ino=426324 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_exec_t:s0 tclass=file type=AVC msg=audit(1313519772.730:169): avc: denied { read open } for pid=4097 comm="virsh" name="xend" dev=dm-5 ino=426324 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_exec_t:s0 tclass=file
Sorry, the errors I posted above were older than I realised and may not still be current. Here are some new ones (including some which may be with a xen guest running) type=AVC msg=audit(1317503403.133:66): avc: denied { getattr } for pid=1248 comm="xl" path="/var/run/xenstored.pid" dev=tmpfs ino=18157 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xenstored_var_run_t:s0 tclass=file type=AVC msg=audit(1317503850.899:99): avc: denied { execute } for pid=1535 comm="virsh" name="xend" dev=dm-5 ino=431318 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_exec_t:s0 tclass=file type=AVC msg=audit(1317503850.899:99): avc: denied { read open } for pid=1535 comm="virsh" name="xend" dev=dm-5 ino=431318 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_exec_t:s0 tclass=file type=AVC msg=audit(1317503850.899:99): avc: denied { execute_no_trans } for pid=1535 comm="virsh" path="/usr/sbin/xend" dev=dm-5 ino=431318 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_exec_t:s0 tclass=file type=AVC msg=audit(1317503850.949:104): avc: denied { getattr } for pid=1535 comm="xend" path="/usr/sbin/xend" dev=dm-5 ino=431318 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_exec_t:s0 tclass=file type=AVC msg=audit(1317503850.949:105): avc: denied { ioctl } for pid=1535 comm="xend" path="/usr/sbin/xend" dev=dm-5 ino=431318 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xend_exec_t:s0 tclass=file type=AVC msg=audit(1317556148.669:69): avc: denied { getattr } for pid=1248 comm="xl" path="/var/run/xenstored.pid" dev=tmpfs ino=18185 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xenstored_var_run_t:s0 tclass=file type=AVC msg=audit(1317556624.321:94): avc: denied { sys_module } for pid=2141 comm="brctl" capability=16 scontext=system_u:system_r:brctl_t:s0-s0:c0.c1023 tcontext=system_u:system_r:brctl_t:s0-s0:c0.c1023 tclass=capability
Fixed in selinux-policy-3.10.0-36.fc16
selinux-policy-3.10.0-36.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-36.fc16
Package selinux-policy-3.10.0-36.fc16: * should fix your issue, * was pushed to the Fedora 16 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-36.fc16' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-36.fc16 then log in and leave karma (feedback).
The problem isn't entirely fixed. I still get messages like type=AVC msg=audit(1317843757.701:65): avc: denied { getattr } for pid=1246 comm="xl" path="/var/run/xenstored.pid" dev=tmpfs ino=18473 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:xenstored_var_run_t:s0 tclass=file
Are you getting more AVC msgs in permissive mode? #setenforce 0 re-test it. # ausearch -m avc -ts recent #setenforce 1
These messages were all generated in permissive mode. The message in comment 5 is essentially the same as one in comment 3 (and one in comment 1) so it isn't a new discovery.
Fixed in selinux-policy-3.10.0-38.fc16
selinux-policy-3.10.0-38.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.