Bug 1180769
| Summary: | Security context on image file gets reset | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Ben Woodard <woodard> |
| Component: | libguestfs | Assignee: | Richard W.M. Jones <rjones> |
| Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.0 | CC: | berrange, dallan, eblake, extras-qa, foraker1, j, leiwang, linl, mattdm, mbooth, ptoscano, rjb, rjones, sherold, tgummels, tzheng, virt-maint, woodard, wshi, xchen |
| Target Milestone: | rc | ||
| Target Release: | 7.3 | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | libguestfs-1.32.0-2.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 912499 | Environment: | |
| Last Closed: | 2016-11-03 17:49:04 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 912499, 1218766 | ||
| Bug Blocks: | 910270, 1274917, 1288337, 1301891, 1364088 | ||
|
Description
Ben Woodard
2015-01-09 22:46:26 UTC
Jim Foraker at LLNL is having this exact problem on RHEL7. libguestfs-1.22.6-22.el7.x86_64 Reproduced this case. Test steps: 1. # ls -lZ rhel7.img -rw-------. root root system_u:object_r:admin_home_t:s0 rhel7.img 2. # guestfish --rw -a rhel7.img ><fs> get-backend libvirt ><fs> run ><fs> mount /dev/sda1 / 3. # ls -lZ rhel7.img -rw-------. qemu qemu system_u:object_r:svirt_image_t:s0:c230,c866 rhel7.img 4. # virt-df -a rhel7.img Filesystem 1K-blocks Used Available Use% rhel7.img:/dev/sda1 508588 95524 413064 19% rhel7.img:/dev/rhel/root 7022592 2984968 4037624 43% Comments: virt-df can get the filesystem of the image. 5. # ls -lZ rhel7.img -rw-------. qemu qemu system_u:object_r:virt_content_t:s0 rhel7.img Comments: However libvirt relabels the disks from system_u:object_r:svirt_image_t:s0:c678,c742 to system_u:object_r:virt_content_t:s0. 6. ><fs> touch /test Comments: create the file test successfully. 7. ><fs> umount / 8. ><fs> mount /dev/sda1 / libguestfs: error: mount: /dev/sda1 on / (options: ''): mount: /dev/sda1: can't read superblock 9. ls -lZ /tmp/libguestfsXINrGS/overlay1 -rw-r--r--. qemu qemu system_u:object_r:svirt_image_t:s0 overlay1 In step5, after run "virt-df -a rhel7.img", the libvirt relabels the disks from system_u:object_r:svirt_image_t:s0:c678,c742 to system_u:object_r:virt_content_t:s0. In step6, The problem is here. before umount, we can write to the image. However, it fails to mount /dev/sda1 again after unmount it. Is it caused by the change of the label? In step9, the overlay1's label does not change. (In reply to Hu Zhang from comment #4) > Reproduced this case. > > Test steps: > 1. # ls -lZ rhel7.img > -rw-------. root root system_u:object_r:admin_home_t:s0 rhel7.img > 2. # guestfish --rw -a rhel7.img > ><fs> get-backend > libvirt > ><fs> run > ><fs> mount /dev/sda1 / > 3. # ls -lZ rhel7.img > -rw-------. qemu qemu system_u:object_r:svirt_image_t:s0:c230,c866 > rhel7.img > 4. # virt-df -a rhel7.img > Filesystem 1K-blocks Used Available Use% > rhel7.img:/dev/sda1 508588 95524 413064 19% > rhel7.img:/dev/rhel/root 7022592 2984968 4037624 43% > Comments: virt-df can get the filesystem of the image. > 5. # ls -lZ rhel7.img > -rw-------. qemu qemu system_u:object_r:virt_content_t:s0 rhel7.img > Comments: However libvirt relabels the disks from > system_u:object_r:svirt_image_t:s0:c678,c742 to > system_u:object_r:virt_content_t:s0. > 6. ><fs> touch /test > Comments: create the file test successfully. > 7. ><fs> umount / > 8. ><fs> mount /dev/sda1 / > libguestfs: error: mount: /dev/sda1 on / (options: ''): mount: /dev/sda1: > can't read superblock > 9. ls -lZ /tmp/libguestfsXINrGS/overlay1 > -rw-r--r--. qemu qemu system_u:object_r:svirt_image_t:s0 overlay1 > > In step5, after run "virt-df -a rhel7.img", the libvirt relabels the disks > from > system_u:object_r:svirt_image_t:s0:c678,c742 to > system_u:object_r:virt_content_t:s0. > In step6, The problem is here. before umount, we can write to the image. > However, it fails to mount /dev/sda1 again after unmount it. > In step9, the overlay1's label does not change. The symptom is not exactly the same as the description. What's the symptom you met? My personal notes are kind of sketchy due to the fact that the initial discussion was over the phone where we mapped out a plan of attack to begin to get a handle on it then within about 10min he came back to me with: 14:20 foraker: Hrm, I think this is what I'm seeing: https://bugzilla.redhat.com/show_bug.cgi?id=912499 14:28 foraker: The more concice explanation: https://lists.fedoraproject.org/pipermail/virt/2013-February/003592.html 14:28 foraker: And indeed, setting LIBGUESTFS_ATTACH_METHOD=appliance makes the problem go away. According to what I remember, when he ran virt-manager he briefly would see a libguestfs flicker in the virt-manager and then right after it went away, all the running VMs would start report errors that indicated that they couldn't read their disk images. The rebase in RHEL 7.3 should fix this one. Hi, Rich I still have some question about this bug, could you please check for me? this is my verify steps: 1. The original selinux context: # ls -lZ RHEL-Server-7.2-64-hvm.raw -rw-r--r--. root root unconfined_u:object_r:user_home_t:s0 RHEL-Server-7.2-64-hvm.raw 2. Launch the guest image and Ctrl+z it, then check the selinux context. # guestfish -a RHEL-Server-7.2-64-hvm.raw ><fs> run ><fs> mount /dev/sda1 / ><fs> ^Z [1]+ Stopped guestfish -a RHEL-Server-7.2-64-hvm.raw # ls -lZ RHEL-Server-7.2-64-hvm.raw -rw-r--r--. qemu qemu system_u:object_r:svirt_image_t:s0:c9,c86 RHEL-Server-7.2-64-hvm.raw 3. Use virt-df and check the selinux context: # virt-df -a RHEL-Server-7.2-64-hvm.raw # ls -lZ RHEL-Server-7.2-64-hvm.raw -rw-r--r--. qemu qemu system_u:object_r:virt_content_t:s0 RHEL-Server-7.2-64-hvm.raw 4. # fg guestfish -a RHEL-Server-7.2-64-hvm.raw ><fs> touch /test ><fs> umount / ><fs> mount /dev/sda1 / ><fs> touch /test1 ><fs> ^Z 5. Check overlay1 # ls -lZ /tmp/libguestfsHTgxL3/overlay1 -rw-r--r--. qemu qemu system_u:object_r:svirt_image_t:s0 /tmp/libguestfsHTgxL3/overlay1 My question is: 1. In step 3, I learn from the above comments and patch that you told libvirt not to relabel the image, but here it still has relabeled the guest from "svirt_image_t:s0:c9,c86" to "virt_content_t:s0" , so is this a problem or I was wrong? 2. If it's ok for libvirt to relabel the context, then what have you done to fix the errors occurred in step 4 before (failed to touch /test or failed to mount again)? Since you used virt-df -a option, we didn't know that libvirt was already using the image and we didn't tell libvirt not to relabel it. If you had used the -d option instead then the image shouldn't have been relabelled. The relevant function used with the -d option only is: https://github.com/libguestfs/libguestfs/blob/master/src/libvirt-domain.c#L180-L319 Nothing in this bug tries to fix the -a option case. Thanks for Rich's reply.
Verified with the packages:
libguestfs-1.32.5-10.el7.x86_64
Verify steps:
1. Start a RHEL guest image:
# virsh list --all
Id Name State
----------------------------------------------------
15 rhel7.2-20160711 running
2. Check the selinux context:
# ls -lZ RHEL-Server-7.2-64-hvm.raw
-rw-r--r--. qemu qemu system_u:object_r:svirt_image_t:s0:c784,c1001 RHEL-Server-7.2-64-hvm.raw
3.
# virt-df -d rhel7.2-20160711
Filesystem 1K-blocks Used Available Use%
rhel7.2-20160711:/dev/sda1 508588 93608 414980 19%
rhel7.2-20160711:/dev/rhel_dhcp-10-28/root
6981632 2150148 4831484 31%
4. Check the selinux context again:
# ls -lZ RHEL-Server-7.2-64-hvm.raw
-rw-r--r--. qemu qemu system_u:object_r:svirt_image_t:s0:c784,c1001 RHEL-Server-7.2-64-hvm.raw
***Looks good, the selinux context has not been modified by libvirt.
5. Start guest image using guestfish and check the selinux context of overlay1.
# guestfish -d rhel7.2-20160711 --ro
><fs> run
><fs> mount /dev/sda1 /
><fs> ^Z
[1]+ Stopped guestfish -d rhel7.2-20160711 --ro
# ls -lZ RHEL-Server-7.2-64-hvm.raw
-rw-r--r--. qemu qemu system_u:object_r:svirt_image_t:s0:c784,c1001 RHEL-Server-7.2-64-hvm.raw
# ls -lZ /tmp/libguestfsb4Y6Xs/overlay1
-rw-r--r--. qemu qemu system_u:object_r:svirt_image_t:s0:c784,c1001 /tmp/libguestfsb4Y6Xs/overlay1
***The selinux context of guest image and overlay1 are all right.
So verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2016-2576.html |