Bug 2093956

Description of problem
----------------------

The software TPM emulator binary ("/usr/bin/swtpm") running inside a
container currently does not have write/append permissions.  As a
result, the 'swtpm' binary fails to start, and that in turn causes a
virtual machine configured with vTPM failing to boot.

That's the SELinux denial in question (see further below for fuller
denial):

     $> ausearch -m avc -m user_avc -m selinux_err -i -c swtpm [...]
     type=AVC msg=audit(06/02/2022 13:42:20.778:43441) : avc:  denied  {
     append } for  pid=339697 comm=swtpm
     name=instance-000000b0-swtpm.log dev="overlay" ino=40378064
     scontext=system_u:system_r:svirt_t:s0:c146,c635
     tcontext=system_u:object_r:container_ro_file_t:s0 tclass=file
     permissive=0

In short, the log file directory under /var/log/swtpm should have the
label "container_file_t" and _not_ "container_ro_file_t".


SELinux labels
--------------

Looking at the SELinx labels for 'swtpm' binary, we see that it has the
label "container_ro_file_t" (correctly so):

    [heat-admin@compute-1 ~]$ sudo podman exec -it nova_virtqemud /bin/bash
    [root@compute-1 /]# ls -lZ /usr/bin/swtpm
    -rwxr-xr-x. 1 root root system_u:object_r:container_ro_file_t:s0 42312 Nov 12  2021 /usr/bin/swtpm

And the log file (and the directory) has "container_ro_file_t", i.e.
read-only (notice the "_ro_" in the SELinux label):

    [root@compute-1 /]# ls -lZ /var/log/swtpm/libvirt/qemu/instance-000000b0-swtpm.log
    -rw-r--r--. 1 tss tss system_u:object_r:container_ro_file_t:s0 3385 Jun  2 13:42 /var/log/swtpm/libvirt/qemu/instance-000000b0-swtpm.log

For comparison, if you see the QEMU binary, it also has
"container_ro_file_t" (correctly so):

    [root@compute-1 /]# ls -lZ /usr/libexec/qemu-kvm 
    -rwxr-xr-x. 1 root root system_u:object_r:container_ro_file_t:s0 18574328 Mar 22 13:34 /usr/libexec/qemu-kvm

However, the log files it handles have the label "container_file_t"
(notice, there's no"_ro_" here, i.e. they _are_ writeable):

    [root@compute-1 /]# ls -lZ /var/log/libvirt/qemu/instance-000000b0.log
    -rw-------. 1 root root unconfined_u:object_r:container_file_t:s0 0 Jun  3 00:00 /var/log/libvirt/qemu/instance-000000b0.log


Environment
-----------

This is an OpenStack setup with RHEL-9 host.  And the virtual machines
will be launched inside a container.


Version
-------

  - container-selinux-2.179.1-1.el9_0.noarch
  - swtpm-0.7.0-1.20211109gitb79fd91.el9.x86_64 [inside the container]
  - qemu-kvm-6.2.0-11.el9_0.2.x86_64 [inside the container]

How reproducible: Consistently.


Steps to Reproduce
------------------

This bug was found in a QE environment (thanks: James Parker) of Red Hat
OpenStack on RHEL9.  It's a fairly involved setup, and can be re-run if
really required.

However, the information in this bug should be sufficient.  As the
solution here seems to be for '/usr/bin/swtpm' to be able to write to
log files under /var/log/swtpm/ directory.


Actual results
--------------

A QEMU instance (i.e. a virtual machine) running inside a container
fails to start as 'swtpm' binary couldn't be started:
-----------------------------------------------------------------------
$> cat instance-000000b0.log.1
2022-06-02 13:42:20.765+0000: Starting external device: TPM Emulator
/usr/bin/swtpm socket --daemon --ctrl type=unixio,path=/run/libvirt/qemu/swtpm/115-instance-000000b0-swtpm.sock,mode=0600 --tpmstate
dir=/var/lib/libvirt/swtpm/febdee00-d829-4f92-8441-4abbf6768c77/tpm2,mode=0600 --log file=/var/log/swtpm/libvirt/qemu/instance-000000b0-swtpm.log --
terminate --tpm2 --pid file=/run/libvirt/qemu/swtpm/115-instance-000000b0-swtpm.pid --key pwdfd=31,mode=aes-256-cbc --migration-key pwdfd=33,mode=aes-
256-cbc
2022-06-02 13:42:20.780+0000: shutting down, reason=failed
-----------------------------------------------------------------------

And that's the fuller SELinux denial for the 'swtpm' binary (I've 
manually line-wrapped the logs below):
-----------------------------------------------------------------------
$> ausearch -m avc -m user_avc -m selinux_err -i -c swtpm
----
type=PROCTITLE msg=audit(06/02/2022 13:42:20.778:43441) :
proctitle=/usr/bin/swtpm socket --daemon --ctrl
type=unixio,path=/run/libvirt/qemu/swtpm/115-instance-000000b0-swtpm.sock,mode=0600
--tpms 

type=SYSCALL msg=audit(06/02/2022 13:42:20.778:43441) : arch=x86_64
syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD
a1=0x5598ba4fad50 a2=O_WRONLY|O_CREAT|O_APPEND|O_NOFOLLOW a3=0x180
items=0 ppid=339696 pid=339697 auid=heat-admin uid=tss gid=tss euid=tss
suid=tss fsuid=tss egid=tss sgid=tss fsgid=tss tty=(none) ses=3
comm=swtpm exe=/usr/bin/swtpm
subj=system_u:system_r:svirt_t:s0:c146,c635 key=(null) 

type=AVC msg=audit(06/02/2022 13:42:20.778:43441) : avc:  denied  {
append } for  pid=339697 comm=swtpm name=instance-000000b0-swtpm.log
dev="overlay" ino=40378064
scontext=system_u:system_r:svirt_t:s0:c146,c635
tcontext=system_u:object_r:container_ro_file_t:s0 tclass=file
permissive=0
-----------------------------------------------------------------------


Expected results
----------------

The 'swtpm' binary running in a container should be able to append to
log files under /var/log/swtpm/libvirt/qemu/ directory.