Bug 593739
| Summary: | Need to set socket context before connecting to QEMU monitor for SELinux MLS policy | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Daniel Berrangé <berrange> | ||||||
| Component: | libvirt | Assignee: | Daniel Berrangé <berrange> | ||||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Virtualization Bugs <virt-bugs> | ||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | low | ||||||||
| Version: | 6.0 | CC: | dallan, dwalsh, hbrock, jyang, mjenner, xen-maint | ||||||
| Target Milestone: | rc | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | libvirt-0_8_1-8_el6 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2010-11-11 14:48:25 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux major release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Major release. This request is not yet committed for inclusion. Created attachment 415168 [details]
Set socket context before connecting to monitor
Created attachment 415373 [details]
Set socket context before connecting to monitor
libvirt-0_8_1-8_el6 has been built in RHEL-6-candidate with the fix. Dave [root@dhcp-66-65-163 SOURCES]# ps -efZ | grep libvirtd | grep -v grep unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 root 15716 1 0 18:56 ? 00:00:02 libvirtd --daemon [root@dhcp-66-65-163 SOURCES]# ps -efZ | grep toy-f1 unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 16546 13872 0 19:56 pts/1 00:00:00 grep toy-f1 system_u:system_r:svirt_t:s0:c431,c903 qemu 24011 1 1 Jun28 ? 04:45:53 /usr/libexec/qemu-kvm -S -M rhel6.0.0 -enable-kvm -m 1024 -smp 1,sockets=1,cores=1,threads=1 -name toy-f1 -uuid f9debf17-b8b5-a889-ec3f-47a0f5f723ae -nodefaults -chardev socket,id=monitor,path=/var/lib/libvirt/qemu/toy-f1.monitor,server,nowait -mon chardev=monitor,mode=control -rtc base=utc -boot c -drive file=/var/lib/libvirt/migrate/toy.img,if=none,id=drive-ide0-0-0,boot=on,format=raw -device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0 -netdev tap,fd=21,id=hostnet0 -device rtl8139,netdev=hostnet0,id=net0,mac=52:54:00:61:92:bc,bus=pci.0,addr=0x4 -chardev pty,id=serial0 -device isa-serial,chardev=serial0 -usb -vnc 127.0.0.1:3 -k en-us -vga cirrus -device AC97,id=sound0,bus=pci.0,addr=0x5 -device ES1370,id=sound1,bus=pci.0,addr=0x6 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3 [root@dhcp-66-65-163 SOURCES]# ls /var/lib/libvirt/qemu/toy-f1.monitor -lZ srwxr-xr-x. qemu qemu system_u:object_r:svirt_var_run_t:s0:c431,c903 /var/lib/libvirt/qemu/toy-f1.monitor as we can see the MLS portion of the Unix domain socket of monitor is same as the process of running the guest. verified. - Osier Red Hat Enterprise Linux 6.0 is now available and should resolve the problem described in this bug report. This report is therefore being closed with a resolution of CURRENTRELEASE. You may reopen this bug report if the solution does not work for you. |
Description of problem: The libvirtd daemon normally runs with a context like unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 In an MLS environment a guest might run with a context system_u:system_r:svirt_t:s0:c1 When connecting to the QEMU monitor, the libvirtd end of the UNIX domain socket currently inherits libvirt's labelling virtd_t:s0-s0:c0.c1023 whereas it needs to get a context matching the MLS level of the guest. To achieve this, libvirt needs to do some extra magic: setsockcreatecon("system_u:system_r:virtd_t:[MLS PORTION]"); connect to KVM/QEMU setsockcreatecon(""); Version-Release number of selected component (if applicable): 0.8.1-1.el6 How reproducible: Steps to Reproduce: 1. Unknown 2. 3. Actual results: Expected results: Additional info: