Bug 822958 - SELinux is preventing /usr/bin/qemu-kvm from write access on the file /home/test/.libvirt/qemu/log/Fedora 17.log
Summary: SELinux is preventing /usr/bin/qemu-kvm from write access on the file /home/t...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 17
Hardware: All
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-05-18 15:46 UTC by Jiri Koten
Modified: 2012-06-22 12:16 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-06-22 12:16:08 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description Jiri Koten 2012-05-18 15:46:36 UTC 
Description of problem:
When I try to install VM using Boxes, it fails and I got SELinux AVC alert.  Also get this every time I try to run the VM.

Version-Release number of selected component (if applicable):
gnome-boxes-3.4.2-1.fc17
selinux-policy-3.10.0-125.fc17
qemu-system-x86-1.0-17.fc17

How reproducible:
100%

Steps to Reproduce:
1. run gnome-boxes
2. install F17 using iso file
  
Actual results:
installation failed

Additional info:

Source Context                system_u:system_r:svirt_t:s0:c251,c695
Target Context                unconfined_u:object_r:virt_home_t:s0
Target Objects                /home/test/.libvirt/qemu/log/Fedora 17.log [ file
                              ]
Source                        qemu-kvm
Source Path                   /usr/bin/qemu-kvm
Port                          <Unknown>
Host                          dhcp-29-57.brq.redhat.com
Source RPM Packages           qemu-system-x86-1.0-17.fc17.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.10.0-125.fc17.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     dhcp-29-57.brq.redhat.com
Platform                      Linux dhcp-29-57.brq.redhat.com
                              3.3.6-3.fc17.x86_64 #1 SMP Wed May 16 21:21:18 UTC
                              2012 x86_64 x86_64
Alert Count                   2
First Seen                    Fri 18 May 2012 02:45:39 PM CEST
Last Seen                     Fri 18 May 2012 03:20:29 PM CEST
Local ID                      6576043f-66b3-4303-a200-1ff8fa05045a

Raw Audit Messages
type=AVC msg=audit(1337347229.119:115): avc:  denied  { write } for  pid=4007 comm="qemu-kvm" path=2F686F6D652F746573742F2E6C6962766972742F71656D752F6C6F672F4665646F72612031372E6C6F67 dev="dm-9" ino=803162 scontext=system_u:system_r:svirt_t:s0:c251,c695 tcontext=unconfined_u:object_r:virt_home_t:s0 tclass=file


type=SYSCALL msg=audit(1337347229.119:115): arch=x86_64 syscall=write success=yes exit=EINVAL a0=1 a1=7f087b6e8000 a2=16 a3=7f087682105c items=0 ppid=1 pid=4007 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=2 comm=qemu-kvm exe=/usr/bin/qemu-kvm subj=system_u:system_r:svirt_t:s0:c251,c695 key=(null)
Comment 1 Daniel Walsh 2012-05-18 17:54:09 UTC 
Could you 

rm /home/test/.libvirt/qemu/log/*.log
chcon -t svirt_home_t -R /home/test/.libvirt/qemu

And then try it out?

This is the new labeling I will add to F17.
Comment 2 Christophe Fergeau 2012-05-21 07:29:03 UTC 
This is a duplicate of bug #809910
Note You need to log in before you can comment on or make changes to this bug.