Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1293722
| Summary: | need selinux policy for new libvirt daemon virtlogd | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Giulio 'juliuxpigface' <juliux.pigface> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | rawhide | CC: | agedosier, berrange, clalancette, crobinso, dominick.grift, dwalsh, dyuan, fjin, flast, itamar, jforbes, laine, libvirt-maint, lvrabec, mgrepl, plautrba, veillard, virt-maint, zhwang | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2016-01-20 14:50:01 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Can you say if you have SELinux enabled, and if so provide the /var/log/audit/audit.log file contents after boot Following module avoids this issue. I hope that will help you. ``` module bug1293722 1; require { type iptables_t; type firewalld_tmpfs_t; type unconfined_service_t; type init_t; class file { read write }; class unix_stream_socket { create setopt bind listen }; } allow iptables_t firewalld_tmpfs_t:file { read write }; allow init_t unconfined_service_t:unix_stream_socket { create setopt bind listen }; ``` (In reply to Kohei Takahashi from comment #2) > Following module avoids this issue. I hope that will help you. > > ``` > module bug1293722 1; > > require { > type iptables_t; > type firewalld_tmpfs_t; > type unconfined_service_t; > type init_t; > class file { read write }; > class unix_stream_socket { create setopt bind listen }; > } > > allow iptables_t firewalld_tmpfs_t:file { read write }; > allow init_t unconfined_service_t:unix_stream_socket { create setopt bind > listen }; > ``` I don't know why the firewall bits are in there, virtlogd shouldn't be touching that stuff. Definitely needs the unix bits though. Here's the AVCs I get: type=AVC msg=audit(1452886623.735:766): avc: denied { create } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1 type=AVC msg=audit(1452886623.735:767): avc: denied { setopt } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1 type=AVC msg=audit(1452886623.735:768): avc: denied { bind } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1 type=AVC msg=audit(1452886623.735:769): avc: denied { listen } for pid=1 comm="systemd" path="/run/libvirt/virtlogd-sock" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1 type=SERVICE_START msg=audit(1452886623.738:770): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=virtlogd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Hi, Rule related to iptables is different issue in SELinux. Other troubles are fixed now. Closing as duplicate. *** This bug has been marked as a duplicate of bug 1291940 *** |
Created attachment 1108703 [details] output of "# journalctl -b 0 -u virtlogd.socket" Description of problem: Everytime I start a qemu-kvm guest (which contains Fedora 20151218 Rawhide - Workstation), I see that unit failing. Version-Release number of selected component (if applicable): libvirt-daemon-1.3.0-1.fc24.x86_64 How reproducible: Always Steps to Reproduce: 1. Boot Fedora 20151218 (installed on a qemu-kvm x86_64 guest). 2. Log in. 3. Read the output of "# systemctl --all --failed". Actual results: The unit "virtlogd.socket" fails. Expected results: The unit "virtlogd.socket" should not fail. Additional info: I'm attaching the output of "# journalctl -b 0 -u virtlogd.socket"