Re: [libvirt] I have no idea why the current version of libvirt works for anyone in enforcing mode.

On 03/13/2009 09:49 AM, Daniel P. Berrange wrote: > On Fri, Mar 13, 2009 at 09:44:15AM -0400, Daniel J Walsh wrote: >> On 03/13/2009 06:19 AM, Daniel P. Berrange wrote: >>> On Thu, Mar 12, 2009 at 01:39:13PM -0400, Daniel J Walsh wrote: >>>> Libvirt is executing qemu requiring it to execute pulseaudio which would >>>> require the folowing permissions, >>>> >>>> #============= svirt_t ============== >>>> allow svirt_t admin_home_t:dir setattr; >>>> allow svirt_t admin_home_t:file { read write }; >>>> allow svirt_t pulseaudio_port_t:tcp_socket name_connect; >>>> allow svirt_t svirt_tmpfs_t:file read; >>>> allow svirt_t user_tmpfs_t:file read; >>>> >>>> Since qemu(svirt_t) is not allowed these permissions, pulseaudio crashes >>>> and qemu dies. >>> I don't see it crashing - when I run with a guest with a sound device >>> attached, I see the AVC denials, and QEMU just carries on without a >>> active sound backend AFAICT. >>> >>>> I believe you need to run without sound if you are running as root. >>> We can't disable sound unconditonally for root, because not everyone >>> will be using SELinux so its still valid to allow sound cards. I think >>> the focus has to be on stopping QEMU from crashing. It might actually >>> be an SDL bug, rather than a QEMU bug, because I believe its SDL that >>> is responsible for opening the sound devices. >>> >>> Daniel >> How about if we check if you are running with svirt then don't execute >> the code. Since I do not want to deal with these avc messages. Either >> they will happen always and I have to dontaudit them in which case a >> compromised svirt attacking the /root directory would be dontaudited, or >> people are going to see avc's all the time. > For that scenario I think it'd be better to make virt-manager prevent > addition of sound hardware, since its in a position to give feedback > to the user telling them why sound devices aren't allowed. > > > Daniel Well there is no protocol currently to tell virt-manager that the libvirt is running with svirt. I tried to remove a audio device via virt-manager and it does nothing. Also what happens when virt-manager configures a remote libvirt? Does the sound card automatically get added?