Bug 831850 - SELinux prevents remote-viewer connection to Virtual machine provisioned by Ovirt Management
Summary: SELinux prevents remote-viewer connection to Virtual machine provisioned by O...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 17
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-06-13 21:55 UTC by Marian Krcmarik
Modified: 2012-07-19 09:17 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-06-20 00:29:08 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Marian Krcmarik 2012-06-13 21:55:56 UTC
Description of problem:
SELinux prevents remote-viewer connection to Virtual machine provisioned by Ovirt Management.
AVC:
type=AVC msg=audit(1339600810.583:314): avc:  denied  { name_connect } for  pid=2546 comm="remote-viewer" dest=5911 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:vnc_port_t:s0 tclass=tcp_socket

Version-Release number of selected component (if applicable):
virt-viewer-0.5.3-1.fc17
spice-xpi-2.7-1.fc17

How reproducible:
Always

Steps to Reproduce:
1. Log in to RHEVM/Ovirt User portal in Firefox (management web frontend of RHEVM/Ovirt - virtualization managers, spice-xpi plugin needs to be installed.
2. Click on Spice console button to connect to any VM provisioned by RHEVM/Ovirt with using remote-viewer client (binary included in virt-viewer package).
  
Actual results:
AVC, SELinux prevents remote-viewer connection.

Expected results:
No AVC, successful cnenction in enforcing mode.

Additional info:
since it's not esay to get setup, I am willing to provide any more info.
WORKAROUND: Switch to permissive mode

Comment 1 Daniel Walsh 2012-06-14 20:16:21 UTC
Looks like we already have a fix for this in, 

Fixed in selinux-policy-3.10.0-130.fc17

Comment 2 Fedora Update System 2012-06-19 07:58:43 UTC
selinux-policy-3.10.0-132.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-132.fc17

Comment 3 Fedora Update System 2012-06-20 00:29:08 UTC
selinux-policy-3.10.0-132.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2012-07-19 09:17:08 UTC
selinux-policy-3.10.0-132.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.