Bug 822958 - SELinux is preventing /usr/bin/qemu-kvm from write access on the file /home/test/.libvirt/qemu/log/Fedora 17.log
SELinux is preventing /usr/bin/qemu-kvm from write access on the file /home/t...
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
All Linux
unspecified Severity high
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2012-05-18 11:46 EDT by Jiri Koten
Modified: 2012-06-22 08:16 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-06-22 08:16:08 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Jiri Koten 2012-05-18 11:46:36 EDT
Description of problem:
When I try to install VM using Boxes, it fails and I got SELinux AVC alert.  Also get this every time I try to run the VM.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. run gnome-boxes
2. install F17 using iso file
Actual results:
installation failed

Additional info:

Source Context                system_u:system_r:svirt_t:s0:c251,c695
Target Context                unconfined_u:object_r:virt_home_t:s0
Target Objects                /home/test/.libvirt/qemu/log/Fedora 17.log [ file
Source                        qemu-kvm
Source Path                   /usr/bin/qemu-kvm
Port                          <Unknown>
Host                          dhcp-29-57.brq.redhat.com
Source RPM Packages           qemu-system-x86-1.0-17.fc17.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.10.0-125.fc17.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     dhcp-29-57.brq.redhat.com
Platform                      Linux dhcp-29-57.brq.redhat.com
                              3.3.6-3.fc17.x86_64 #1 SMP Wed May 16 21:21:18 UTC
                              2012 x86_64 x86_64
Alert Count                   2
First Seen                    Fri 18 May 2012 02:45:39 PM CEST
Last Seen                     Fri 18 May 2012 03:20:29 PM CEST
Local ID                      6576043f-66b3-4303-a200-1ff8fa05045a

Raw Audit Messages
type=AVC msg=audit(1337347229.119:115): avc:  denied  { write } for  pid=4007 comm="qemu-kvm" path=2F686F6D652F746573742F2E6C6962766972742F71656D752F6C6F672F4665646F72612031372E6C6F67 dev="dm-9" ino=803162 scontext=system_u:system_r:svirt_t:s0:c251,c695 tcontext=unconfined_u:object_r:virt_home_t:s0 tclass=file

type=SYSCALL msg=audit(1337347229.119:115): arch=x86_64 syscall=write success=yes exit=EINVAL a0=1 a1=7f087b6e8000 a2=16 a3=7f087682105c items=0 ppid=1 pid=4007 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=2 comm=qemu-kvm exe=/usr/bin/qemu-kvm subj=system_u:system_r:svirt_t:s0:c251,c695 key=(null)
Comment 1 Daniel Walsh 2012-05-18 13:54:09 EDT
Could you 

rm /home/test/.libvirt/qemu/log/*.log
chcon -t svirt_home_t -R /home/test/.libvirt/qemu

And then try it out?

This is the new labeling I will add to F17.
Comment 2 Christophe Fergeau 2012-05-21 03:29:03 EDT
This is a duplicate of bug #809910

Note You need to log in before you can comment on or make changes to this bug.