Bug 2093355

Try to reproduce it on qemu side but didn't reproduce this issue. will try to run it on libvirt side. And actually, if /etc/sysconfig/qemu-ga file changed, qga.service should've been restarted, btw. maybe you did that but didn't write it down there, if the whole operations are correct and configurations are well.

Yes sorry I restarts the service after changing /etc/sysconfig/qemu-ga.

(In reply to Renaud Métrich from comment #2)
> Yes sorry I restarts the service after changing /etc/sysconfig/qemu-ga.

okay, I got it. Could you please provide the XML file you used to boot up VM? it would be better for us to reproduce the same issue.

See discussion "qemu-ga guest-exec & SELinux" from selinux-fedora List:
https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.org/thread/LWL4WVO42KVFGZZDXATPBUDTPU36S5BK/

Daniel Berrange said:
"IMHO execution of external commands should only be allowed after toggling
a SELinux boolean tunable."

It looks like we should find a selinux solution. In Fedora first, before it can be backported. I am moving the bug back to selinux.

Thanks

I think there is no need for any additional SELinux boolean as long as the child of the service in charge of executing the command runs in the "unconfined domain".

Merged in rawhide, we will consider it to backport to rhel 8.8 or 8.9.

the new pck should not be ready yet right?  I was testing 'selinux-policy-38.1.23-1.el9' but there is no active booleans at all.

This BZ is filed against RHEL-8.

@demeng , please use the latest selinux-policy build for RHEL-8: selinux-policy-3.14.3-128.el8

Hi all, 
After executing the above steps as comment 16&37&39, I paste some output and results here, but the final result is that I couldn't execute qga command 'guest-exec' successfully.

output:
[root@vm-73-228 ~]# semanage fcontext -l | grep virt_qemu_ga_unco
/etc/qemu-ga/fsfreeze-hook.d(/.*)?                 all files          system_u:object_r:virt_qemu_ga_unconfined_exec_t:s0 
/usr/libexec/qemu-ga/fsfreeze-hook.d(/.*)?         all files          system_u:object_r:virt_qemu_ga_unconfined_exec_t:s0 
/usr/local/bin/qemu-quest-agent-wrapper            all files          system_u:object_r:virt_qemu_ga_unconfined_exec_t:s0 
/var/run/qemu-ga/fsfreeze-hook.d(/.*)?             all files          system_u:object_r:virt_qemu_ga_unconfined_exec_t:s0 


results:

{"execute":"guest-exec","arguments":{"path":"qemu-quest-agent-wrapper","arg":["mount","-l"],"input-data":"","capture-output":true}}
{"error": {"class": "CommandNotFound", "desc": "Command guest-exec has been disabled"}}
{"execute":"guest-exec-status","arguments":{"pid":948}}
{"error": {"class": "CommandNotFound", "desc": "Command guest-exec-status has been disabled"}}

anything is not correct? or does it require libvirt only?

I believe that the mount command is usually present on RHEL machines. Which means that the CommandNotFound error belongs to the qemu-quest-agent-wrapper command.

Did you create the qemu-quest-agent-wrapper file?

(In reply to dehanmeng from comment #44)
> (In reply to Milos Malik from comment #43)
> > I believe that the mount command is usually present on RHEL machines. Which
> > means that the CommandNotFound error belongs to the qemu-quest-agent-wrapper
> > command.
> > 
> > Did you create the qemu-quest-agent-wrapper file?
> 
> [root@vm-73-228 selinux-policy]# cat /usr/local/bin/qemu-quest-agent-wrapper 
> #!/bin/sh
> 
> echo "$(basename $0) executing as $(id -Z)"
> exec "${@:-}"
> 
> anything I need to change?

I believe no need for a change, but check permissions+context of the wrapper and look for AVC denials if there are any:

ls -lZ /usr/local/bin/qemu-quest-agent-wrapper
ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today

Is the searched path configured comewhere? Isn't it necessary to include full path instead of just the wrapper name?
execute":"guest-exec","arguments":{"path":"qemu-quest-agent-wrapper","arg":["mount","-l"],"input-data":"","capture-output":true}}

(In reply to Zdenek Pytela from comment #45)
> (In reply to dehanmeng from comment #44)
> > (In reply to Milos Malik from comment #43)
> > > I believe that the mount command is usually present on RHEL machines. Which
> > > means that the CommandNotFound error belongs to the qemu-quest-agent-wrapper
> > > command.
> > > 
> > > Did you create the qemu-quest-agent-wrapper file?
> > 
> > [root@vm-73-228 selinux-policy]# cat /usr/local/bin/qemu-quest-agent-wrapper 
> > #!/bin/sh
> > 
> > echo "$(basename $0) executing as $(id -Z)"
> > exec "${@:-}"
> > 
> > anything I need to change?
> 
> I believe no need for a change, but check permissions+context of the wrapper
> and look for AVC denials if there are any:
> 
> ls -lZ /usr/local/bin/qemu-quest-agent-wrapper

[root@vm-73-228 ~]# ls -lZ /usr/local/bin/qemu-quest-agent-wrapper
-rwxr-xr-x. 1 root root unconfined_u:object_r:virt_qemu_ga_unconfined_exec_t:s0 69 Aug 28 17:59 /usr/local/bin/qemu-quest-agent-wrapper

> ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today

[root@vm-73-228 ~]# ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today
<no matches>

> 
> Is the searched path configured comewhere? Isn't it necessary to include
> full path instead of just the wrapper name?
> execute":"guest-exec","arguments":{"path":"qemu-quest-agent-wrapper","arg":
> ["mount","-l"],"input-data":"","capture-output":true}}

I actually tested it with both absolute/relative path, and always get that error.

LGTM

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:7091

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days