Bug 1331309

Summary: [Hyper-V][RHEL7.3]hypervvssd and selinux denials
Product: Red Hat Enterprise Linux 7 Reporter: Jarno Huuskonen <jarno.huuskonen>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.2CC: boyang, ccheney, dapospis, hhei, jingli, jopoulso, ldu, leiwang, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde, vkuznets, xiaofwan, xuli, yacao
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.13.1-133.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1335733 (view as bug list) Environment:
Last Closed: 2017-08-01 15:10:10 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1335733, 1401400    

Description Jarno Huuskonen 2016-04-28 09:17:14 UTC
Description of problem:
We're using UDP(arcserve) to backup linux VMs (on win2012R2 hyper-v). UDP/hyperv uses hypervvssd to freeze/thaw filesystems during backup(snapshot).

Default selinux-policy doesn't allow hypervvssd to freeze/thaw filesystems.

Second problem we've encountered with hypervvssd/UDP backups is that few times
creating the snapshot has left all filesystems in frozen state. (AFAIK UDP/vss writer managed to freeze filesystems but for some reason didn't call THAW).

So would it be possible to add (for example -s|--syncfs) cli option to hypervvssd. This would change hypervvssd behaviour:
hypervvssd would call syncfs(fd) instead of ioctl(fd, FIFREEZE (and basically
do noop on VSS_OP_THAW).
With this option it would be possible to make sure that filesystems are not
left in frozen state (and probably sacrifice some snapshot consistency).
(I made initial syncfs patch for hypervvssd, and if this option sounds reasonable I can attach the patch).

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.13.1-60.el7_2.3.noarch
hypervvssd-0-0.26.20150402git.el7.x86_64
(same problem happens with RHEL6.7).

How reproducible:
always when using UDP to backup linux guest VM (on hyperv).

Steps to Reproduce:
1. use UDP(arcserve) to backup linux guest (I guess anything that calls hypervvssd with freeze/thaw will do). (AFAIK "normal" hyper-v checkpoint doesn't call hypervvssd+freeze/thaw).

Actual results:
avc:  denied  { read } for  pid=47775 comm="hypervvssd" name="/" dev="dm-5" ino=128 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:object_r:mysqld_db_t:s0 tclass=dir

avc:  denied  { dac_read_search } for  pid=47775 comm="hypervvssd" capability=2  scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:system_r:hypervvssd_t:s0 tclass=capability

avc:  denied  { dac_override } for  pid=47775 comm="hypervvssd" capability=1  scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:system_r:hypervvssd_t:s0 tclass=capability

and UDP backup fails because VSS writer didn't create snapshot.


Expected results:
journal: Hyper-V VSS: VSS: op=FREEZE: succeeded
journal: Hyper-V VSS: VSS: op=THAW: succeeded

Additional info:
creating selinux module with something like this allows hypervvsd to freeze/thaw
filesystems:
allow hypervvssd_t mysqld_db_t:dir { read write ioctl open };
allow hypervvssd_t postgresql_db_t:dir { read write ioctl open };
allow hypervvssd_t tmp_t:dir { read write ioctl open };
allow hypervvssd_t usr_t:dir { read write ioctl open };
allow hypervvssd_t var_lib_t:dir { read write ioctl open };
allow hypervvssd_t var_log_t:dir { read write ioctl open };
allow hypervvssd_t self:capability { dac_read_search dac_override };

Comment 6 Lukas Vrabec 2016-06-28 11:26:24 UTC
What is fix here? hypervvssd_t should read all dirs on system?

Comment 7 xuli 2016-06-29 02:30:55 UTC
Could please Vitaly help to comment on what the fix is?

Thank you.

Comment 8 Vitaly Kuznetsov 2016-06-29 09:27:24 UTC
hypervvssd is very simple, it does the following:

For all mountpoints in /proc/mounts (including '/'):

on freeze request from the host:

1) fd = open(dir, O_RDONLY);
2) ioctl(fd, FIFREEZE, 0);
3) close(fd);

on thaw request from the host:

1) fd = open(dir, O_RDONLY);
2) ioctl(fd, FITHAW, 0);
3) close(fd);

this should always succeed. So, answering the question, hypervvssd_t should be able to open any dir on the system and (I'm not sure what it means for SELinux) do appropriate ioctls. The daemon only talks to kernel so giving it such permissions is relatively safe.

Comment 14 errata-xmlrpc 2017-08-01 15:10:10 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1861