In a CentOS 6.8 host with a CentOS 6.8 QEMU-KVM guest, I have a USB
sound device that I assign to the guest. Since the update to CentOS 6.8,
whenever I assign the USB host device to the guest or return it to the
host I get AVC deniala for alsactl writing to the /var/lock directory:
type=AVC msg=audit(1464239503.474:168): avc: denied { write } for
pid=6462 comm="alsactl" name="lock" dev="dm-1" ino=1310721
scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023
tcontext=system_u:object_r:var_lock_t:s0 tclass=dir permissive=0
type=SYSCALL msg=audit(1464239503.474:168): arch=x86_64 syscall=open
success=no exit=EACCES a0=4122a3 a1=c2 a2=1a4 a3=7fff7e7950a0 items=0
ppid=6325 pid=6462 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=alsactl
exe=/sbin/alsactl subj=system_u:system_r:alsa_t:s0-s0:c0.c1023 key=(null)
I don't see any reason to deny this, so I have run the recommended
audit2allow steps. Unless someone tells me otherwise, I'll report this
as a bug in the policy.
selinux-policy-3.7.19-292.el6.noarch
selinux-policy-targeted-3.7.19-292.el6.noarch
--
Bob Nichols "NOSPAM" is really part of my email address.
Do NOT delete it.
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://lists.fedoraproject.org/admin/lists/selinux@xxxxxxxxxxxxxxxxxxxxxxx
