Bug 959639

There was a bug in file transition rules.

commit 2fcfe26b060dab4f006bdfb67ee3771e3c315a51
Author: Miroslav Grepl <mgrepl>
Date:   Mon May 6 09:31:22 2013 +0200

    Allow qemu-ga to create files in /run with proper labeling

A problem persists in Fedora 19 Beta TC4:

[root@fedora19 ~]# ausearch --message AVC --start today
----
time->Mon May 13 02:19:27 2013
type=SYSCALL msg=audit(1368429567.622:20): arch=c000003e syscall=254 success=no exit=-13 a0=8 a1=7f9c66c754f0 a2=380 a3=0 items=0 ppid=1 pid=497 auid=4294967295 uid=999 gid=999 euid=999 suid=999 fsuid=999 egid=999 sgid=999 fsgid=999 ses=4294967295 tty=(none) comm="polkitd" exe="/usr/lib/polkit-1/polkitd" subj=system_u:system_r:policykit_t:s0 key=(null)
type=AVC msg=audit(1368429567.622:20): avc:  denied  { read } for  pid=497 comm="polkitd" name="machine" dev="cgroup" ino=1327 scontext=system_u:system_r:policykit_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir
----
time->Mon May 13 02:20:40 2013
type=SYSCALL msg=audit(1368429640.032:37): arch=c000003e syscall=254 success=no exit=-13 a0=8 a1=7faa6648b5d0 a2=380 a3=7faa6648c450 items=0 ppid=1 pid=489 auid=4294967295 uid=999 gid=999 euid=999 suid=999 fsuid=999 egid=999 sgid=999 fsgid=999 ses=4294967295 tty=(none) comm="polkitd" exe="/usr/lib/polkit-1/polkitd" subj=system_u:system_r:policykit_t:s0 key=(null)
type=AVC msg=audit(1368429640.032:37): avc:  denied  { read } for  pid=489 comm="polkitd" name="machine" dev="cgroup" ino=1329 scontext=system_u:system_r:policykit_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir
----
time->Mon May 13 02:22:09 2013
type=SYSCALL msg=audit(1368429729.201:427): arch=c000003e syscall=59 success=no exit=-13 a0=7f603213bb9f a1=7fff592bf840 a2=7fff592c3098 a3=7f60320f5a10 items=0 ppid=387 pid=1240 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="qemu-ga" exe="/usr/bin/qemu-ga" subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null)
type=AVC msg=audit(1368429729.201:427): avc:  denied  { execute } for  pid=1240 comm="qemu-ga" name="systemctl" dev="dm-1" ino=663719 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file

[root@fedora19 ~]#

These are different. policykit_t issue has been fixed.

Could you please run

# semanage permissive -a virt_qemu_ga_t

re-test it and

# ausearch -m avc -ts recent

polkitd_t avc's are allowed in selinux-policy-3.12.1-43.fc19

Any idea what qemu-ga is doing executing systemctl?

[root@fedora19 ~]# yum list installed selinux-policy*
Loaded plugins: langpacks, refresh-packagekit
Installed Packages
selinux-policy.noarch                      3.12.1-42.fc19              @anaconda
selinux-policy-devel.noarch                3.12.1-42.fc19              @anaconda
selinux-policy-doc.noarch                  3.12.1-42.fc19              @anaconda
selinux-policy-targeted.noarch             3.12.1-42.fc19              @anaconda

[root@fedora19 ~]# ausearch --message AVC --start recent
----
time->Mon May 13 09:22:07 2013
type=SYSCALL msg=audit(1368454927.964:35): arch=c000003e syscall=254 success=no exit=-13 a0=8 a1=7fd8b0e32200 a2=380 a3=0 items=0 ppid=1 pid=493 auid=4294967295 uid=999 gid=999 euid=999 suid=999 fsuid=999 egid=999 sgid=999 fsgid=999 ses=4294967295 tty=(none) comm="polkitd" exe="/usr/lib/polkit-1/polkitd" subj=system_u:system_r:policykit_t:s0 key=(null)
type=AVC msg=audit(1368454927.964:35): avc:  denied  { read } for  pid=493 comm="polkitd" name="machine" dev="cgroup" ino=1345 scontext=system_u:system_r:policykit_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir
----
time->Mon May 13 09:22:36 2013
type=SYSCALL msg=audit(1368454956.503:423): arch=c000003e syscall=4 success=yes exit=0 a0=7faa06a8c8e8 a1=7fffc9ee63c0 a2=7fffc9ee63c0 a3=0 items=0 ppid=387 pid=1230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="shutdown" exe="/usr/bin/systemctl" subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null)
type=AVC msg=audit(1368454956.503:423): avc:  denied  { read } for  pid=1230 comm="shutdown" scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file
type=AVC msg=audit(1368454956.503:423): avc:  denied  { read } for  pid=1230 comm="shutdown" name="root" dev="proc" ino=1156 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=lnk_file
----
time->Mon May 13 09:22:36 2013
type=SYSCALL msg=audit(1368454956.497:422): arch=c000003e syscall=59 success=yes exit=0 a0=7f08e00f6b9f a1=7fffbab0d160 a2=7fffbab109b8 a3=7f08e00b0a10 items=0 ppid=387 pid=1230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="shutdown" exe="/usr/bin/systemctl" subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null)
type=AVC msg=audit(1368454956.497:422): avc:  denied  { execute_no_trans } for  pid=1230 comm="qemu-ga" path="/usr/bin/systemctl" dev="dm-1" ino=663719 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file
type=AVC msg=audit(1368454956.497:422): avc:  denied  { read open } for  pid=1230 comm="qemu-ga" path="/usr/bin/systemctl" dev="dm-1" ino=663719 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file
type=AVC msg=audit(1368454956.497:422): avc:  denied  { execute } for  pid=1230 comm="qemu-ga" name="systemctl" dev="dm-1" ino=663719 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file
----
time->Mon May 13 09:22:36 2013
type=SYSCALL msg=audit(1368454956.504:424): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7fffc9ee61b0 a2=16 a3=7fffc9ee5f60 items=0 ppid=387 pid=1230 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="shutdown" exe="/usr/bin/systemctl" subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null)
type=AVC msg=audit(1368454956.504:424): avc:  denied  { connectto } for  pid=1230 comm="shutdown" path="/run/systemd/private" scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket
----
time->Mon May 13 09:23:07 2013
type=SYSCALL msg=audit(1368454987.502:19): arch=c000003e syscall=254 success=no exit=-13 a0=8 a1=7f2d155024f0 a2=380 a3=0 items=0 ppid=1 pid=499 auid=4294967295 uid=999 gid=999 euid=999 suid=999 fsuid=999 egid=999 sgid=999 fsgid=999 ses=4294967295 tty=(none) comm="polkitd" exe="/usr/lib/polkit-1/polkitd" subj=system_u:system_r:policykit_t:s0 key=(null)
type=AVC msg=audit(1368454987.502:19): avc:  denied  { read } for  pid=499 comm="polkitd" name="machine" dev="cgroup" ino=6660 scontext=system_u:system_r:policykit_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir

[root@fedora19 ~]#

qemu-guest-agent still has problems with Fedora 19 Beta TC4:

[root@ipa ~]# yum list installed selinux-policy*
Loaded plugins: langpacks, refresh-packagekit
Installed Packages
selinux-policy.noarch                   3.12.1-44.fc19          @updates-testing
selinux-policy-devel.noarch             3.12.1-44.fc19          @updates-testing
selinux-policy-doc.noarch               3.12.1-44.fc19          @updates-testing
selinux-policy-targeted.noarch          3.12.1-44.fc19          @updates-testing

[root@ipa ~]# ausearch --message avc --start today
----
time->Tue May 14 11:34:32 2013
type=AVC msg=audit(1368549272.764:5): avc:  denied  { getattr } for  pid=387 comm="qemu-ga" name="/" dev="tmpfs" ino=1147 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem
----
time->Tue May 14 11:51:18 2013
type=SYSCALL msg=audit(1368550278.154:449): arch=c000003e syscall=59 success=no exit=-13 a0=7ff0c1baeb9f a1=7fffc2019e60 a2=7fffc201d6b8 a3=7ff0c1b68a10 items=0 ppid=387 pid=1638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="qemu-ga" exe="/usr/bin/qemu-ga" subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null)
type=AVC msg=audit(1368550278.154:449): avc:  denied  { execute } for  pid=1638 comm="qemu-ga" name="systemctl" dev="dm-1" ino=140673 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file

[root@ipa ~]# 

The first alert is from about the time the virtual machine was built and restarted. The second alert is from when I tried to shut down the virtual machine.

Ok, going to add fixes.

Have you identified a version of selinix-policy when this will be fixed?

The problem persists in Fedora 19 Beta RC3.

Has been fixed in -45.fc19.

http://koji.fedoraproject.org/koji/buildinfo?buildID=419810

selinux-policy-3.12.1-47.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-47.fc19

Package selinux-policy-3.12.1-47.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-47.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-9565/selinux-policy-3.12.1-47.fc19
then log in and leave karma (feedback).

selinux-policy-3.12.1-47.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.