Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1369884 - selinux prevents KVM VMs from starting.
Summary: selinux prevents KVM VMs from starting.
Keywords:
Status: CLOSED DUPLICATE of bug 1368745
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 24
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-24 15:30 UTC by Dawid Zamirski
Modified: 2016-08-24 17:45 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-08-24 17:45:14 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)
audit.log (5.69 KB, text/plain)
2016-08-24 15:30 UTC, Dawid Zamirski 		no flags Details
View All

Description Dawid Zamirski 2016-08-24 15:30:01 UTC 
Created attachment 1193676 [details]
audit.log

Description of problem:
KVM Virtual Machines fail to start with SELinux access denied error, both from CLI and Virt-Manager (even under root account)

virsh # start Windows7_Siris
error: Failed to start domain Windows7_Siris
error: SELinux policy denies access.

This started happening after installing recent updates on Fedora 24. The only 'unusual' thing on the system is that disk images for the VMs are stored in user's home dir with the following permissions and SELinux context:

-rw-r--r--. 1 root root unconfined_u:object_r:user_home_t:s0 137067102208 Aug 23 17:25 Windows7_Siris.qcow2


Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.13.1-191.12.fc24.noarch

How reproducible:
Always

Steps to Reproduce:
virsh # start Windows7_Siris
error: Failed to start domain Windows7_Siris
error: SELinux policy denies access.

Actual results:
VM failed to start due to SELinux policy.

Expected results:
Should start just fine as it used to.

Additional info:
attached audit.log
Comment 1 Dawid Zamirski 2016-08-24 15:33:15 UTC 
PS. audit2allow claims 'Nothing to do' given attached audit.log. So the only option I was left with was to setenforce 0 temporarily.
Comment 2 Daniel Walsh 2016-08-24 17:45:14 UTC 

*** This bug has been marked as a duplicate of bug 1368745 ***
Note You need to log in before you can comment on or make changes to this bug.