Bug 517619
| Summary: | libvirtd should chown dirs when qemu configured to run as root/root | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Tim Waugh <twaugh> | ||||
| Component: | libvirt | Assignee: | Daniel Berrangé <berrange> | ||||
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | rawhide | CC: | berrange, clalance, crobinso, dwalsh, eparis, itamar, markmc, mgrepl, veillard, virt-maint | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2009-09-15 10:44:54 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 498968 | ||||||
| Attachments: |
|
||||||
|
Description
Tim Waugh
2009-08-15 09:00:05 UTC
Actually even with the default qemu.conf I get these same AVC messages. The boot screen appears but it fails to read the boot disk (a qemu:qemu owned file with virt_content_t label). Okay, here's what I can reproduce:
1) change /etc/libvirt/qemu.conf to user=root/group=root and restart libvirtd
now guests fail to start with the "could not open monitor device" error
because the qemu process is failing to transition to svirt_t as the AVC
shows
2) change it back to user=qemu/group=qemu and restart libvirtd
now guests appear to work fine, the process is running as qemu and
transitioning correctly, but the AVCs still appear when starting a guest
4) leave it as user=qemu/group=qemu and reboot
now everything is fine again with no AVCs
I think the confusion here is because it is not sufficient to merely change the user/group to root/root in the config file. The directory permissions will not allow QEMU to create its monitor socket, since even with the user set to root/root, the QEMU instance is still unprivileged, so can only access files which are explicitly owned by root. ie it lacks CAP_DAC_OVERRIDE. So you'd also need to at least chown /var/run/libvirt/qemu to root:root IIRC. I cant explain the failure to transition SElinux domains though - that shouldn't be at all related to the QEMU process' UID/GID. We certainly need to document this better - the config file is misleading in suggesting you can simply change the user/group and nothing else dwalsh: any idea what's causing the transition AVCs ? Confirm that chowning the dirs to root:root is enough to make things work (modulo these weird transition AVCs) We're going to make libvirtd do this chowning automatically, see: http://www.redhat.com/archives/libvir-list/2009-August/msg00402.html I recently changed all unconfined_domains to permissive domains to see what AVC's are around if you removed the unconfined policy package. In Fedora 11 libvirt is running as an unconfined_domain. If you look closely at the AVC, you will see success=yes, which means the kernel did not block anything. Setroubleshoot should tell you this. The AVC is because you have unconfined_u:system_r:virtd_t:s0-s0;c0.c1023 system_u:system_r:svirt_t:s0:c224,c1013 So the problem is a missing rule to allow libvirt to change the user of a process it is executing. Theoretically libvirt should have only changed the type and MLS/MCS portion of the context, But since it changed the user component I also need to allow this in policy. Fixed in selinux-policy-3.6.28-2.fc12.noarch Thanks dwalsh That just leaves the dir chowning issue Thanks dwalsh That just leaves the dir chowning issue Created attachment 358599 [details]
Fix chowning of directories
This patch addresses several problems
- If chown's the /var/{lib,cache}/libvirt/qemu directories to match the configured qemu user/group
- It sets /var/run/libvirt/qemu to always be root:root, since that contains security critical data that should not be writable by the guest
- It moves the monitor socket out of /var/run and into /var/lib due to previous point
- Fixes memory leak of monitor device data
- Removes the monitor device at shutdown
Split up and posted upstream http://www.redhat.com/archives/libvir-list/2009-August/msg00482.html We now correctly chown directories and this is in rawhide http://libvirt.org/git/?p=libvirt.git;a=commit;h=2a6825c393157fe476763565e94451bf78ccca8f |