Hi,
when I am creating virtual machine on system with new SELinux policy for Libvirt, I am getting this error message:
Unable to complete install: 'Unable to create device /dev/urandom: File exists'
Traceback (most recent call last):
File "/usr/share/virt-manager/virtManager/asyncjob.py", line 65, in cb_wrapper
callback(asyncjob, *args, **kwargs)
File "/usr/share/virt-manager/virtManager/createvm.py", line 2001, in _do_async_install
installer.start_install(guest, meter=meter)
File "/usr/share/virt-manager/virtinst/install/installer.py", line 701, in start_install
domain = self._create_guest(
File "/usr/share/virt-manager/virtinst/install/installer.py", line 649, in _create_guest
domain = self.conn.createXML(install_xml or final_xml, 0)
File "/usr/lib64/python3.10/site-packages/libvirt.py", line 4393, in createXML
raise libvirtError('virDomainCreateXML() failed')
libvirt.libvirtError: Unable to create device /dev/urandom: File exists
And SELinux denial, where SELinux prevents virtqemud to unlink character device /dev/urandom:
time->Wed Feb 23 19:30:33 2022
type=PROCTITLE msg=audit(1645662633.819:930): proctitle=2F7573722F7362696E2F7669727471656D7564002D2D74696D656F757400313230
type=PATH
msg=audit(1645662633.819:930): item=1 name="/dev/urandom" inode=6
dev=00:44 mode=020666 ouid=0 ogid=0 rdev=01:09
obj=system_u:object_r:urandom_device_t:s0 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH
msg=audit(1645662633.819:930): item=0 name="/dev/" inode=1 dev=00:44
mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmpfs_t:s0 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(1645662633.819:930): cwd="/"
type=SYSCALL
msg=audit(1645662633.819:930): arch=c000003e syscall=87 success=no
exit=-13 a0=7f9418064f50 a1=7f943909c930 a2=7f941d0ef6d4 a3=0 items=2
ppid=6722 pid=7196 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rpc-worker"
exe="/usr/sbin/virtqemud" subj=system_u:system_r:virtqemud_t:s0 key=(null)
type=AVC
msg=audit(1645662633.819:930): avc: denied { unlink } for pid=7196
comm="rpc-worker" name="urandom" dev="tmpfs" ino=6
scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file permissive=0