Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-47274

virt-install triggers a lot of SELinux denials

    • selinux-policy-40.13.9-1.el10
    • Yes
    • Critical
    • sst_security_selinux
    • ssg_security
    • 27
    • None
    • QE ack
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • Hide

      The virt-install command does not trigger any SELinux denials in default configuration. SELinux policy allows a successful provisioning of virtual machines via virt-install.

      Show
      The virt-install command does not trigger any SELinux denials in default configuration. SELinux policy allows a successful provisioning of virtual machines via virt-install.
    • Pass
    • Automated
    • Unspecified Release Note Type - Unknown
    • None

      The latest RHEL/CentOS 10 selinux-policy update breaks virt-install and thus cockpit-machines. Today's run with selinux-policy-40.13.4-1.el10.noarch is a complete failure, while a run from yesterday with selinux-policy-40.13.3-2.el10.noarch still works.

      Reproducible: always

      Packages installed:
      libvirt-10.4.0-1.el10.x86_64
      libvirt-client-10.4.0-1.el10.x86_64
      libvirt-client-qemu-10.4.0-1.el10.x86_64
      libvirt-daemon-10.4.0-1.el10.x86_64
      libvirt-daemon-common-10.4.0-1.el10.x86_64
      libvirt-daemon-config-network-10.4.0-1.el10.x86_64
      libvirt-daemon-config-nwfilter-10.4.0-1.el10.x86_64
      libvirt-daemon-driver-interface-10.4.0-1.el10.x86_64
      libvirt-daemon-driver-network-10.4.0-1.el10.x86_64
      libvirt-daemon-driver-nodedev-10.4.0-1.el10.x86_64
      libvirt-daemon-driver-nwfilter-10.4.0-1.el10.x86_64
      libvirt-daemon-driver-qemu-10.4.0-1.el10.x86_64
      libvirt-daemon-driver-secret-10.4.0-1.el10.x86_64
      libvirt-daemon-driver-storage-10.4.0-1.el10.x86_64
      libvirt-daemon-driver-storage-core-10.4.0-1.el10.x86_64
      libvirt-daemon-driver-storage-disk-10.4.0-1.el10.x86_64
      libvirt-daemon-driver-storage-iscsi-10.4.0-1.el10.x86_64
      libvirt-daemon-driver-storage-logical-10.4.0-1.el10.x86_64
      libvirt-daemon-driver-storage-mpath-10.4.0-1.el10.x86_64
      libvirt-daemon-driver-storage-rbd-10.4.0-1.el10.x86_64
      libvirt-daemon-driver-storage-scsi-10.4.0-1.el10.x86_64
      libvirt-daemon-kvm-10.4.0-1.el10.x86_64
      libvirt-daemon-lock-10.4.0-1.el10.x86_64
      libvirt-daemon-log-10.4.0-1.el10.x86_64
      libvirt-daemon-plugin-lockd-10.4.0-1.el10.x86_64
      libvirt-daemon-proxy-10.4.0-1.el10.x86_64
      libvirt-dbus-1.4.1-5.el10.x86_64
      libvirt-glib-5.0.0-3.el10.x86_64
      libvirt-libs-10.4.0-1.el10.x86_64
      libvirt-nss-10.4.0-1.el10.x86_64
      libvirt-ssh-proxy-10.4.0-1.el10.x86_64
      selinux-policy-40.13.4-1.el10.noarch
      selinux-policy-targeted-40.13.4-1.el10.noarch
      virt-install-4.1.0-7.el10.noarch
      virtiofsd-1.10.0-3.el10.1.x86_64
      virt-manager-common-4.1.0-7.el10.noarch

      Steps to Reproduce:

      # service virtqemud start
      Redirecting to /bin/systemctl start virtqemud.service
      # service virtnetworkd start
      Redirecting to /bin/systemctl start virtnetworkd.service
      # virt-install --memory 50 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk none --wait 0 --name test1
      WARNING  Treating --wait 0 as --noautoconsole
      WARNING  The guest's network configuration may not support PXE
      WARNING  Requested memory 50 MiB is less than the recommended 128 MiB for OS alpinelinux3.8
      
      Starting install...
      Creating domain...                                          |         00:00     
      
      Domain is still running. Installation may be in progress.
      You can reconnect to the console to complete the installation process.
      # virsh list
       Id   Name    State
      -----------------------
       2    test1   running
      # sleep 60
      # virsh destroy test1
      Domain 'test1' destroyed
      
      # virsh undefine test1
      Domain 'test1' has been undefined
      
      #
      

            rhn-support-zpytela Zdenek Pytela
            rhn-engineering-mpitt Martin Pitt
            Zdenek Pytela Zdenek Pytela
            Milos Malik Milos Malik
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated: