Bug 1758772

Description of problem:
After fully patching a fresh RHEL 8.0 , SELINUX prevents qemu-ga from accessing one of the block devices.
As the VM is hosted on oVirt , that information is needed for the VM's "Disks" section and should be allowed.

Version-Release number of selected component (if applicable):
selinux-policy-3.14.1-61.el8_0.2.noarch
qemu-guest-agent-2.12.0-65.module+el8.0.0+4084+cce

How reproducible:
Installed once, but noticed same behaviour on CentOS 8 -> https://bugs.centos.org/view.php?id=16452

Steps to Reproduce:
1.Install with guest tools
2.Install Ansible via https://access.redhat.com/articles/3050101
3.Fully update 
4.Force relabel (touch /.autorelabel) & reboot


Actual results:
An AVC is generated:

[root@ansible ~]# sealert -l 5269453e-d426-42b6-a731-92f51f20fd3b
SELinux is preventing /usr/bin/qemu-ga from read access on the file b8:1.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that qemu-ga should be allowed read access on the b8:1 file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'qemu-ga' --raw | audit2allow -M my-qemuga
# semodule -X 300 -i my-qemuga.pp


Additional Information:
Source Context                system_u:system_r:virt_qemu_ga_t:s0
Target Context                system_u:object_r:udev_var_run_t:s0
Target Objects                b8:1 [ file ]
Source                        qemu-ga
Source Path                   /usr/bin/qemu-ga
Port                          <Unknown>
Host                          ansible.localdomain
Source RPM Packages           qemu-guest-agent-2.12.0-65.module+el8.0.0+4084+cce
                              b9f44.5.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.14.1-61.el8_0.2.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     ansible.localdomain
Platform                      Linux ansible.localdomain
                              4.18.0-80.11.2.el8_0.x86_64 #1 SMP Sun Sep 15
                              11:24:21 UTC 2019 x86_64 x86_64
Alert Count                   56
First Seen                    2019-10-05 16:11:21 EEST
Last Seen                     2019-10-05 16:41:21 EEST
Local ID                      5269453e-d426-42b6-a731-92f51f20fd3b

Raw Audit Messages
type=AVC msg=audit(1570282881.902:117): avc:  denied  { read } for  pid=974 comm="qemu-ga" name="b8:1" dev="tmpfs" ino=20618 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=0


type=SYSCALL msg=audit(1570282881.902:117): arch=x86_64 syscall=openat success=no exit=EACCES a0=ffffff9c a1=7ffec7fe2780 a2=80000 a3=0 items=0 ppid=1 pid=974 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=qemu-ga exe=/usr/bin/qemu-ga subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null)

Hash: qemu-ga,virt_qemu_ga_t,udev_var_run_t,file,read



Expected results:
No AVC denial to be observed.