| Summary: | [Hyper-V][RHEL7.3]hypervvssd and selinux denials | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Jarno Huuskonen <jarno.huuskonen> | |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 7.2 | CC: | boyang, ccheney, dapospis, hhei, jingli, jopoulso, ldu, leiwang, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde, vkuznets, xiaofwan, xuli, yacao | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | x86_64 | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | selinux-policy-3.13.1-133.el7 | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1335733 (view as bug list) | Environment: | ||
| Last Closed: | 2017-08-01 15:10:10 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Bug Depends On: | ||||
| Bug Blocks: | 1401400, 1335733 | |||
What is fix here? hypervvssd_t should read all dirs on system? Could please Vitaly help to comment on what the fix is? Thank you. hypervvssd is very simple, it does the following: For all mountpoints in /proc/mounts (including '/'): on freeze request from the host: 1) fd = open(dir, O_RDONLY); 2) ioctl(fd, FIFREEZE, 0); 3) close(fd); on thaw request from the host: 1) fd = open(dir, O_RDONLY); 2) ioctl(fd, FITHAW, 0); 3) close(fd); this should always succeed. So, answering the question, hypervvssd_t should be able to open any dir on the system and (I'm not sure what it means for SELinux) do appropriate ioctls. The daemon only talks to kernel so giving it such permissions is relatively safe. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:1861 |
Description of problem: We're using UDP(arcserve) to backup linux VMs (on win2012R2 hyper-v). UDP/hyperv uses hypervvssd to freeze/thaw filesystems during backup(snapshot). Default selinux-policy doesn't allow hypervvssd to freeze/thaw filesystems. Second problem we've encountered with hypervvssd/UDP backups is that few times creating the snapshot has left all filesystems in frozen state. (AFAIK UDP/vss writer managed to freeze filesystems but for some reason didn't call THAW). So would it be possible to add (for example -s|--syncfs) cli option to hypervvssd. This would change hypervvssd behaviour: hypervvssd would call syncfs(fd) instead of ioctl(fd, FIFREEZE (and basically do noop on VSS_OP_THAW). With this option it would be possible to make sure that filesystems are not left in frozen state (and probably sacrifice some snapshot consistency). (I made initial syncfs patch for hypervvssd, and if this option sounds reasonable I can attach the patch). Version-Release number of selected component (if applicable): selinux-policy-targeted-3.13.1-60.el7_2.3.noarch hypervvssd-0-0.26.20150402git.el7.x86_64 (same problem happens with RHEL6.7). How reproducible: always when using UDP to backup linux guest VM (on hyperv). Steps to Reproduce: 1. use UDP(arcserve) to backup linux guest (I guess anything that calls hypervvssd with freeze/thaw will do). (AFAIK "normal" hyper-v checkpoint doesn't call hypervvssd+freeze/thaw). Actual results: avc: denied { read } for pid=47775 comm="hypervvssd" name="/" dev="dm-5" ino=128 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:object_r:mysqld_db_t:s0 tclass=dir avc: denied { dac_read_search } for pid=47775 comm="hypervvssd" capability=2 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:system_r:hypervvssd_t:s0 tclass=capability avc: denied { dac_override } for pid=47775 comm="hypervvssd" capability=1 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:system_r:hypervvssd_t:s0 tclass=capability and UDP backup fails because VSS writer didn't create snapshot. Expected results: journal: Hyper-V VSS: VSS: op=FREEZE: succeeded journal: Hyper-V VSS: VSS: op=THAW: succeeded Additional info: creating selinux module with something like this allows hypervvsd to freeze/thaw filesystems: allow hypervvssd_t mysqld_db_t:dir { read write ioctl open }; allow hypervvssd_t postgresql_db_t:dir { read write ioctl open }; allow hypervvssd_t tmp_t:dir { read write ioctl open }; allow hypervvssd_t usr_t:dir { read write ioctl open }; allow hypervvssd_t var_lib_t:dir { read write ioctl open }; allow hypervvssd_t var_log_t:dir { read write ioctl open }; allow hypervvssd_t self:capability { dac_read_search dac_override };