SELinux interfering with host/guest file sharing using KVM

Question

I'm running Fedora 17 with KVM and the virtual machine runs okay. I tried to follow this to get access to a file on the host system but SELinux prevents the VM from accessing any files other than those in /var/lib/libvirt/images. This is the message the host gives when running ls inside the VM on the shared path.

SELinux is preventing /usr/bin/qemu-kvm from read access on the
directory share.

How can I get around this? The purpose of my VM is to test binaries on multiple Linux distributions so a shared path would be easiest. Is there a way to make /tmp/share absolutely accessible by everyone?

Answer 1

/var/lib/libvirt/images should have svirt_image_t security context (can be verified by doing ls -ldZ svirt_image_t). If this is labelled as something else SELinux will not let kvm read/write on that dir.

Solution is to do the following: restorecon -vR /var/lib/libvirt/images

You can also check /var/log/audit/audit.log for possible reason for the AVC denial

Search for the AVC denials of today /sbin/ausearch -m avc -ts today

Or check /var/log/messages It will tell you the unique identifier for the AVC denial which needs to be run as an argument to sealert -l

Example: sealert -l 84e0b04d-d0ad-4347-8317-22e74f6cd020

You have to go through that information. It tells the commands you need to execute to overcome AVC denials.