Stephan Huiser wrote: > Problem: > SElinux denies reboot of Xen PV via 'virsh' >
I may be wrong, but I think you want to post this to et-mgmt-tools if this is about virsh. https://www.redhat.com/mailman/listinfo/et-mgmt-tools > uname -a > Linux xen.dmz.huiser.local 2.6.18-128.1.1.el5xen #1 SMP Mon Jan 26 > 14:19:09 EST 2009 x86_64 x86_64 x86_64 GNU/Linux > > rpm -q cobbler > cobbler-1.4.3-4.el5 > > sealert -l 8db1a624-b131-41ec-b6e6-f9fb6a60e288 > > Summary: > > SELinux is preventing virsh (xm_t) "read" to random (random_device_t). > > Detailed Description: > > SELinux denied access requested by virsh. It is not expected that this > access is > required by virsh and this access may signal an intrusion attempt. It is > also > possible that the specific version or configuration of the application is > causing it to require additional access. > > Allowing Access: > > Sometimes labeling problems can cause SELinux denials. You could try to > restore > the default system file context for random, > > restorecon -v 'random' > > If this does not work, there is currently no automatic way to allow this > access. > Instead, you can generate a local policy module to allow this access - > see FAQ > (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can > disable > SELinux protection altogether. Disabling SELinux protection is not > recommended. > Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) > against this package. > > Additional Information: > > Source Context user_u:system_r:xm_t > Target Context system_u:object_r:random_device_t > Target Objects random [ chr_file ] > Source virsh > Source Path /usr/bin/virsh > Port <Unknown> > Host xen.dmz.huiser.local > Source RPM Packages libvirt-0.3.3-14.el5_3.1 > Target RPM Packages > Policy RPM selinux-policy-2.4.6-203.el5 > Selinux Enabled True > Policy Type targeted > MLS Enabled True > Enforcing Mode Enforcing > Plugin Name catchall_file > Host Name xen.dmz.huiser.local > Platform Linux xen.dmz.huiser.local > 2.6.18-128.1.1.el5xen > #1 SMP Mon Jan 26 14:19:09 EST 2009 x86_64 > x86_64 > Alert Count 1 > First Seen Mon Mar 23 23:08:06 2009 > Last Seen Mon Mar 23 23:08:06 2009 > Local ID 8db1a624-b131-41ec-b6e6-f9fb6a60e288 > Line Numbers > > Raw Audit Messages > > host=xen.dmz.huiser.local type=AVC msg=audit(1237846086.693:10639): > avc: denied { read } for pid=397 comm="virsh" name="random" dev=tmpfs > ino=2556 scontext=user_u:system_r:xm_t:s0 > tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file > > host=xen.dmz.huiser.local type=SYSCALL msg=audit(1237846086.693:10639): > arch=c000003e syscall=21 success=no exit=-13 a0=3c85e39150 a1=4 a2=1 > a3=0 items=0 ppid=14767 pid=397 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 > egid=0 sgid=0 fsgid=0 tty=(none) ses=409 comm="virsh" > exe="/usr/bin/virsh" subj=user_u:system_r:xm_t:s0 key=(null) > > _______________________________________________ > cobbler mailing list > [email protected] > https://fedorahosted.org/mailman/listinfo/cobbler > _______________________________________________ cobbler mailing list [email protected] https://fedorahosted.org/mailman/listinfo/cobbler
