qemu-ga generates AVCs when "domfsinfo" is executed from the host

Solution Verified - Updated -

Issue

  • When executing virsh domfsinfo <domain> from the host, the command succeeds but AVCs are displayed in the guest

    type=PROCTITLE msg=audit(07/05/2023 13:28:04.672:1448) : proctitle=/usr/bin/qemu-ga --method=virtio-serial --path=/dev/virtio-ports/org.qemu.guest_agent.0 --blacklist= -F/etc/qemu-ga/fsfreeze-hoo
    type=SYSCALL msg=audit(07/05/2023 13:28:04.672:1448) : arch=x86_64 syscall=statfs success=no exit=EACCES(Permission denied) a0=0x55fcf1a98230 a1=0x7ffc551cefd0 a2=0x7fc9d10dec20 a3=0x55fcf1a84bb0 items=0 ppid=1 pid=1016 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=qemu-ga exe=/usr/bin/qemu-ga subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null)
    type=AVC msg=audit(07/05/2023 13:28:04.672:1448) : avc:  denied  { search } for  pid=1016 comm=qemu-ga name=named dev="dm-0" ino=108035 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:named_zone_t:s0 tclass=dir permissive=0
    

Environment

  • Red Hat Enterprise Linux 8 and 9
    • QEMU/KVM
    • bind-chroot service enabled on the system
    • containers

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content