Bug 2178612

Summary:	Add a SELinux boolean which allows qemu guest agent to write SSH keys
Product:	Red Hat Enterprise Linux 9	Reporter:	Andrej Krejcir <akrejcir>
Component:	selinux-policy	Assignee:	Nikola Knazekova <nknazeko>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.2	CC:	demeng, lvrabec, mmalik, mtessun, nknazeko, ovasik, pvlasin, sgott, zpytela
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-38.1.9-1.el9_2	Doc Type:	Enhancement
Doc Text:	Feature: Add SELinux boolean to allow qemu guest agent to manage SSH keys Reason: QEMU Guest Agent 5.2.0 added some new features including commands for managing guest ssh keys. Result: QEMU Guest Agent can manage ssh home directory by enabling the virt_qemu_ga_manage_ssh SELinux boolean.	Story Points:	---
Clone Of:
Clones:	2179027 (view as bug list)		Environment:
Last Closed:	2023-05-09 08:17:18 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2179027

Description Andrej Krejcir 2023-03-15 12:30:04 UTC

Description of problem:

By default selinux blocks qemu guest agent from accessing SSH key files.
Currently there is a boolean to allow reading keys "virt_qemu_ga_read_ssh", but there is no boolean to allow writing keys.

Version-Release number of selected component (if applicable):
selinux-policy  38.1.8-1.el9 

How reproducible:
100%

Steps to Reproduce:
1. Start a VM with RHEL 9.2 guest image. I've used "rhel-guest-image-9.2-20230220.9.x86_64.qcow2"

virt-customize -a rhel-9.2.qcow2 \
  --ssh-inject root \
  --root-password password:pass123 \
  --uninstall cloud-init \
  --connect qemu:///system

virt-install --name test-vm \
  --vcpus 2 \
  --cpu host \
  --memory 2048 \
  --rng /dev/urandom \
  --disk rhel-9.2.qcow2 \
  --os-variant=rhel9.0 \
  --import \
  --boot uefi \
  --noautoconsole \
  --connect qemu:///system


2. Try to set SSH keys using qemu guest agent.
virsh -c qemu:///system set-user-sshkeys test-vm root --file ~/.ssh/id_rsa.pub

Fails with error message:
error: internal error: unable to execute QEMU agent command 'guest-ssh-add-authorized-keys': failed to write to '/root/.ssh/authorized_keys': Failed to create file “/root/.ssh/authorized_keys.SUES11”: Permission denied


Additional info:

Reading the keys fails similarly, if the "virt_qemu_ga_read_ssh" boolean is not set in the guest.

virsh -c qemu:///system get-user-sshkeys test-vm root

fails with:
error: internal error: unable to execute QEMU agent command 'guest-ssh-get-authorized-keys': failed to read '/root/.ssh/authorized_keys': Failed to open file “/root/.ssh/authorized_keys”: Permission denied


After the boolean is set,

virsh -c qemu:///system get-user-sshkeys test-vm root

Succeeds and prints the key.

Comment 21 errata-xmlrpc 2023-05-09 08:17:18 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2483