Running latest rawhide.
If I try to 'run/open' a kvm virtual machine using virt-manager, I get the following AVC:
type=AVC msg=audit(1189626420.012:34): avc: denied { execmem } for pid=8603 comm="/usr/share/virt" scontext=system_u:system_r:unconfined_t:s0 tcontext=system_u:system_r:unconfined_t:s0 tclass=process type=SYSCALL msg=audit(1189626420.012:34): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=1000000 a2=7 a3=121 items=0 ppid=8602 pid=8603 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="/usr/share/virt" exe="/usr/bin/python" subj=system_u:system_r:unconfined_t:s0 key=(null)
Notice the reference to '/usr/share/virt'. This doesn't exist (but /usr/share/virt-manager does exist).
Ignoring the evident problem with virt-manager, any idea why the 'audit trail' would appear to be messed up?
tom
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Tom London wrote:
Running latest rawhide.
If I try to 'run/open' a kvm virtual machine using virt-manager, I get the following AVC:
type=AVC msg=audit(1189626420.012:34): avc: denied { execmem } for pid=8603 comm="/usr/share/virt" scontext=system_u:system_r:unconfined_t:s0 tcontext=system_u:system_r:unconfined_t:s0 tclass=process type=SYSCALL msg=audit(1189626420.012:34): arch=40000003 syscall=192 success=no exit=-13 a0=0 a1=1000000 a2=7 a3=121 items=0 ppid=8602 pid=8603 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="/usr/share/virt" exe="/usr/bin/python" subj=system_u:system_r:unconfined_t:s0 key=(null)
Notice the reference to '/usr/share/virt'. This doesn't exist (but /usr/share/virt-manager does exist).
Ignoring the evident problem with virt-manager, any idea why the 'audit trail' would appear to be messed up?
tom
I wonder if virt-manager is changing it's argv[0] to /usr/share/virt or if this is a bug in the kernel.
Now why it wants execmem is also curious.
selinux@lists.fedoraproject.org