Bug 2187290
| Summary: | enhancement request - pacemaker + virt + virsh | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | lejeczek <peljasz> |
| Component: | selinux-policy | Assignee: | Nobody <nobody> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | urgent | Docs Contact: | |
| Priority: | medium | ||
| Version: | CentOS Stream | CC: | bstinson, jwboyer, lvrabec, mmalik, zpytela |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-38.1.13-1.el9 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-11-07 08:52:21 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Deadline: | 2023-05-16 | ||
Hi lejeczek, can you please attach audit logs? # ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today Thank you Nikola Yes I can but I'd have to revert back to "broken" setup, which would be costly. I'd suggest to get the authors/devel of pcs/pacemaker involved - no better way then go to the source - and ask them to use plain-vanilla Centos 9 to run VirtualDomain _live_ migration (move) with tls & with tcp (it does not appear to be an issue with ssh) This issue does not seem to occur with libvirtd alone, virsh migrates okey, seems to pertain pcs/pacemaker specifically. -> $ ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts 9:40
----
type=PROCTITLE msg=audit(19/04/23 09:57:49.713:60379) : proctitle=virsh --connect=qemu:///system --quiet migrate --live --unsafe orum2 qemu+tls://swir.serv.internal/system
type=SYSCALL msg=audit(19/04/23 09:57:49.713:60379) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x7 a1=0x55f35b5c1560 a2=0x10 a3=0x7fff95fd4724 items=0 ppid=3696697 pid=3696741 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=virsh exe=/usr/bin/virsh subj=system_u:system_r:virsh_t:s0 key=(null)
type=AVC msg=audit(19/04/23 09:57:49.713:60379) : avc: denied { name_connect } for pid=3696741 comm=virsh dest=16514 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virt_port_t:s0 tclass=tcp_socket permissive=0
Additional Information:
Source Context system_u:system_r:virsh_t:s0
Target Context system_u:object_r:virt_port_t:s0
Target Objects port 16514 [ tcp_socket ]
Source virsh
Source Path /usr/bin/virsh
Port 16514
Host whale.mine.priv
Source RPM Packages libvirt-client-9.0.0-7.el9.x86_64
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-38.1.11-2.el9.noarch
Local Policy RPM selinux-policy-targeted-38.1.11-2.el9.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name whale.mine.priv
Platform Linux whale.mine.priv 5.14.0-299.el9.x86_64 #1 SMP
PREEMPT_DYNAMIC Thu Apr 13 10:08:03 UTC 2023
x86_64 x86_64
Alert Count 1
First Seen 2023-04-19 09:57:49 CEST
Last Seen 2023-04-19 09:57:49 CEST
Local ID 6aa6e73e-04c4-4d9a-a8ec-a6aa407cab39
Raw Audit Messages
type=AVC msg=audit(1681891069.713:60379): avc: denied { name_connect } for pid=3696741 comm="virsh" dest=16514 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virt_port_t:s0 tclass=tcp_socket permissive=0
type=SYSCALL msg=audit(1681891069.713:60379): arch=x86_64 syscall=connect success=no exit=EACCES a0=7 a1=55f35b5c1560 a2=10 a3=7fff95fd4724 items=0 ppid=3696697 pid=3696741 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=virsh exe=/usr/bin/virsh subj=system_u:system_r:virsh_t:s0 key=(null)
Hash: virsh,virsh_t,virt_port_t,tcp_socket,name_connect
Caught in enforcing mode:
----
type=PROCTITLE msg=audit(04/21/2023 11:23:45.290:1809) : proctitle=virsh --connect=qemu+tls:///system
type=SOCKADDR msg=audit(04/21/2023 11:23:45.290:1809) : saddr={ saddr_fam=inet laddr=127.0.0.1 lport=16514 }
type=SYSCALL msg=audit(04/21/2023 11:23:45.290:1809) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x5 a1=0x5562b908cee0 a2=0x10 a3=0x7fff1ca8f744 items=0 ppid=5763 pid=46373 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=6 comm=virsh exe=/usr/bin/virsh subj=system_u:system_r:virsh_t:s0 key=(null)
type=AVC msg=audit(04/21/2023 11:23:45.290:1809) : avc: denied { name_connect } for pid=46373 comm=virsh dest=16514 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virt_port_t:s0 tclass=tcp_socket permissive=0
----
Caught in permissive mode:
----
type=PROCTITLE msg=audit(04/21/2023 11:25:44.608:2015) : proctitle=virsh --connect=qemu+tls:///system
type=SOCKADDR msg=audit(04/21/2023 11:25:44.608:2015) : saddr={ saddr_fam=inet laddr=127.0.0.1 lport=16514 }
type=SYSCALL msg=audit(04/21/2023 11:25:44.608:2015) : arch=x86_64 syscall=connect success=no exit=ECONNREFUSED(Connection refused) a0=0x5 a1=0x5599f95625a0 a2=0x10 a3=0x7fff0d76e524 items=0 ppid=5763 pid=47879 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=6 comm=virsh exe=/usr/bin/virsh subj=system_u:system_r:virsh_t:s0 key=(null)
type=AVC msg=audit(04/21/2023 11:25:44.608:2015) : avc: denied { name_connect } for pid=47879 comm=virsh dest=16514 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virt_port_t:s0 tclass=tcp_socket permissive=1
----
The reproducer I used:
# runcon system_u:system_r:initrc_t:s0 bash -c 'virsh --connect=qemu+tls:///system'
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:6617 |
Description of problem: Hi. I see some denials which result in: module my-virsh-pacemaker 1.0; require { type virt_port_t; type cluster_var_lib_t; type virsh_t; class file write; class tcp_socket name_connect; } #============= virsh_t ============== allow virsh_t cluster_var_lib_t:file write; allow virsh_t virt_port_t:tcp_socket name_connect; I think it would be good to have, if not in default policies then perhaps with the help of boolean(s) to allow these. Maybe even more as these come from pacemaker use ocf_heartbeat_VirtualDomain - which would be a common/popular env I'd imagine - when set to use tcp and/or tls -> thus should be easy to "policy-debug" many thanks, L. Version-Release number of selected component (if applicable): selinux-policy-38.1.11-2.el9.noarch How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info: