reboot xen pv virtual via virsh: selinux denied access - cobbler - Fedora mailing-lists

23 Mar 2009


      Problem:
SElinux denies reboot of Xen PV via 'virsh'
uname -a
Linux xen.dmz.huiser.local 2.6.18-128.1.1.el5xen #1 SMP Mon Jan 26 
14:19:09 EST 2009 x86_64 x86_64 x86_64 GNU/Linux
rpm -q cobbler
cobbler-1.4.3-4.el5
sealert -l 8db1a624-b131-41ec-b6e6-f9fb6a60e288
Summary:
SELinux is preventing virsh (xm_t) "read" to random (random_device_t).
Detailed Description:
SELinux denied access requested by virsh. It is not expected that this 
access is
required by virsh and this access may signal an intrusion attempt. It is 
also
possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to 
restore
the default system file context for random,
restorecon -v 'random'
If this does not work, there is currently no automatic way to allow this 
access.
Instead, you can generate a local policy module to allow this access - 
see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can 
disable
SELinux protection altogether. Disabling SELinux protection is not 
recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context                user_u:system_r:xm_t
Target Context                system_u:object_r:random_device_t
Target Objects                random [ chr_file ]
Source                        virsh
Source Path                   /usr/bin/virsh
Port                          <Unknown>
Host                          xen.dmz.huiser.local
Source RPM Packages           libvirt-0.3.3-14.el5_3.1
Target RPM Packages          
Policy RPM                    selinux-policy-2.4.6-203.el5
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     xen.dmz.huiser.local
Platform                      Linux xen.dmz.huiser.local 
2.6.18-128.1.1.el5xen
                              #1 SMP Mon Jan 26 14:19:09 EST 2009 x86_64 
x86_64
Alert Count                   1
First Seen                    Mon Mar 23 23:08:06 2009
Last Seen                     Mon Mar 23 23:08:06 2009
Local ID                      8db1a624-b131-41ec-b6e6-f9fb6a60e288
Line Numbers
Raw Audit Messages
host=xen.dmz.huiser.local type=AVC msg=audit(1237846086.693:10639): 
avc:  denied  { read } for  pid=397 comm="virsh" name="random" dev=tmpfs 
ino=2556 scontext=user_u:system_r:xm_t:s0 
tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file
host=xen.dmz.huiser.local type=SYSCALL msg=audit(1237846086.693:10639): 
arch=c000003e syscall=21 success=no exit=-13 a0=3c85e39150 a1=4 a2=1 
a3=0 items=0 ppid=14767 pid=397 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 
egid=0 sgid=0 fsgid=0 tty=(none) ses=409 comm="virsh" 
exe="/usr/bin/virsh" subj=user_u:system_r:xm_t:s0 key=(null)