Bug 1238079

Summary:

libStorageMgmt: SELinux is preventing HP SmartArray plugin

Product:

Red Hat Enterprise Linux 7

Reporter:

Gris Ge <fge>

Component:

selinux-policy

Assignee:

Lukas Vrabec <lvrabec>

Status:

CLOSED ERRATA

QA Contact:

Milos Malik <mmalik>

Severity:

low

Docs Contact:

Priority:

low

Version:

7.2

CC:

bgoncalv, fge, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde, tasleson

Target Milestone:

Target Release:

---

Hardware:

x86_64

OS:

Linux

Whiteboard:

Fixed In Version:

selinux-policy-3.13.1-50.el7

Doc Type:

Bug Fix

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2015-11-19 10:38:34 UTC

Type:

Bug

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Attachments:

Description	Flags
LibStorageMgmt hpsa plugin selinux AVC logs.	none

Description Gris Ge 2015-07-01 07:19:23 UTC

Description of problem:
SELinux is stopping libstoragemgmt MegaRAID plugin

/usr/lib/python2.7/site-packages/lsm/plugin/hpsa/hpsa.py


The HP Smart Array plugin will execute vendor binrary tool -- 
hpssacli as root user to:

* IOCTL CCISS_PASSTHRU against /dev/sdX
* Read sysfs files.

Version-Release number of selected component (if applicable):
libstoragemgmt-1.2.3-2.el7.x86_64
libstoragemgmt-hpsa-plugin-1.2.3-2.el7.noarch
storcli-1.14.12-1.noarch (vendor binary tool)
selinux-policy-targeted-3.13.1-23.el7.noarch

How reproducible:
100%

Steps to Reproduce:
1. Find a server with HP Smart Array card installed.
2. Install libstoragemgmt-hpsa-plugin-1.2.3-2.el7.noarch 
3. Use this repo to install hpssacli:
http://file.nay.redhat.com/~fge/lsm/HP/HP_hpssacli.repo
4. modprobe sg
5. lsmcli ls -u hpsa://

Actual results:

SELinux stopped the libstoragemgmt HP SmartArray plugin.

Expected results:
HP SmartArray plugin works.

Additional info:
No sure SELinux should include policy for their party binrary tools or not.
I will post the 12 logs if we decide to do so.

Comment 1 Miroslav Grepl 2015-07-16 11:33:57 UTC

Could you attach AVC messages?

Comment 2 Gris Ge 2015-07-16 13:14:33 UTC

Created attachment 1052690 [details]
LibStorageMgmt hpsa plugin selinux AVC logs.

Since we have 12 AVC reports, I create a tarball.
Let me know if you prefer copy&paste way.

Comment 3 Miroslav Grepl 2015-08-05 07:51:08 UTC

Lukas,
could you check these AVCs and see if we can add fixes to 7.2?

Comment 4 Lukas Vrabec 2015-08-05 08:31:55 UTC

Yes, we can Add this rules to 7.2

Comment 5 Lukas Vrabec 2015-08-05 09:09:37 UTC

HI, 

There is one rule: 
allow lsmd_plugin_t fixed_disk_device_t:blk_file { read write open };

fixed_disk_device_t is labeled on this files:
$ sudo semanage fcontext -l | grep fixed_disk_device_t
/dev/(raw/)?rawctl                                 character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/[shmxv]d[^/]*                                 block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/\.tmp-block-.*                                character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/ataraid/.*                                    block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/bcache[0-9]+                                  block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/cciss/[^/]*                                   block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/dasd[^/]*                                     block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/dasd[^/]*                                     character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/device-mapper                                 character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/dm-[0-9]+                                     block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/drbd[^/]*                                     block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/etherd/.+                                     block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/flash[^/]*                                    block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/i2o/hd[^/]*                                   block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/ida/[^/]*                                     block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/initrd                                        block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/jsfd                                          block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/jsflash                                       character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/loop.*                                        block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/lvm                                           character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/mapper/.*                                     block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/md/.*                                         block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/megadev.*                                     character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/megaraid_sas_ioctl_node                       character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/mtd.*                                         block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/nb[^/]+                                       block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/ps3d.*                                        block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/ram.*                                         block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/raw/raw[0-9]+                                 character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/rd.*                                          block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/root                                          block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/scramdisk/.*                                  block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/tw[a-z][^/]*                                  character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/ubd[^/]*                                      block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/vd[^/]*                                       block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/xvd[^/]*                                      block device       system_u:object_r:fixed_disk_device_t:s0 
/lib/udev/devices/loop.*                           block device       system_u:object_r:fixed_disk_device_t:s0 
/usr/lib/udev/devices/loop.*                       block device       system_u:object_r:fixed_disk_device_t:s0 

Is really necessary to write to this devices?

Comment 7 Lukas Vrabec 2015-08-05 10:30:53 UTC

commit abac06ff2d2c21a6a92dbf60e1c2e19ed2cf796d
Author: Lukas Vrabec <lvrabec>
Date:   Wed Aug 5 12:27:18 2015 +0200

    Allow lsm_plugin_t to rw raw_fixed_disk.
    Resolves:#1238079

commit cba244bf08396e23ec7e56c8c63f7654cf77c20b
Author: Lukas Vrabec <lvrabec>
Date:   Wed Aug 5 11:13:56 2015 +0200

    Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device
    Resolves: #1238079

Comment 8 Gris Ge 2015-08-05 13:36:04 UTC

Hi Lukas,

Base on the code of HP opensource tool(cciss_vol_status, not the binary tool 
hpssacli we use here), they need the write access to /dev/sgX (char device)
and /dev/sdX(block device) in order to generate the query IOCTL.

The manpage of 'hpsa(4)' mentioned this:
============
Supported ioctl() operations
    CCISS_PASSTHRU, CCISS_BIG_PASSTHRU
        Allows  "BMIC" and "CISS" commands to be passed through to the Smart Array.
        These are used extensively by the HP Array Configuration Utility, SNMP 
        storage agents, etc.  See cciss_vol_status at  ⟨http://cciss.sf.net⟩ for
        some examples.
============

Comment 9 Gris Ge 2015-08-06 13:23:55 UTC

Hi Lukas,

In stead of giving lsmd_plugin_t (all lsm plugin) for this wide
permission, is there anyway to limit this permission only for:
/usr/lib/python2.7/site-packages/lsm/plugin/hpsa/hpsa.py
?

Thank you.

Comment 10 Miroslav Grepl 2015-08-07 09:49:30 UTC

(In reply to Gris Ge from comment #9)
> Hi Lukas,
> 
> In stead of giving lsmd_plugin_t (all lsm plugin) for this wide
> permission, is there anyway to limit this permission only for:
> /usr/lib/python2.7/site-packages/lsm/plugin/hpsa/hpsa.py
> ?
> 
> Thank you.

Yes, but I don't see as a big security advantage. Basically we treat all these plugins under lsmd_plugin_t.

So I am fine with fixes in -39.el7.

Comment 13 Gris Ge 2015-09-14 07:18:27 UTC

Hi Milos Malik,

Still got warnnings on selinux-policy-targeted-3.13.1-47.el7.noarch.
But 'sealert' failed(exist bug?) to provide detail information:
====
[root@hp-dl360pgen8-08 ~]# grep 'sealert -l ' /var/log/messages |perl -ne 'print "$1\n" if /(sealert -l.+)$/'|sort -u
sealert -l 8666433b-b792-4f7e-a40a-10c53fb01940
sealert -l e44c22f1-19c6-45fd-a6f6-f7b166525ab1
[root@hp-dl360pgen8-08 ~]# sealert -l 8666433b-b792-4f7e-a40a-10c53fb01940
failed to connect to server: No such file or directory
[root@hp-dl360pgen8-08 ~]# sealert -l e44c22f1-19c6-45fd-a6f6-f7b166525ab1
failed to connect to server: No such file or directory
====

/var/log/audit/audit.log contains.
====
type=AVC msg=audit(1442214534.788:6114): avc:  denied  { sys_admin } for  pid=21374 comm="hpssacli" capability=21  scontext=system_u:system_r:lsmd_plugin_t:s0 tcontext=system_u:system_r:lsmd_plugin_t:s0 tclass=capability
type=SYSCALL msg=audit(1442214534.788:6114): arch=c000003e syscall=2 success=yes exit=5 a0=7f5728047708 a1=2 a2=7f57309f23f8 a3=3 items=0 ppid=21351 pid=21374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hpssacli" exe="/opt/hp/hpssacli/bld/hpssacli" subj=system_u:system_r:lsmd_plugin_t:s0 key=(null)
type=AVC msg=audit(1442214641.159:6116): avc:  denied  { getattr } for  pid=21704 comm="hpssacli" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:lsmd_plugin_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
type=SYSCALL msg=audit(1442214641.159:6116): arch=c000003e syscall=137 success=yes exit=0 a0=7f3538013a48 a1=7f353fb1bd30 a2=fffffffffff473b8 a3=7f353fb1bb60 items=0 ppid=21702 pid=21704 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hpssacli" exe="/opt/hp/hpssacli/bld/hpssacli" subj=system_u:system_r:lsmd_plugin_t:s0 key=(null)
====

Comment 17 errata-xmlrpc 2015-11-19 10:38:34 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2300.html