Bug 2187290

Summary: enhancement request - pacemaker + virt + virsh
Product: Red Hat Enterprise Linux 9 Reporter: lejeczek <peljasz>
Component: selinux-policyAssignee: Nobody <nobody>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: urgent Docs Contact:
Priority: medium    
Version: CentOS StreamCC: bstinson, jwboyer, lvrabec, mmalik, zpytela
Target Milestone: rcKeywords: Triaged
Target Release: ---Flags: pm-rhel: mirror+
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-38.1.13-1.el9 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-11-07 08:52:21 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2023-05-16   

Description lejeczek 2023-04-17 11:44:44 UTC
Description of problem:

Hi.
I see some denials which result in:

module my-virsh-pacemaker 1.0;

require {
	type virt_port_t;
	type cluster_var_lib_t;
	type virsh_t;
	class file write;
	class tcp_socket name_connect;
}

#============= virsh_t ==============
allow virsh_t cluster_var_lib_t:file write;
allow virsh_t virt_port_t:tcp_socket name_connect;

I think it would be good to have, if not in default policies then perhaps with the help of boolean(s) to allow these.
Maybe even more as these come from pacemaker use ocf_heartbeat_VirtualDomain - which would be a common/popular env I'd imagine - when set to use tcp and/or tls -> thus should be easy to "policy-debug"

many thanks, L.

Version-Release number of selected component (if applicable):

selinux-policy-38.1.11-2.el9.noarch

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Nikola Knazekova 2023-04-18 18:51:50 UTC
Hi lejeczek,

can you please attach audit logs?

# ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today

Thank you
Nikola

Comment 2 lejeczek 2023-04-19 07:26:29 UTC
Yes I can but I'd have to revert back to "broken" setup, which would be costly.

I'd suggest to get the authors/devel of pcs/pacemaker involved - no better way then go to the source - and ask them to use plain-vanilla Centos 9 to run VirtualDomain _live_ migration (move) with tls & with tcp (it does not appear to be an issue with ssh)

This issue does not seem to occur with libvirtd alone, virsh migrates okey, seems to pertain pcs/pacemaker specifically.

Comment 3 lejeczek 2023-04-19 08:06:43 UTC
-> $ ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts 9:40
----
type=PROCTITLE msg=audit(19/04/23 09:57:49.713:60379) : proctitle=virsh --connect=qemu:///system --quiet migrate --live --unsafe orum2 qemu+tls://swir.serv.internal/system 
type=SYSCALL msg=audit(19/04/23 09:57:49.713:60379) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x7 a1=0x55f35b5c1560 a2=0x10 a3=0x7fff95fd4724 items=0 ppid=3696697 pid=3696741 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=virsh exe=/usr/bin/virsh subj=system_u:system_r:virsh_t:s0 key=(null) 
type=AVC msg=audit(19/04/23 09:57:49.713:60379) : avc:  denied  { name_connect } for  pid=3696741 comm=virsh dest=16514 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virt_port_t:s0 tclass=tcp_socket permissive=0 

Additional Information:
Source Context                system_u:system_r:virsh_t:s0
Target Context                system_u:object_r:virt_port_t:s0
Target Objects                port 16514 [ tcp_socket ]
Source                        virsh
Source Path                   /usr/bin/virsh
Port                          16514
Host                          whale.mine.priv
Source RPM Packages           libvirt-client-9.0.0-7.el9.x86_64
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-38.1.11-2.el9.noarch
Local Policy RPM              selinux-policy-targeted-38.1.11-2.el9.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     whale.mine.priv
Platform                      Linux whale.mine.priv 5.14.0-299.el9.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Thu Apr 13 10:08:03 UTC 2023
                              x86_64 x86_64
Alert Count                   1
First Seen                    2023-04-19 09:57:49 CEST
Last Seen                     2023-04-19 09:57:49 CEST
Local ID                      6aa6e73e-04c4-4d9a-a8ec-a6aa407cab39

Raw Audit Messages
type=AVC msg=audit(1681891069.713:60379): avc:  denied  { name_connect } for  pid=3696741 comm="virsh" dest=16514 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virt_port_t:s0 tclass=tcp_socket permissive=0


type=SYSCALL msg=audit(1681891069.713:60379): arch=x86_64 syscall=connect success=no exit=EACCES a0=7 a1=55f35b5c1560 a2=10 a3=7fff95fd4724 items=0 ppid=3696697 pid=3696741 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=virsh exe=/usr/bin/virsh subj=system_u:system_r:virsh_t:s0 key=(null)

Hash: virsh,virsh_t,virt_port_t,tcp_socket,name_connect

Comment 4 Milos Malik 2023-04-21 09:35:03 UTC
Caught in enforcing mode:
----
type=PROCTITLE msg=audit(04/21/2023 11:23:45.290:1809) : proctitle=virsh --connect=qemu+tls:///system 
type=SOCKADDR msg=audit(04/21/2023 11:23:45.290:1809) : saddr={ saddr_fam=inet laddr=127.0.0.1 lport=16514 } 
type=SYSCALL msg=audit(04/21/2023 11:23:45.290:1809) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x5 a1=0x5562b908cee0 a2=0x10 a3=0x7fff1ca8f744 items=0 ppid=5763 pid=46373 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=6 comm=virsh exe=/usr/bin/virsh subj=system_u:system_r:virsh_t:s0 key=(null) 
type=AVC msg=audit(04/21/2023 11:23:45.290:1809) : avc:  denied  { name_connect } for  pid=46373 comm=virsh dest=16514 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virt_port_t:s0 tclass=tcp_socket permissive=0 
----

Caught in permissive mode:
----
type=PROCTITLE msg=audit(04/21/2023 11:25:44.608:2015) : proctitle=virsh --connect=qemu+tls:///system 
type=SOCKADDR msg=audit(04/21/2023 11:25:44.608:2015) : saddr={ saddr_fam=inet laddr=127.0.0.1 lport=16514 } 
type=SYSCALL msg=audit(04/21/2023 11:25:44.608:2015) : arch=x86_64 syscall=connect success=no exit=ECONNREFUSED(Connection refused) a0=0x5 a1=0x5599f95625a0 a2=0x10 a3=0x7fff0d76e524 items=0 ppid=5763 pid=47879 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=6 comm=virsh exe=/usr/bin/virsh subj=system_u:system_r:virsh_t:s0 key=(null) 
type=AVC msg=audit(04/21/2023 11:25:44.608:2015) : avc:  denied  { name_connect } for  pid=47879 comm=virsh dest=16514 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virt_port_t:s0 tclass=tcp_socket permissive=1 
----

The reproducer I used:

# runcon system_u:system_r:initrc_t:s0 bash -c 'virsh --connect=qemu+tls:///system'

Comment 16 errata-xmlrpc 2023-11-07 08:52:21 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6617