On Fri, Sep 21, 2012 at 01:00:26PM +0100, Daniel P. Berrange wrote:
On Fri, Sep 21, 2012 at 12:54:25PM +0100, Richard W.M. Jones wrote:
On Fri, Sep 21, 2012 at 10:39:19AM +0100, Daniel P. Berrange wrote:
From: "Daniel P. Berrange" <berrange@redhat.com>
SELinux wants all log files opened with O_APPEND. When running non-root though, libvirtd likes to use O_TRUNC to avoid log files growing in size indefinitely. Instead of using O_TRUNC though, we can use O_APPEND and then call ftruncate() which keeps SELinux happier.
As far as I can see, although this patch doesn't break anything, it doesn't fix the SELinux problem either. SELinux still prevents qemu from writing to the log. The AVCs look the same as before:
type=AVC msg=audit(1348227948.158:14174): avc: denied { append } for pid=13139 comm="qemu-kvm" path="/home/rjones/.cache/libvirt/qemu/log/guestfs-wd6efsxohmy5jd2s.log" dev="dm-5" ino=1870215 scontext=unconfined_u:unconfined_r:svirt_t:s0:c69,c512 tcontext=unconfined_u:object_r:cache_home_t:s0 tclass=file type=AVC msg=audit(1348227948.158:14174): avc: denied { append } for pid=13139 comm="qemu-kvm" path="/home/rjones/.cache/libvirt/qemu/log/guestfs-wd6efsxohmy5jd2s.log" dev="dm-5" ino=1870215 scontext=unconfined_u:unconfined_r:svirt_t:s0:c69,c512 tcontext=unconfined_u:object_r:cache_home_t:s0 tclass=file
The target context here is unconfined_u:object_r:cache_home_t:s0 which is wrong. The context ought to be virt_home_t instead of cache_home_t. Try changing the libvirt directories to have virt_home_t as their type. Then my patch ought to do something useful.
This is correct: relabelling the log directory causes the patch to work.
We need to check if SELinux policy knows about $HOME/.cache/libvirt and $HOME/.config/libvirt, or whether it still only considers the old location of $HOME/.libvirt
I've filed a bug against SELinux: https://bugzilla.redhat.com/show_bug.cgi?id=859395 Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-top is 'top' for virtual machines. Tiny program with many powerful monitoring features, net stats, disk stats, logging, etc. http://et.redhat.com/~rjones/virt-top