Allow virtqemud relabel tun_socket #2503
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The commit addresses the following AVC denial:
type=PROCTITLE msg=audit(12/16/2024 03:49:11.325:19674) : proctitle=/usr/sbin/virtqemud --timeout 120
type=AVC msg=audit(12/16/2024 03:49:11.325:19674) : avc: denied { relabelfrom } for pid=500526 comm=rpc-virtqemud scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:system_r:virtqemud_t:s0 tclass=tun_socket permissive=1
type=AVC msg=audit(12/16/2024 03:49:11.325:19674) : avc: denied { relabelto } for pid=500526 comm=rpc-virtqemud scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:system_r:virtqemud_t:s0 tclass=tun_socket permissive=1
type=SYSCALL msg=audit(12/16/2024 03:49:11.325:19674) : arch=aarch64 syscall=ioctl success=yes exit=0 a0=0x1a a1=0x400454ca a2=0xffffa57dd800 a3=0x0 items=0 ppid=1 pid=500526 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpc-virtqemud exe=/usr/sbin/virtqemud subj=system_u:system_r:virtqemud_t:s0 key=(null)
Resolves: RHEL-71394
This is a follow-up commit to 5749a0a ("Allow virtqemud relabelfrom virt_log_t files"), as it turned out also relabelfrom is needed. The commit addresses the following AVC denial: type=PROCTITLE msg=audit(12/20/2024 09:06:12.607:2598) : proctitle=/usr/sbin/virtqemud --timeout 120 type=AVC msg=audit(12/20/2024 09:06:12.607:2598) : avc: denied { relabelto } for pid=39137 comm=rpc-virtqemud name=rhel-swtpm.log dev="dm-0" ino=202517283 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:virt_log_t:s0 tclass=file permissive=1 type=SYSCALL msg=audit(12/20/2024 09:06:12.607:2598) : arch=x86_64 syscall=setxattr success=yes exit=0 a0=0x55eb6bf9fa70 a1=0x7ff13bb37197 a2=0x7ff11c06a700 a3=0x20 items=0 ppid=38650 pid=39137 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpc-virtqemud exe=/usr/sbin/virtqemud subj=system_u:system_r:virtqemud_t:s0 key=(null) Resolves: RHEL-48236
This is a follow-up to 40017f3 ("Allow virtqemud manage nfs files when virt_use_nfs boolean is on") as additional permissionsfor virtqemud are needed, too. The permission set is now the same as it previously was for virtd_t. The commit addresses the following AVC denial example: type=PROCTITLE msg=audit(12/12/2024 04:31:01.442:783) : proctitle=/usr/sbin/virtqemud --timeout 120 type=PATH msg=audit(12/12/2024 04:31:01.442:783) : item=1 name=/var/lib/libvirt/swtpm/311bdd21-5945-4928-ab14-b258acfba1e4/tpm2 inode=29363572 dev=00:31 mode=dir,700 ouid=tss ogid=tss rdev=00:00 obj=system_u:object_r:nfs_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(12/12/2024 04:31:01.442:783) : item=0 name=/var/lib/libvirt/swtpm/311bdd21-5945-4928-ab14-b258acfba1e4/ inode=25170736 dev=00:31 mode=dir,711 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:nfs_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=SYSCALL msg=audit(12/12/2024 04:31:01.442:783) : arch=x86_64 syscall=rmdir success=yes exit=0 a0=0x7f598c091d60 a1=0x7f598c0aa120 a2=0x40000 a3=0x4002 items=2 ppid=1 pid=6537 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpc-virtqemud exe=/usr/sbin/virtqemud subj=system_u:system_r:virtqemud_t:s0 key=(null) type=AVC msg=audit(12/12/2024 04:31:01.442:783) : avc: denied { rmdir } for pid=6537 comm=rpc-virtqemud name=tpm2 dev="0:49" ino=29363572 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir permissive=1 type=AVC msg=audit(12/12/2024 04:31:01.442:783) : avc: denied { remove_name } for pid=6537 comm=rpc-virtqemud name=tpm2 dev="0:49" ino=29363572 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir permissive=1 Resolves: RHEL-71068
This permission is needed when a virtiofs device is hotunplugged.
The commit addresses the following AVC denial:
type=PROCTITLE msg=audit(07/05/2024 03:29:05.489:79517) : proctitle=/usr/sbin/virtqemud --timeout 120
type=AVC msg=audit(07/05/2024 03:29:05.489:79517) : avc: denied { getpgid } for pid=730181 comm=qemu-event scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:system_r:virtqemud_t:s0 tclass=process permissive=1
type=SYSCALL msg=audit(07/05/2024 03:29:05.489:79517) : arch=aarch64 syscall=getpgid success=yes exit=730729 a0=0xb266a a1=0xffffbd0a1af8 a2=0x0 a3=0x0 items=0 ppid=1 pid=730181 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=qemu-event exe=/usr/sbin/virtqemud subj=system_u:system_r:virtqemud_t:s0 key=(null)
Resolves: RHEL-46357
Command which triggers the denials:
virsh migrate source qemu+ssh://${target}/system --live --verbose
Resolves: RHEL-43217
Triggered by the following command:
virsh -c 'qemu:///system' migrate --live --p2p --verbose --domain hostname --desturi qemu+ssh://\{target}/system
Resolves: RHEL-53972
The commit addresses the following AVC denial:
type=AVC msg=audit(1730798043.779:27002): avc: denied { execute } for pid=1041433 comm="rpc-virtqemud" name="numad" dev="vda4" ino=1646 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:numad_exec_t:s0 tclass=file permissive=1
Resolves: RHEL-65789
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The commit addresses the following AVC denial:
type=PROCTITLE msg=audit(12/16/2024 03:49:11.325:19674) : proctitle=/usr/sbin/virtqemud --timeout 120 type=AVC msg=audit(12/16/2024 03:49:11.325:19674) : avc: denied { relabelfrom } for pid=500526 comm=rpc-virtqemud scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:system_r:virtqemud_t:s0 tclass=tun_socket permissive=1 type=AVC msg=audit(12/16/2024 03:49:11.325:19674) : avc: denied { relabelto } for pid=500526 comm=rpc-virtqemud scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:system_r:virtqemud_t:s0 tclass=tun_socket permissive=1 type=SYSCALL msg=audit(12/16/2024 03:49:11.325:19674) : arch=aarch64 syscall=ioctl success=yes exit=0 a0=0x1a a1=0x400454ca a2=0xffffa57dd800 a3=0x0 items=0 ppid=1 pid=500526 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpc-virtqemud exe=/usr/sbin/virtqemud subj=system_u:system_r:virtqemud_t:s0 key=(null)
Resolves: RHEL-71394