Bug 1062384

Tried to reproduce this issue.

host info:
# uname -r && rpm -q qemu-kvm
2.6.32-425.el6.x86_64
qemu-kvm-0.12.1.2-2.420.el6.x86_64
guest info:
2.6.32-425.el6.x86_64
qemu-guest-agent-0.12.1.2-2.420.el6.x86_64

Steps:
1.boot guest with virt-agent server.
e.:/usr/libexec/qemu-kvm...-device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x7 -chardev socket,id=channel1,path=/tmp/helloworld1,server,nowait -device virtserialport,chardev=channel1,name=org.qemu.guest_agent.0,bus=virtio-serial0.0,id=port1,nr=1

2.connect to the guest via guest-agent.
# nc -U /tmp/helloworld1

3.execute "guest-set-time" command to settimeofday.
{ "execute": "guest-set-time", "arguments":{"time":1}} 

Results:
after step 3, fail to execute the "guest-set-time" command when SELinux Enforcing.

#####SELinux Enforcing: 
guest]# setenforce 1
guest]# getenforce 
Enforcing
{ "execute": "guest-set-time", "arguments":{"time":1}}
{"error": {"class": "GenericError", "desc": "Failed to set time to guest: Operation not permitted", "data": {"message": "Failed to set time to guest: Operation not permitted"}}}

guest]# grep qemu-ga /var/log/audit/audit.log
type=AVC msg=audit(50.734:101): avc:  denied  { sys_time } for  pid=2521 comm="qemu-ga" capability=25  scontext=unconfined_u:system_r:virt_qemu_ga_t:s0 tcontext=unconfined_u:system_r:virt_qemu_ga_t:s0 tclass=capability
type=SYSCALL msg=audit(50.734:101): arch=c000003e syscall=164 success=no exit=-1 a0=7ffff3028570 a1=0 a2=0 a3=aaaaaaab items=0 ppid=1 pid=2521 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="qemu-ga" exe="/usr/bin/qemu-ga" subj=unconfined_u:system_r:virt_qemu_ga_t:s0 key=(null)

#####SELinux Permissive: 
guest]# setenforce 0
guest]# getenforce
Permissive

{ "execute": "guest-set-time", "arguments":{"time":1}}
{"return": {}}

guest]# grep qemu-ga /var/log/audit/audit.log
type=AVC msg=audit(50.734:101): avc:  denied  { sys_time } for  pid=2521 comm="qemu-ga" capability=25  scontext=unconfined_u:system_r:virt_qemu_ga_t:s0 tcontext=unconfined_u:system_r:virt_qemu_ga_t:s0 tclass=capability
type=SYSCALL msg=audit(50.734:101): arch=c000003e syscall=164 success=no exit=-1 a0=7ffff3028570 a1=0 a2=0 a3=aaaaaaab items=0 ppid=1 pid=2521 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="qemu-ga" exe="/usr/bin/qemu-ga" subj=unconfined_u:system_r:virt_qemu_ga_t:s0 key=(null)
type=AVC msg=audit(71.530:103): avc:  denied  { sys_time } for  pid=2521 comm="qemu-ga" capability=25  scontext=unconfined_u:system_r:virt_qemu_ga_t:s0 tcontext=unconfined_u:system_r:virt_qemu_ga_t:s0 tclass=capability
type=SYSCALL msg=audit(71.530:103): arch=c000003e syscall=164 success=yes exit=0 a0=7ffff3028570 a1=0 a2=0 a3=aaaaaaab items=0 ppid=1 pid=2521 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="qemu-ga" exe="/usr/bin/qemu-ga" subj=unconfined_u:system_r:virt_qemu_ga_t:s0 key=(null)
type=AVC msg=audit(0.000:104): avc:  denied  { execute } for  pid=2613 comm="qemu-ga" name="hwclock" dev=dm-0 ino=21070 scontext=unconfined_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:hwclock_exec_t:s0 tclass=file
type=AVC msg=audit(0.000:104): avc:  denied  { read open } for  pid=2613 comm="qemu-ga" name="hwclock" dev=dm-0 ino=21070 scontext=unconfined_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:hwclock_exec_t:s0 tclass=file
type=AVC msg=audit(0.000:104): avc:  denied  { execute_no_trans } for  pid=2613 comm="qemu-ga" path="/sbin/hwclock" dev=dm-0 ino=21070 scontext=unconfined_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:hwclock_exec_t:s0 tclass=file

Base on above, mark qa_ack+ to it.

Best Regards,
sluo

(In reply to Sibiao Luo from comment #3)
> Tried to reproduce this issue.
> 
> host info:
> # uname -r && rpm -q qemu-kvm
> 2.6.32-425.el6.x86_64
> qemu-kvm-0.12.1.2-2.420.el6.x86_64
> guest info:
> 2.6.32-425.el6.x86_64
> qemu-guest-agent-0.12.1.2-2.420.el6.x86_64
selinux version:
selinux-policy-3.7.19-224.el6.noarch

Update: in order to allow the extended "guest-set-time" qemu-guest-agent
command to work (see dependent bug 1066191), the following AVCs should be
addressed:

- SELinux is preventing /usr/bin/qemu-ga from execute access on the file
  hwclock.
- SELinux is preventing /sbin/hwclock from create access on the
  netlink_audit_socket .
- SELinux is preventing /sbin/hwclock from read access on the file adjtime.
- SELinux is preventing /sbin/hwclock from read access on the chr_file rtc0.
- SELinux is preventing /sbin/hwclock from getattr access on the file
  /etc/adjtime.
- SELinux is preventing /sbin/hwclock from ioctl access on the chr_file
  /dev/rtc0.
- SELinux is preventing /sbin/hwclock from using the sys_time capability.
- SELinux is preventing /sbin/hwclock from nlmsg_relay access on the
  netlink_audit_socket .

Thanks!

Created attachment 882395 [details]
AVCs for comment 6

clock_domtrans(virt_qemu_ga_t)

Will probably solve the problem.

Could you try to install this policy and see if it fixes your AVC's

policy_module(myvirt, 1.0)
gen_require(`
type virt_qemu_ga_t;
')
clock_domtrans(virt_qemu_ga_t)


If this fixes the problem, then we need to decide if we want to allow this by default or add a boolean.

In the guest:
- Stored the above file contents (from comment 8) in "myvirt.te".
- Issued "make -f /usr/share/selinux/devel/Makefile myvirt.pp"
- Issued "semodule -i myvirt.pp".

In the host:
- Issued (from blocked bug 1066191 comment 3):

    virsh qemu-agent-command seabios.rhel6 --block \
        '{"execute":"guest-set-time"}'

  and it worked:

    {"return":{}}

Thanks.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1568.html