Bug 1368356

Summary: No DAC seclabel info is output in active dumpxml when security_default_confined = 0
Product: Red Hat Enterprise Linux 7 Reporter: Fangge Jin <fjin>
Component: libvirtAssignee: Ján Tomko <jtomko>
Status: CLOSED WONTFIX QA Contact: yafu <yafu>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.3CC: dyuan, mzhan, rbalakri, xuzhang, yafu, yanqzhan, zpeng
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-06-02 10:44:54 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Fangge Jin 2016-08-19 07:28:33 UTC
Description of problem:
Set security_default_confined = 0 in qemu.conf, start guest, guest image ownership changed to qemu:qemu from root:root, but seclabel info is not output in active xml.

Version-Release number of selected component:
libvirt-2.0.0-5.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Prepare guest image file:
# ll -Z /var/lib/libvirt/images/rhel7.2.qcow2
-rw-------. root root system_u:object_r:virt_image_t:s0 /var/lib/libvirt/images/rhel7.2.qcow2


2. Set security_default_confined = 0 in qemu.conf, restart libvirtd service

3. Check active domain xml:
# virsh dumpxml rhel7
...
  <seclabel type='none' model='selinux'/>
...

No DAC seclabel info is output in dumpxml, but actually guest image file ownership is changed to qemu:qemu from root:root

# ll -Z /var/lib/libvirt/images/rhel7.2.qcow2
-rw-------. qemu qemu system_u:object_r:virt_image_t:s0 /var/lib/libvirt/images/rhel7.2.qcow2


Actual results:
As step3

Expected results:
In step 3, DAC seclabel info is output in active xml, or guest should fail to start

Additional info:
1. Keep default setting in qemu.conf
2. Prepare guest without seclabel element in domain xml
3. Start guest, check active dumpxml:
# virsh dumpxml rhel7
...
  <seclabel type='dynamic' model='selinux' relabel='yes'>
    <label>system_u:system_r:svirt_t:s0:c124,c389</label>
    <imagelabel>system_u:object_r:svirt_image_t:s0:c124,c389</imagelabel>
  </seclabel>
  <seclabel type='dynamic' model='dac' relabel='yes'>
    <label>+107:+107</label>
    <imagelabel>+107:+107</imagelabel>
  </seclabel>
...

Comment 2 Ján Tomko 2018-06-02 10:44:54 UTC
The "dac" security driver is quirky. I don't think this particular corner case is worth fixing.