Bug 1782615

Summary: Incomplete SELinux policy for virt_qemu_ga_t
Product: Red Hat Enterprise Linux 7 Reporter: sawozny
Component: qemu-guest-agentAssignee: Marc-Andre Lureau <marcandre.lureau>
Status: CLOSED WONTFIX QA Contact: xiagao
Severity: low Docs Contact:
Priority: unspecified    
Version: 7.6CC: jinzhao, juzhang, lijin, marcandre.lureau
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-02-03 15:48:50 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1779358    
Bug Blocks:    

Description sawozny 2019-12-11 23:58:44 UTC
Description of problem: When I attempt to create a snapshot in virsh on a machine with a second disk with a mysql instance on that mount point, the snapshot fails and the error message references the mount point of the second disk.  SELinux audit2allow shows missing capabilities for the qemu guest agent type.

Version-Release number of selected component (if applicable): EL 7.6; qemu-guest-agent.x86_64 - 10:2.12.0-2.el7

How reproducible: Every time

Steps to Reproduce:
1. On the host, install the qemu-ev repo and qemu-kvm-ev on top of qemu-kvm (so snapshot-create works)
2. Create a guest machine with a min install and qemu guest agent
3. Add a second disk on the host with qemu-img create and virsh attach-disk to the guest.
4. On the guest, format and mount the disk to /var/lib/mysql
5. On the guest, install Mysql (I used 5.7) and run it (this problem doesn't happen when the second disk is empty as a pure test) also note you'll need to add ignore-db-dir=lost+found to the [mysqld] section of the config file before your first run or mysql environment will refuse to manifest in the non-empty directory.
6. On the host in virsh, run a: snapshot-create-as <DOMAIN_NAME> test.snap --disk-only --quiesce --atomic

Actual results: error: internal error: unable to execute QEMU agent command 'guest-fsfreeze-freeze': failed to open /var/lib/mysql: Permission denied

audit2allow -a shows:
#============= virt_qemu_ga_t ==============
allow virt_qemu_ga_t self:capability { dac_override dac_read_search };

Expected results: Successful creation of snapshot

Additional info: Workarounds are to allow virt_qemu_ga_t to run in permissive mode while working with the snapped machine.  Also could add custom policy to address this, but I believe the production policy for this type is incomplete.  This was done on a CentOS 7.6 VM running on a CentOS 7.6 host, but I don't think the results on RHEL will be different.

Comment 5 John Ferlan 2020-02-03 15:48:50 UTC
Seeing as the dependent bz was closed as wontfix, so doing the same here.

Seems as though the SElinux level adjustments for RHEL7 would require more justification and a workaround exists (writing a custom policy), thus there are no plans to alter the RHEL7 default policies to resolve.

Comment 6 sawozny 2020-02-03 19:20:07 UTC
I don't agree that this should be closed as a won't fix, but not being a RH customer I'm only shouting into the wind.  

There is a clear gap in default policy that is not related to custom work, but will be found by any user who tries to snapshot and quiesce a machine with a USED off-disk mount point.  

When I hear people push back against setting SELinux to enforce and then see demonstrable out-of-the-box policy errors going unfixed I really can't blame them for feeling that way.

But at least this bug is now part of the public record and people affected by it will know the cause and how to work around it when they encounter it.  

I predict it will eventually be "discovered" and fixed in policy but probably only when an actual RH customer pushes the point.

In the meantime, I have my workaround so while I'm disappointed in this result, I thank everyone involved for their time.