Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-68723

[RHEL-10.0] avc: denied { ioctl } for pid=13510 comm="qemu-kvm" path="/dev/sev" dev="devtmpfs"

XMLWordPrintable

    • selinux-policy-40.13.21-1.el10
    • No
    • Moderate
    • 1
    • rhel-sst-security-selinux
    • ssg_security
    • 23
    • 1
    • QE ack
    • False
    • Hide

      None

      Show
      None
    • No
    • SELINUX 250129: 1
    • Hide

      SELinux policy defines an allow rule which enables the access which is shown in the AVC.

      Show
      SELinux policy defines an allow rule which enables the access which is shown in the AVC.
    • Pass
    • Manual
    • Release Note Not Required
    • None

      What were you trying to do that didn't work?

      SELinux status:                 enabled
      SELinuxfs mount:                /sys/fs/selinux
      SELinux root directory:         /etc/selinux
      Loaded policy name:             targeted
      Current mode:                   enforcing
      Mode from config file:          enforcing
      Policy MLS status:              enabled
      Policy deny_unknown status:     allowed
      Memory protection checking:     actual (secure)
      Max kernel policy version:      33
      selinux-policy-40.13.13-1.el10.noarch

      time->Fri Nov 22 02:06:14 2024
      type=PROCTITLE msg=audit(1732259174.518:898): proctitle=2F7573722F6C6962657865632F71656D752D6B766D002D53002D6E6F2D757365722D636F6E666967002D6E6F64656661756C7473002D6E6F67726170686963002D6D616368696E65006E6F6E652C616363656C3D6B766D3A746367002D716D7000756E69783A2F7661722F6C69622F6C6962766972742F71656D752F716D702D
      type=SYSCALL msg=audit(1732259174.518:898): arch=c000003e syscall=16 success=no exit=-5 a0=f a1=c0105300 a2=7f717a55df30 a3=55b207dc1010 items=0 ppid=1 pid=13510 auid=4294967295 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=4294967295 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:virtqemud_t:s0 key=(null)
      type=AVC msg=audit(1732259174.518:898): avc:  denied  { ioctl } for  pid=13510 comm="qemu-kvm" path="/dev/sev" dev="devtmpfs" ino=389 ioctlcmd=0x5300 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:sev_device_t:s0 tclass=chr_file permissive=1

      Please provide the package NVR for which the bug is seen:

      kernel-6.12.0-30.el10

      selinux-policy-40.13.13-1.el10.noarch

      How reproducible is this bug?:

      many times

      Expected results

      No AVC deny

      Actual results

      AVC deny

       

      Additional info:
      Beaker jobs:

      https://beaker.engineering.redhat.com/jobs/10238650

      https://beaker-archive.prod.engineering.redhat.com/beaker-logs/2024/11/102386/10238650/17540669/187268650/873559742/avc.log

       

      https://beaker.engineering.redhat.com/jobs/10237097

      https://beaker-archive.prod.engineering.redhat.com/beaker-logs/2024/11/102370/10237097/17538631/187257474/873506362/avc.log

       

       

       

       

              rhn-support-zpytela Zdenek Pytela
              rh-ee-yieli Zhi Li
              Zdenek Pytela Zdenek Pytela
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated: