Bug 968303

Any AVC messages?

Hi Miroslav
sorry to don't find any AVC messages in the audit.log

Are you still getting this issue?

Hi Miroslav
I'm so sorry to reply you so late , since i miss your needinfo before, i just re-test the comment0's steps with my latest environment, find that i can still hit this issue, and i found that it'll generate a deny event while i check the audit log with auvirt command after i detach the disk. I miss this event previous, I hope you help me have a look, thanks. BTW, since i can still reproduce this issue, so i think that we'd better re-open this bug, right ?

pkg info
qemu-kvm-rhev-1.5.3-47.el7.x86_64
libvirt-1.1.1-23.el7.x86_64
kernel-3.10.0-87.el7.x86_64
selinux-policy-3.12.1-125.el7.noarch
libselinux-2.2.2-5.el7.x86_64

steps
1. prepare a running guest
virsh list
 Id    Name                           State
----------------------------------------------------
 2     rhel75                       running

2.create a img
# qemu-img create -f qcow2 /var/lib/libvirt/images/test.img 1G
Formatting '/var/lib/libvirt/images/test.img', fmt=qcow2 size=1073741824 encryption=off cluster_size=65536 lazy_refcounts=off
3.attach the disk, then detach it
# virsh attach-disk rhel7qcow2 /var/lib/libvirt/images/test.img vdb
Disk attached successfully

# virsh detach-disk rhel75 vdb
Disk detached successfully

4.check the audit log with ausearch, both the "attach" event and "detach"event can be found with ausearch command, Meanwhile i also find a deny log afer i detach the disk

# ausearch -m VIRT_RESOURCE --start recent 
time->Wed Feb 19 18:59:18 2014
type=VIRT_RESOURCE msg=audit(1392807558.592:8018): pid=5234 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=attach vm="rhel75" uuid=4f43c3bd-249c-428e-8a67-f55f95916b1d old-disk="?" new-disk="/var/lib/libvirt/images/test.img" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
----
time->Wed Feb 19 18:59:50 2014
type=VIRT_RESOURCE msg=audit(1392807590.744:8036): pid=5234 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=detach vm="rhel75" uuid=4f43c3bd-249c-428e-8a67-f55f95916b1d old-disk="/var/lib/libvirt/images/test.img" new-disk="?" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
----
time->Wed Feb 19 18:59:50 2014
type=VIRT_RESOURCE msg=audit(1392807590.745:8037): pid=5234 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup reason=deny vm="rhel75" uuid=4f43c3bd-249c-428e-8a67-f55f95916b1d cgroup="/sys/fs/cgroup/devices/machine.slice/machine-qemu\x2drhel75.scope/" class=path path="/var/lib/libvirt/images/test.img" rdev=? acl=rwm exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'


5.check the audit log with auvirt again, we can just see the "attach" event ,can't find the "detach" event, however, find a deny event after i did the detach operation 

# auvirt --all-events --start recent
res   rhel75                   	root       	Wed Feb 19 18:42 - 18:42  (00:00)  	disk        	attach    	/var/lib/libvirt/images/test.img
res   rhel75                   	root       	Wed Feb 19 18:42                   	cgroup      	deny      	path	rwm	/var/lib/libvirt/images/test.img


6.Didn't find any avc during i test the upper steps

Re-try the comment5's operation with the latest env, still hit the issue, so re-open this bug 

pkg info
libvirt-1.1.1-29.el7.x86_64
qemu-kvm-rhev-1.5.3-59.el7ev.x86_64
kernel-3.10.0-115.el7.x86_64
selinux-policy-3.12.1-148.el7.noarch

1. Does it work in permissive mode?

# setenforce 0

2. If yes, please re-test it with

# semodule -DB
# ausearch -m avc,user_avc -ts recent
# grep invalid /var/log/messages

Hi Miroslav
it didn't work in permissive mode and i got the same result with testing in enforcing mode as comment5 description

If it does not work in permissive mode then it is not SELinux issue.

Err the detach event is right there in the logs you quoted. see reason=detach here

time->Wed Feb 19 18:59:50 2014
type=VIRT_RESOURCE msg=audit(1392807590.744:8036): pid=5234 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=detach vm="rhel75" uuid=4f43c3bd-249c-428e-8a67-f55f95916b1d old-disk="/var/lib/libvirt/images/test.img" new-disk="?" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'

Libvirt correctly logs the event, no idea why auvirt doesn't show it.

This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.

What it looks like it does is finds the attach record, update the time, and add a proof. This way it gives you the time usage of a resource. So, I don't think it was meant to issue a detach just like there are no stop events for resources. I'll compare this with aulast to see how it handles sessions. I don't think you get logout events. 

Perhaps removing the whole reason column is the answer?

I'm going to close this as an explained condition. If anyone has questions, please let me know.