We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Trying to enable a virtiofs mount for a domain with unprivileged libvirt gives:
May 17 10:09:38 xenon audit[1556282]: AVC avc: denied { connectto } for pid=1556282 comm="qemu-system-x86" path="/var/home/walters/.config/libvirt/qemu/lib/domain-12-podman-bootc-8cb7ffb/fs0-fs.sock" scontext=unconfined_u:unconfined_r:svirt_t:s0:c156,c869 tcontext=unconfined_u:unconfined_r:unconfined_t:s0:c156,c869 tclass=unix_stream_socket permissive=1
I think to fix this, we'd need to also have libvirt fork virtiofsd under svirt_t? Or ensure that the target socket is labeled.
svirt_t
A workaround here is to turn off "svirt" by adding e.g. <seclabel type='none'/> to the domain XML.
<seclabel type='none'/>
The text was updated successfully, but these errors were encountered:
libvirt: Disable sVirt (SELinux) separation
116b5d1
Prep for adding virtiofs support. See fedora-selinux/selinux-policy#2124 for the tracker. Signed-off-by: Colin Walters <walters@verbum.org>
Resolved some time ago.
f41# sesearch -A -s svirt_t -t unconfined_t -c unix_stream_socket -p connectto allow svirt_t unconfined_t:unix_stream_socket connectto;
Sorry, something went wrong.
No branches or pull requests
Trying to enable a virtiofs mount for a domain with unprivileged libvirt gives:
I think to fix this, we'd need to also have libvirt fork virtiofsd under
svirt_t
? Or ensure that the target socket is labeled.A workaround here is to turn off "svirt" by adding e.g.
<seclabel type='none'/>
to the domain XML.The text was updated successfully, but these errors were encountered: