Bug 886640 - SELinux is preventing /usr/bin/qemu-kvm from 'read' accesses on the file /etc/resolv.conf.
Summary: SELinux is preventing /usr/bin/qemu-kvm from 'read' accesses on the file /etc...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 18
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:1ec1e3f594db6d8462780a51937...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-12-12 18:11 UTC by Dean Hunter
Modified: 2012-12-18 06:53 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-12-18 06:53:32 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Dean Hunter 2012-12-12 18:11:22 UTC
Description of problem:
The alert was raised while using gnome-boxes to create a new local box from the Fedora 18 beta x86_64 Live Desktop ISO file.

SELinux is preventing /usr/bin/qemu-kvm from 'read' accesses on the file /etc/resolv.conf.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that qemu-kvm should be allowed read access on the resolv.conf file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep qemu-kvm /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:svirt_t:s0:c524,c817
Target Context                system_u:object_r:net_conf_t:s0
Target Objects                /etc/resolv.conf [ file ]
Source                        qemu-kvm
Source Path                   /usr/bin/qemu-kvm
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           qemu-system-x86-1.2.0-24.fc18.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-62.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.6.10-4.fc18.x86_64 #1 SMP Tue
                              Dec 11 18:01:27 UTC 2012 x86_64 x86_64
Alert Count                   110
First Seen                    2012-12-12 11:57:10 CST
Last Seen                     2012-12-12 12:06:29 CST
Local ID                      73eda860-290b-4953-a518-3b2f9d88d0a5

Raw Audit Messages
type=AVC msg=audit(1355335589.874:896): avc:  denied  { read } for  pid=6535 comm="qemu-kvm" name="resolv.conf" dev="dm-1" ino=919333 scontext=unconfined_u:system_r:svirt_t:s0:c524,c817 tcontext=system_u:object_r:net_conf_t:s0 tclass=file


type=SYSCALL msg=audit(1355335589.874:896): arch=x86_64 syscall=open success=no exit=EACCES a0=7fee1a3df0d9 a1=0 a2=1b6 a3=238 items=0 ppid=1 pid=6535 auid=997000001 uid=997000001 gid=997000001 euid=997000001 suid=997000001 fsuid=997000001 egid=997000001 sgid=997000001 fsgid=997000001 tty=(none) ses=5 comm=qemu-kvm exe=/usr/bin/qemu-kvm subj=unconfined_u:system_r:svirt_t:s0:c524,c817 key=(null)

Hash: qemu-kvm,svirt_t,net_conf_t,file,read

audit2allow
audit2allow -R

Additional info:
hashmarkername: setroubleshoot
kernel:         3.6.10-4.fc18.x86_64
type:           libreport

Comment 1 Dean Hunter 2012-12-14 15:12:40 UTC
Please raise the Severity of this bug report from the Automatic Bug Reporting Tools' default setting of unspecified to high or urgent as it is not possible to create a new box with gnome-boxes. This makes it impossible to do any further testing of the product.

Comment 2 Fedora Update System 2012-12-17 17:39:01 UTC
selinux-policy-3.11.1-66.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-66.fc18

Comment 3 Fedora Update System 2012-12-18 06:53:34 UTC
selinux-policy-3.11.1-66.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.