DescriptionJarno Huuskonen
2016-04-28 09:17:14 UTC
Description of problem:
We're using UDP(arcserve) to backup linux VMs (on win2012R2 hyper-v). UDP/hyperv uses hypervvssd to freeze/thaw filesystems during backup(snapshot).
Default selinux-policy doesn't allow hypervvssd to freeze/thaw filesystems.
Second problem we've encountered with hypervvssd/UDP backups is that few times
creating the snapshot has left all filesystems in frozen state. (AFAIK UDP/vss writer managed to freeze filesystems but for some reason didn't call THAW).
So would it be possible to add (for example -s|--syncfs) cli option to hypervvssd. This would change hypervvssd behaviour:
hypervvssd would call syncfs(fd) instead of ioctl(fd, FIFREEZE (and basically
do noop on VSS_OP_THAW).
With this option it would be possible to make sure that filesystems are not
left in frozen state (and probably sacrifice some snapshot consistency).
(I made initial syncfs patch for hypervvssd, and if this option sounds reasonable I can attach the patch).
Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.13.1-60.el7_2.3.noarch
hypervvssd-0-0.26.20150402git.el7.x86_64
(same problem happens with RHEL6.7).
How reproducible:
always when using UDP to backup linux guest VM (on hyperv).
Steps to Reproduce:
1. use UDP(arcserve) to backup linux guest (I guess anything that calls hypervvssd with freeze/thaw will do). (AFAIK "normal" hyper-v checkpoint doesn't call hypervvssd+freeze/thaw).
Actual results:
avc: denied { read } for pid=47775 comm="hypervvssd" name="/" dev="dm-5" ino=128 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:object_r:mysqld_db_t:s0 tclass=dir
avc: denied { dac_read_search } for pid=47775 comm="hypervvssd" capability=2 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:system_r:hypervvssd_t:s0 tclass=capability
avc: denied { dac_override } for pid=47775 comm="hypervvssd" capability=1 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:system_r:hypervvssd_t:s0 tclass=capability
and UDP backup fails because VSS writer didn't create snapshot.
Expected results:
journal: Hyper-V VSS: VSS: op=FREEZE: succeeded
journal: Hyper-V VSS: VSS: op=THAW: succeeded
Additional info:
creating selinux module with something like this allows hypervvsd to freeze/thaw
filesystems:
allow hypervvssd_t mysqld_db_t:dir { read write ioctl open };
allow hypervvssd_t postgresql_db_t:dir { read write ioctl open };
allow hypervvssd_t tmp_t:dir { read write ioctl open };
allow hypervvssd_t usr_t:dir { read write ioctl open };
allow hypervvssd_t var_lib_t:dir { read write ioctl open };
allow hypervvssd_t var_log_t:dir { read write ioctl open };
allow hypervvssd_t self:capability { dac_read_search dac_override };
hypervvssd is very simple, it does the following:
For all mountpoints in /proc/mounts (including '/'):
on freeze request from the host:
1) fd = open(dir, O_RDONLY);
2) ioctl(fd, FIFREEZE, 0);
3) close(fd);
on thaw request from the host:
1) fd = open(dir, O_RDONLY);
2) ioctl(fd, FITHAW, 0);
3) close(fd);
this should always succeed. So, answering the question, hypervvssd_t should be able to open any dir on the system and (I'm not sure what it means for SELinux) do appropriate ioctls. The daemon only talks to kernel so giving it such permissions is relatively safe.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2017:1861
Description of problem: We're using UDP(arcserve) to backup linux VMs (on win2012R2 hyper-v). UDP/hyperv uses hypervvssd to freeze/thaw filesystems during backup(snapshot). Default selinux-policy doesn't allow hypervvssd to freeze/thaw filesystems. Second problem we've encountered with hypervvssd/UDP backups is that few times creating the snapshot has left all filesystems in frozen state. (AFAIK UDP/vss writer managed to freeze filesystems but for some reason didn't call THAW). So would it be possible to add (for example -s|--syncfs) cli option to hypervvssd. This would change hypervvssd behaviour: hypervvssd would call syncfs(fd) instead of ioctl(fd, FIFREEZE (and basically do noop on VSS_OP_THAW). With this option it would be possible to make sure that filesystems are not left in frozen state (and probably sacrifice some snapshot consistency). (I made initial syncfs patch for hypervvssd, and if this option sounds reasonable I can attach the patch). Version-Release number of selected component (if applicable): selinux-policy-targeted-3.13.1-60.el7_2.3.noarch hypervvssd-0-0.26.20150402git.el7.x86_64 (same problem happens with RHEL6.7). How reproducible: always when using UDP to backup linux guest VM (on hyperv). Steps to Reproduce: 1. use UDP(arcserve) to backup linux guest (I guess anything that calls hypervvssd with freeze/thaw will do). (AFAIK "normal" hyper-v checkpoint doesn't call hypervvssd+freeze/thaw). Actual results: avc: denied { read } for pid=47775 comm="hypervvssd" name="/" dev="dm-5" ino=128 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:object_r:mysqld_db_t:s0 tclass=dir avc: denied { dac_read_search } for pid=47775 comm="hypervvssd" capability=2 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:system_r:hypervvssd_t:s0 tclass=capability avc: denied { dac_override } for pid=47775 comm="hypervvssd" capability=1 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:system_r:hypervvssd_t:s0 tclass=capability and UDP backup fails because VSS writer didn't create snapshot. Expected results: journal: Hyper-V VSS: VSS: op=FREEZE: succeeded journal: Hyper-V VSS: VSS: op=THAW: succeeded Additional info: creating selinux module with something like this allows hypervvsd to freeze/thaw filesystems: allow hypervvssd_t mysqld_db_t:dir { read write ioctl open }; allow hypervvssd_t postgresql_db_t:dir { read write ioctl open }; allow hypervvssd_t tmp_t:dir { read write ioctl open }; allow hypervvssd_t usr_t:dir { read write ioctl open }; allow hypervvssd_t var_lib_t:dir { read write ioctl open }; allow hypervvssd_t var_log_t:dir { read write ioctl open }; allow hypervvssd_t self:capability { dac_read_search dac_override };