Bug 968304
Summary: | Can't find the "detach" event for the auvirt command | ||||||
---|---|---|---|---|---|---|---|
Product: | Red Hat Enterprise Linux 6 | Reporter: | zhenfeng wang <zhwang> | ||||
Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
Status: | CLOSED WONTFIX | QA Contact: | BaseOS QE Security Team <qe-baseos-security> | ||||
Severity: | medium | Docs Contact: | |||||
Priority: | medium | ||||||
Version: | 6.8 | CC: | ajia, dwalsh, dyuan, eparis, gsun, mgrepl, mmalik, mzhan, sdsmall, zhwang | ||||
Target Milestone: | rc | ||||||
Target Release: | --- | ||||||
Hardware: | x86_64 | ||||||
OS: | Linux | ||||||
Whiteboard: | |||||||
Fixed In Version: | Doc Type: | Bug Fix | |||||
Doc Text: | Story Points: | --- | |||||
Clone Of: | 968303 | Environment: | |||||
Last Closed: | 2016-01-18 10:16:04 UTC | Type: | Bug | ||||
Regression: | --- | Mount Type: | --- | ||||
Documentation: | --- | CRM: | |||||
Verified Versions: | Category: | --- | |||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
Cloudforms Team: | --- | Target Upstream Version: | |||||
Embargoed: | |||||||
Attachments: |
|
Description
zhenfeng wang
2013-05-29 12:28:51 UTC
Does it work in permissive mode? Hi Miroslav it works well in the permissive mode # getenforce Permissive #virsh start rhelguest1 Domain rhelguest1 started #virsh attach rhelguest1 /var/lib/libvirt/images/test.img vdb Disk attached successfully #virsh detach rhelguest1 vdb Disk detached successfully check it in the audit.log # ausearch -m VIRT_RESOURCE |grep attach type=VIRT_RESOURCE msg=audit(1370241841.101:61930): user pid=5913 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=attach vm="rhelguest1" uuid=fcf773e6-6eba-4e72-8299-de0a38c89136 old-disk="?" new-disk="/var/lib/libvirt/images/test.img" exe=2F7573722F7362696E2F6C69627669727464202864656C6574656429 hostname=? addr=? terminal=? res=success' # ausearch -m VIRT_RESOURCE |grep detach type=VIRT_RESOURCE msg=audit(1370241865.492:61931): user pid=5913 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=detach vm="rhelguest1" uuid=fcf773e6-6eba-4e72-8299-de0a38c89136 old-disk="/var/lib/libvirt/images/test.img" new-disk="?" exe=2F7573722F7362696E2F6C69627669727464202864656C6574656429 hostname=? addr=? terminal=? res=success' Hi Miroslav Sorry to apply the wrong info in Comment 3, The ausearch can correctly query the info,However the auvirt can't still find the "detach" event, i should check the auvirt command # auvirt --all-events --start recent |grep disk res rhel7qcow2 root Wed May 29 14:06 - 14:07 (00:00) disk attach /var/lib/libvirt/images/test3.img Could you run # semodule -DB re-test it and # ausearch -m avc,user_avc |audit2allow # semodule -DB # virsh attach-disk rhelguest1 /var/lib/libvirt/images/aaa.img vdb Disk attached successfully # virsh detach-disk rhelguest1 vdb Disk detached successfully # ausearch -m avc,user_avc |audit2allow #============= semanage_t ============== allow semanage_t load_policy_t:process { siginh noatsecure rlimitinh }; allow semanage_t setfiles_t:process { siginh noatsecure rlimitinh }; #============= sshd_t ============== allow sshd_t chkpwd_t:process { siginh noatsecure rlimitinh }; Any chance to clear the audit.log and send me audit.log after re-test? Hi Miroslav Sorry to see it so late,here it isthe audit.log after i re-test # semodule -DB # virsh attach-disk rhelguest1 /var/lib/libvirt/images/aaa.img vdb Disk attached successfully # virsh detach-disk rhelguest1 vdb Disk detached successfully # ausearch -m avc,user_avc |audit2allow #============= semanage_t ============== allow semanage_t setfiles_t:process { siginh noatsecure rlimitinh }; #============= sysstat_t ============== allow sysstat_t admin_home_t:dir { getattr search }; Created attachment 774663 [details]
the audit.log
Do the kernel guys have any clue. No obvious AVC. How does it look? hi Miroslav I still couldn't find the "detach" event for the auvirt command pkginfo 1.# semodule -DB 2.# virsh attach-disk kdc /var/lib/libvirt/images/test3.img vdb Disk attached successfully 3.# virsh detach-disk kdc vdb Disk detached successfully 4.# auvirt --all-events --start recent |grep disk res kdc root Wed Mar 4 19:21 disk start /mnt/zhwang/img/rhel65.img res kdc root Wed Mar 4 19:21 - 19:21 (00:00) disk attach /var/lib/libvirt/images/test3.img 5.# ausearch -m avc,user_avc |audit2allow #============= chrome_sandbox_t ============== allow chrome_sandbox_t self:capability sys_nice; #!!!! This avc is allowed in the current policy allow chrome_sandbox_t unconfined_execmem_t:unix_stream_socket shutdown; #============= logrotate_t ============== allow logrotate_t mnt_t:dir read; #============= prelink_cron_system_t ============== allow prelink_cron_system_t mnt_t:dir read; #============= svirt_t ============== #!!!! This avc is allowed in the current policy allow svirt_t nfs_t:file open; allow svirt_t user_tmp_t:file open; #============= unconfined_java_t ============== #!!!! This avc is allowed in the current policy allow unconfined_java_t svirt_t:process transition; #============= xdm_t ============== #!!!! This avc can be allowed using the boolean 'allow_polyinstantiation' allow xdm_t admin_home_t:dir read; I don't see how these could be related. Could you provide me a test machine? Hi Miroslav didn't found any avc info this time and the detach event still couldn't show in the auvirt command pkginfo audit-2.3.7-5.el6.x86_64 qemu-kvm-rhev-0.12.1.2-2.479.el6_7.2.x86_64 kernel-2.6.32-573.el6.x86_64 selinux-policy-3.7.19-281.el6.noarch libvirt-0.10.2-55.el6.x86_64 steps # semodule -DB # virsh start rhel68 # virsh attach-disk rhel68 /var/lib/libvirt/images/test.img vdb Disk attached successfully # virsh detach-disk rhel68 vdb Disk detached successfully # auvirt --all-events --start recent |grep disk res rhel68 root Wed Nov 4 06:13 disk start /var/lib/libvirt/images/rhel67.img res rhel68 root Wed Nov 4 06:14 - 06:14 (00:00) disk attach /var/lib/libvirt/images/test.img # ausearch -m avc,user_avc |audit2allow <no matches> (In reply to zhenfeng wang from comment #21) > Hi Miroslav > didn't found any avc info this time and the detach event still couldn't show > in the auvirt command > > pkginfo > audit-2.3.7-5.el6.x86_64 > qemu-kvm-rhev-0.12.1.2-2.479.el6_7.2.x86_64 > kernel-2.6.32-573.el6.x86_64 > selinux-policy-3.7.19-281.el6.noarch > libvirt-0.10.2-55.el6.x86_64 > > steps > # semodule -DB > # virsh start rhel68 > # virsh attach-disk rhel68 /var/lib/libvirt/images/test.img vdb > Disk attached successfully > > # virsh detach-disk rhel68 vdb > Disk detached successfully > > # auvirt --all-events --start recent |grep disk > res rhel68 root Wed Nov 4 06:13 > disk start /var/lib/libvirt/images/rhel67.img > res rhel68 root Wed Nov 4 06:14 - 06:14 > (00:00) disk attach /var/lib/libvirt/images/test.img > # ausearch -m avc,user_avc |audit2allow > <no matches> Ok and this is also in permissive? I mean no AVCs. There needs to be some another AVCs. yes, this is also in permissive (In reply to zhenfeng wang from comment #23) > yes, this is also in permissive Ok, can we get an access again to work on it? Thank you. Development Management has reviewed and declined this request. You may appeal this decision by reopening this request. Hi Miroslav This bug clone from bug 968303 from RHEL7 and the bug 968303 has been moved to 'audit' component in RHEL7, so can we also move this bug to 'audit' component in RHEL6 to continue to track it? |