Bug 872511 - SELinux is preventing /usr/bin/qemu-kvm from 'connectto' accesses on the unix_stream_socket /tmp/libguestfsY0jFYI/console.sock.
SELinux is preventing /usr/bin/qemu-kvm from 'connectto' accesses on the unix...
Status: CLOSED DUPLICATE of bug 853393
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
18
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
abrt_hash:39dcde0be75d34f80e900fe71cf...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-11-02 05:47 EDT by Michael Scherer
Modified: 2012-12-07 12:30 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-12-07 12:30:02 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
File: type (9 bytes, text/plain)
2012-11-02 05:47 EDT, Michael Scherer
no flags Details
File: hashmarkername (14 bytes, text/plain)
2012-11-02 05:47 EDT, Michael Scherer
no flags Details

  None (edit)
Description Michael Scherer 2012-11-02 05:47:03 EDT
Description of problem:
tried to do basic test of guestfs-browser. It first didn't work as simple user, so i started it as root. 
Then this avc appeared, and i suspect that guestfs-browser is doing something weird.


Additional info:
libreport version: 2.0.18
kernel:         3.6.5-2.fc18.x86_64

description:
:SELinux is preventing /usr/bin/qemu-kvm from 'connectto' accesses on the unix_stream_socket /tmp/libguestfsY0jFYI/console.sock.
:
:*****  Plugin catchall (100. confidence) suggests  ***************************
:
:If vous pensez que qemu-kvm devrait être autorisé à accéder connectto sur console.sock unix_stream_socket par défaut.
:Then vous devriez rapporter ceci en tant qu'anomalie.
:Vous pouvez générer un module de stratégie local pour autoriser cet accès.
:Do
:autoriser cet accès pour le moment en exécutant :
:# grep qemu-kvm /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                system_u:system_r:svirt_t:s0:c437,c989
:Target Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
:                              023
:Target Objects                /tmp/libguestfsY0jFYI/console.sock [
:                              unix_stream_socket ]
:Source                        qemu-kvm
:Source Path                   /usr/bin/qemu-kvm
:Port                          <Inconnu>
:Host                          (removed)
:Source RPM Packages           qemu-system-x86-1.2.0-19.fc18.x86_64
:Target RPM Packages           
:Policy RPM                    selinux-policy-3.11.1-46.fc18.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.6.5-2.fc18.x86_64 #1 SMP Thu Nov
:                              1 00:39:17 UTC 2012 x86_64 x86_64
:Alert Count                   1
:First Seen                    2012-11-02 10:45:14 CET
:Last Seen                     2012-11-02 10:45:14 CET
:Local ID                      3923b7ef-fc82-43a0-8b80-e656a7205d6f
:
:Raw Audit Messages
:type=AVC msg=audit(1351849514.709:4241): avc:  denied  { connectto } for  pid=12019 comm="qemu-kvm" path="/tmp/libguestfsY0jFYI/console.sock" scontext=system_u:system_r:svirt_t:s0:c437,c989 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
:
:
:type=SYSCALL msg=audit(1351849514.709:4241): arch=x86_64 syscall=connect success=no exit=EACCES a0=4 a1=7fff77bb29a0 a2=6e a3=22 items=0 ppid=1 pid=12019 auid=4294967295 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=4294967295 comm=qemu-kvm exe=/usr/bin/qemu-kvm subj=system_u:system_r:svirt_t:s0:c437,c989 key=(null)
:
:Hash: qemu-kvm,svirt_t,unconfined_t,unix_stream_socket,connectto
:
:audit2allow
:
:#============= svirt_t ==============
:allow svirt_t unconfined_t:unix_stream_socket connectto;
:
:audit2allow -R
:
:#============= svirt_t ==============
:allow svirt_t unconfined_t:unix_stream_socket connectto;
:
Comment 1 Michael Scherer 2012-11-02 05:47:06 EDT
Created attachment 637008 [details]
File: type
Comment 2 Michael Scherer 2012-11-02 05:47:08 EDT
Created attachment 637009 [details]
File: hashmarkername
Comment 3 Richard W.M. Jones 2012-11-02 08:14:57 EDT
Which version of selinux-policy, libvirt is installed?

We fixed something very similar to this a while back (bug 857453
or bug 853393).

However yes in general, using libguestfs + libvirt + SELinux
is problematic at the moment in F18.  I'm working on fixing this.
Comment 4 Richard W.M. Jones 2012-11-02 08:15:37 EDT
Also, after updating libvirt, you'll need to kill *all*
libvirtd processes running on your machine and do
service libvirtd start.
Comment 5 Michael Scherer 2012-11-02 08:57:44 EDT
$ rpm -q libvirt
libvirt-0.10.2.1-2.fc18.x86_64
$ rpm -q selinux-policy-targeted 
selinux-policy-targeted-3.11.1-46.fc18.noarch

and my laptop was freshly reboot, but I am not sure if I did upgrade related rpms after or not. I will rebot later and let you know.
Comment 6 Richard W.M. Jones 2012-12-03 12:28:22 EST
I can reproduce this fairly easily now, but for some reason
only on a newly installed F18 machine.  It looks like an SELinux
policy bug.
Comment 7 Daniel Walsh 2012-12-06 16:04:11 EST
This looks like a virtual machine is trying to connect to a user domain over a unix stream socket?
Comment 8 Richard W.M. Jones 2012-12-06 16:44:44 EST
The VM (qemu-kvm) is trying to connect to a socket which
libguestfs creates.  Here is the code from the libguestfs
side of things:

https://github.com/libguestfs/libguestfs/blob/master/src/launch-libvirt.c#L261

I'm not sure I understand the reference to "user domain".
Comment 9 Richard W.M. Jones 2012-12-07 12:30:02 EST

*** This bug has been marked as a duplicate of bug 853393 ***

Note You need to log in before you can comment on or make changes to this bug.