Fedora Account System
Red Hat Associate
Red Hat Customer
---Problem Description--- SELinux tag of HOME DIRECTORY/.cache/libvirt/qemu/log/GUEST.log is cache_home_t whereas it should be virt_log_t in Fedora 17 ---uname output--- Linux 3.5.2-1.fc17.x86_64 Machine Type = x86_64 ---Steps to Reproduce--- 1) Install libvirt and qemu 2) Copy the qemu-system-x86_64 to qemu-kvm 3) start libvirt daemon and then start virsh using virsh -c qemu:///session under an unprivileged user 4) start the guest and will get denial of write for the log for the HOME DIRECTORY/.cache/libvirt/qemu/log/GUEST.log 5) ls -alZ HOME DIRECTORY/.cache/libvirt/qemu/log/GUEST.log will see cache_home_t as the type rather than virt_log_t Here are the denial messages I get type=AVC msg=audit(1345648423.091:575): avc:? denied? { write } for? pid=29234 comm="qemu-kvm" path="/home/richa/.cache/libvirt/qemu/log/F14_64.log" dev="dm-2" ino=15204923 scontext=unconfined_u:unconfined_r:svirt_t:s0:c658,c891 tcontext=unconfined_u:object_r:cache_home_t:s0 tclass=file type=SYSCALL msg=audit(1345648423.091:575): arch=c000003e syscall=59 success=yes exit=0 a0=7f8458003060 a1=7f8458003a10 a2=7f84580029a0 a3=7f8473d2d850 items=0 ppid=1 pid=29234 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=2 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=unconfined_u:unconfined_r:svirt_t:s0:c658,c891 key=(null) type=AVC msg=audit(1345648423.097:576): avc:? denied? { write } for? pid=29234 comm="qemu-kvm" name="lib" dev="dm-2" ino=15204904 scontext=unconfined_u:unconfined_r:svirt_t:s0:c658,c891 tcontext=unconfined_u:object_r:config_home_t:s0 tclass=dir
We have fixes in F18. I am backporting them. Fixed in selinux-policy-3.10.0-148.fc17
------- Comment From rmarwah.com 2012-08-29 15:06 EDT------- I tried the selinux-policy-3.10.0-148.fc17 and now I see that the type is svirt_home_t shouldn't it be virt_log_t as its a log file
Which is correct. We label files in HOME_DIR/.cache/libvirt/qemu as svirt_home_t.
------- Comment From rmarwah.com 2012-09-06 20:54 EDT------- Thanks a lot. You can close the bug
selinux-policy-3.10.0-149.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-149.fc17
Package selinux-policy-3.10.0-149.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-149.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-14301/selinux-policy-3.10.0-149.fc17 then log in and leave karma (feedback).
selinux-policy-3.10.0-149.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.