Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 491245 - SELinux prevented qemu-kvm from reading an LVM logical volume
Summary: SELinux prevented qemu-kvm from reading an LVM logical volume
Alias: None
Product: Fedora
Classification: Fedora
Component: virt-manager
Version: 10
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Daniel Berrange
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2009-03-20 01:34 UTC by Robert Story
Modified: 2009-03-25 18:11 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of: 453938
Last Closed: 2009-03-25 18:11:20 UTC

Attachments (Terms of Use)

Description Robert Story 2009-03-20 01:34:32 UTC
+++ This bug was initially created as a clone of Bug #453938 +++

This bit me today on f10... virt-manager does not try to fix they lvm context, and it appears that this AVC is "don't audit"-ed, because I didn't not get any avcs. I just happened to search for closed bugs.  At the very least, when creating a new vm via virt-manager, it should check the context and warn the user if the type isn't right. Right now, all it does is spew a python error and fail very ungracefully.

Description of problem:
> SELinux is preventing qemu-kvm (qemu_t) "getattr" to
/dev/mapper/Volumes-OldWindowsBackup (fixed_disk_device_t). 

Version-Release number:
virt-manager                 i386     0.6.0-5.fc10

Steps to Reproduce:
1. create a fresh LVM volume and initialize it with some file system
2. add its device file (in /dev/mapper/...) to a QEMU virtual machine as a
storage device (type 'Normal Disk Partition')
3. try to start that virtual machine
Actual results:
SELinux denies access as mentioned above. Virtual machine cannot start.

--- Additional comment from on 2008-07-03 11:26:39 EDT ---

In order to get SELinux to work with qemu, you need to make sure this disk is
labeled correctly.

# semanage fcontext -a -t virt_image_t /dev/mapper/Volumes-OldWindowsBackup
# restorecon /dev/mapper/Volumes-OldWindowsBackup

Should allow you to run in enforcingm mode.

Hopefully virtmanager will start doing this automatically.

Comment 1 Mark McLoughlin 2009-03-25 16:43:50 UTC
dwalsh: would something like your patch in #491052 be appropriate here?

Comment 2 Daniel Walsh 2009-03-25 17:21:16 UTC
No this is a case where libvirt has to take over.  A non priv user would not be allowed to set the context on the volume.  You would need to be root.

libvirt in rawhide would label the device correctly and this would just work.

Comment 3 Mark McLoughlin 2009-03-25 18:11:20 UTC
Okay, sounds like this is fixed in rawhide - closing as such

Comment 4 Mark McLoughlin 2009-03-25 18:11:22 UTC
*** Bug 474182 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.