funny AVC from virt-manager

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tom London wrote:
> Running latest rawhide.
> 
> If I try to 'run/open' a kvm virtual machine using virt-manager, I get
> the following AVC:
> 
> type=AVC msg=audit(1189626420.012:34): avc:  denied  { execmem } for
> pid=8603 comm="/usr/share/virt"
> scontext=system_u:system_r:unconfined_t:s0
> tcontext=system_u:system_r:unconfined_t:s0 tclass=process
> type=SYSCALL msg=audit(1189626420.012:34): arch=40000003 syscall=192
> success=no exit=-13 a0=0 a1=1000000 a2=7 a3=121 items=0 ppid=8602
> pid=8603 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500
> sgid=500 fsgid=500 tty=(none) comm="/usr/share/virt"
> exe="/usr/bin/python" subj=system_u:system_r:unconfined_t:s0
> key=(null)
> 
> Notice the reference to '/usr/share/virt'.  This doesn't exist (but
> /usr/share/virt-manager does exist).
> 
> Ignoring the evident problem with virt-manager, any idea why the
> 'audit trail' would appear to be messed up?
> 
> tom
I wonder if virt-manager is changing it's argv[0] to /usr/share/virt
or if this is a bug in the kernel.

Now why it wants execmem is also curious.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFG8ADMrlYvE4MpobMRAlK7AJ9fbi9nVW5JOLn+JCjo6VbI+C1iJgCeOsWX
JSdV5wpOs0dnYqiIfKBk+ZU=
=1XDg
-----END PGP SIGNATURE-----