Bug 806894 - SELinux is preventing /usr/bin/qemu-kvm from 'getattr' accesses on the filesystem /dev.
Summary: SELinux is preventing /usr/bin/qemu-kvm from 'getattr' accesses on the filesy...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 17
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:648e8e07bb69170ea6a925ddae0...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-03-26 12:57 UTC by Nikolai Maziashvili
Modified: 2012-04-04 21:10 UTC (History)
4 users (show)

Fixed In Version: selinux-policy-3.10.0-110.fc17
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-04-04 21:10:47 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Nikolai Maziashvili 2012-03-26 12:57:13 UTC
libreport version: 2.0.8
executable:     /usr/bin/python
hashmarkername: setroubleshoot
kernel:         3.3.0-1.fc17.x86_64
reason:         SELinux is preventing /usr/bin/qemu-kvm from 'getattr' accesses on the filesystem /dev.
time:           Mon 26 Mar 2012 02:56:06 PM CEST

description:
:SELinux is preventing /usr/bin/qemu-kvm from 'getattr' accesses on the filesystem /dev.
:
:*****  Plugin catchall (100. confidence) suggests  ***************************
:
:If you believe that qemu-kvm should be allowed getattr access on the dev filesystem by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:Do
:allow this access for now by executing:
:# grep qemu-kvm /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                system_u:system_r:svirt_t:s0:c227,c439
:Target Context                system_u:object_r:device_t:s0
:Target Objects                /dev [ filesystem ]
:Source                        qemu-kvm
:Source Path                   /usr/bin/qemu-kvm
:Port                          <Unknown>
:Host                          (removed)
:Source RPM Packages           qemu-system-x86-1.0-6.fc17.x86_64
:Target RPM Packages           filesystem-3-2.fc17.x86_64
:Policy RPM                    selinux-policy-3.10.0-106.fc17.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Permissive
:Host Name                     (removed)
:Platform                      Linux (removed) 3.3.0-1.fc17.x86_64 #1 SMP Mon Mar 19
:                              03:03:39 UTC 2012 x86_64 x86_64
:Alert Count                   1
:First Seen                    Mon 26 Mar 2012 02:55:13 PM CEST
:Last Seen                     Mon 26 Mar 2012 02:55:13 PM CEST
:Local ID                      4f76d79c-63f9-4b16-9b15-58111fc48458
:
:Raw Audit Messages
:type=AVC msg=audit(1332766513.660:341): avc:  denied  { getattr } for  pid=1950 comm="qemu-kvm" name="/" dev="devtmpfs" ino=1025 scontext=system_u:system_r:svirt_t:s0:c227,c439 tcontext=system_u:object_r:device_t:s0 tclass=filesystem
:
:
:type=SYSCALL msg=audit(1332766513.660:341): arch=x86_64 syscall=fstatfs success=yes exit=0 a0=a a1=7fff07405650 a2=0 a3=28 items=0 ppid=1 pid=1950 auid=4294967295 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=4294967295 comm=qemu-kvm exe=/usr/bin/qemu-kvm subj=system_u:system_r:svirt_t:s0:c227,c439 key=(null)
:
:Hash: qemu-kvm,svirt_t,device_t,filesystem,getattr
:
:audit2allowunable to open /sys/fs/selinux/policy:  Permission denied
:
:
:audit2allow -Runable to open /sys/fs/selinux/policy:  Permission denied
:
:

Comment 1 Daniel Walsh 2012-03-27 19:54:07 UTC
ls -ldZ /dev

Comment 2 Jiri Popelka 2012-03-28 05:49:55 UTC
(In reply to comment #1)
> ls -ldZ /dev

drwxr-xr-x. root root system_u:object_r:device_t:s0    /dev

Comment 3 Daniel Walsh 2012-03-28 13:49:50 UTC
I have no idea why, but does not seem like something we need to block.

Fixed in selinux-policy-3.10.0-108.fc17

Comment 4 Fedora Update System 2012-04-03 07:44:01 UTC
selinux-policy-3.10.0-110.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-110.fc17

Comment 5 Fedora Update System 2012-04-04 21:10:47 UTC
selinux-policy-3.10.0-110.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.