RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1075870 - cimserver is blocked by selinux
Summary: cimserver is blocked by selinux
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.0
Hardware: x86_64
OS: Linux
medium
high
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks: 1152104
TreeView+ depends on / blocked
 
Reported: 2014-03-13 05:14 UTC by Jincheng Miao
Modified: 2015-03-05 10:38 UTC (History)
8 users (show)

Fixed In Version: selinux-policy-3.13.1-21.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1152104 (view as bug list)
Environment:
Last Closed: 2015-03-05 10:38:02 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:0458 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2015-03-05 15:17:00 UTC

Description Jincheng Miao 2014-03-13 05:14:59 UTC 
Description of problem:

The getattr operation of tog-pegasus to qemu image is blocked by selinux.
And selinux will block sfcb to name_bind. 

Version-Release number of selected component (if applicable):
selinux-policy-3.12.1-135.el7.noarch
libvirt-cim-0.6.3-6.el7.x86_64
tog-pegasus-2.12.1-16.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
1. run cimtest script 03_defineVS.py of ComputerSystem group

# CIM_NS=root/virt CIM_USER=root CIM_PASS=password ./runtests libvirt-cim -v KVM localhost -g ComputerSystem -t 03_defineVS.py
Starting test suite: libvirt-cim

Testing KVM hypervisor
--------------------------------------------------------------------
ComputerSystem - 03_defineVS.py: FAIL
ERROR         - Got CIM error CIM_ERR_FAILED: ResourceSettings Error: Can't get a valid disk type, Device vda, Address /var/lib/libvirt/images/default-kvm-dimage, make sure Address can be accessed on host system. with return code 1
ERROR         - Failed to define a domain with the name domU1 from virsh
InvokeMethod(DefineSystem): CIM_ERR_FAILED: ResourceSettings Error: Can't get a valid disk type, Device vda, Address /var/lib/libvirt/images/default-kvm-dimage, make sure Address can be accessed on host system.
--------------------------------------------------------------------

2. check the audit.log
# tailf /var/log/audit/audit.log  | grep avc
type=AVC msg=audit(1394602219.138:11597): avc:  denied  { getattr } for  pid=5138 comm="cimprovagt" path="/var/lib/libvirt/images/default-kvm-dimage" dev="sda1" ino=69523305 scontext=system_u:system_r:pegasus_t:s0 tcontext=system_u:object_r:virt_image_t:s0 tclass=file

3. change the cimserver from tog-pegasus to sblim-sfcb, selinux will block sblim-sfcb bind 5988 port
# service sblim-sfcb start
# tailf /var/log/audit/audit.log  | grep avc
type=AVC msg=audit(1394602821.738:11662): avc:  denied  { name_bind } for  pid=5652 comm="sfcbd" src=5988 scontext=system_u:system_r:sblim_sfcbd_t:s0 tcontext=system_u:object_r:pegasus_http_port_t:s0 tclass=tcp_socket

This will make sfcb failed to listen 
Mar 12 13:44:34 localhost.localdomain sfcb[5901]: --- Cannot listen on port 5988 (Permission denied)
Mar 12 13:44:35 localhost.localdomain sfcbd[5900]: --- Winding down sfcbd
Mar 12 13:44:35 localhost.localdomain sfcbd[5900]: spGetMsg receiving from 0 5903-88 Socket operation on non-socket
Mar 12 13:44:35 localhost.localdomain sfcbd[5900]: rcvMsg receiving from 0 5903-88 Socket operation on non-socket
Mar 12 13:44:35 localhost.localdomain sfcbd[5900]: --- forkProvider failed in _methProvider ($ClassProvider$)
Mar 12 13:44:35 localhost.localdomain sfcbd[5900]: spSendMsg sending to 0 5904-88 Socket operation on non-socket

Mar 12 13:44:35 localhost.localdomain sfcb[5901]: spGetMsg receiving from 0 5903-88 Socket operation on non-socket
Mar 12 13:44:35 localhost.localdomain sfcb[5901]: rcvMsg receiving from 0 5903-88 Socket operation on non-socket
Mar 12 13:44:35 localhost.localdomain sfcb[5901]: --- forkProvider failed in _methProvider ($ClassProvider$)
Mar 12 13:44:35 localhost.localdomain sfcb[5901]: spSendMsg sending to 0 5904-88 Socket operation on non-socket

Additional info:
if disable selinux, the operations as above are passed.
Comment 1 Miroslav Grepl 2014-03-13 08:37:29 UTC 
Could you re-test it in permissive mode?
Comment 2 Jincheng Miao 2014-03-14 02:26:02 UTC 
(In reply to Miroslav Grepl from comment #1)
> Could you re-test it in permissive mode?

Yes, Miroslav, I had tested it in permissive mode, both cimservers could pass that cim test case, and sfcb also could name_bind.
Comment 3 Jincheng Miao 2014-03-14 02:57:30 UTC 
(In reply to Miroslav Grepl from comment #1)
> Could you re-test it in permissive mode?

(In reply to Jincheng Miao from comment #2)
> Yes, Miroslav, I had tested it in permissive mode, both cimservers could
> pass that cim test case, and sfcb also could name_bind.

Sorry, I just saw a new brew of selinux-policy from you, and these operations also are blocked.

# rpm -q selinux-policy
selinux-policy-3.12.1-137.el7.noarch

# getenforce 
Enforcing

# service tog-pegasus start
Redirecting to /bin/systemctl start  tog-pegasus.service

# CIM_NS=root/virt CIM_USER=root CIM_PASS=password ./runtests libvirt-cim -v KVM localhost -g ComputerSystem -t 03_defineVS.py
Starting test suite: libvirt-cim

Testing KVM hypervisor
--------------------------------------------------------------------
ComputerSystem - 03_defineVS.py: FAIL
ERROR 	- Got CIM error CIM_ERR_FAILED: ResourceSettings Error: Can't get a valid disk type, Device vda, Address /var/lib/libvirt/images/default-kvm-dimage, make sure Address can be accessed on host system. with return code 1
ERROR 	- Failed to define a domain with the name domU1 from virsh
InvokeMethod(DefineSystem): CIM_ERR_FAILED: ResourceSettings Error: Can't get a valid disk type, Device vda, Address /var/lib/libvirt/images/default-kvm-dimage, make sure Address can be accessed on host system.
--------------------------------------------------------------------


# cat /var/log/audit/audit.log | grep cimprovagt
type=AVC msg=audit(1394765258.481:155): avc:  denied  { getattr } for  pid=2527 comm="cimprovagt" path="/var/lib/libvirt/images/default-kvm-dimage" dev="sda1" ino=69523305 scontext=system_u:system_r:pegasus_t:s0 tcontext=system_u:object_r:virt_content_t:s0 tclass=file

# service tog-pegasus stop
Redirecting to /bin/systemctl stop  tog-pegasus.service

# service sblim-sfcb start
Redirecting to /bin/systemctl start  sblim-sfcb.service

# cat /var/log/audit/audit.log | grep sfcbd
type=AVC msg=audit(1394765426.071:183): avc:  denied  { name_bind } for  pid=3011 comm="sfcbd" src=5988 scontext=system_u:system_r:sblim_sfcbd_t:s0 tcontext=system_u:object_r:pegasus_http_port_t:s0 tclass=tcp_socket
Comment 5 Lukas Vrabec 2014-03-31 12:12:21 UTC 
commit 78a2f1ddc2d41a4db7abff5b4f4fd156e174a24b
Author: Lukas Vrabec <lvrabec>
Date:   Mon Mar 31 13:47:52 2014 +0200

    Allow pegasus to getattr virt_content
Comment 6 Miroslav Grepl 2014-03-31 12:15:41 UTC 
(In reply to Lukas Vrabec from comment #5)
> commit 78a2f1ddc2d41a4db7abff5b4f4fd156e174a24b
> Author: Lukas Vrabec <lvrabec>
> Date:   Mon Mar 31 13:47:52 2014 +0200
> 
>     Allow pegasus to getattr virt_content

Added only to F20.
Comment 10 Miroslav Grepl 2014-09-18 14:11:23 UTC 
#============= sblim_sfcbd_t ==============

#!!!! This avc is allowed in the current policy
allow sblim_sfcbd_t pegasus_https_port_t:tcp_socket name_bind;
Comment 14 Miroslav Grepl 2015-01-26 09:41:30 UTC 
commit 3658b93369f1ad5bcd20e9f5ff1bcc447ddb97f7
Author: Miroslav Grepl <mgrepl>
Date:   Mon Jan 26 10:39:27 2015 +0100

    Allow sblim-sfcb to search images
Comment 18 errata-xmlrpc 2015-03-05 10:38:02 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0458.html
Note You need to log in before you can comment on or make changes to this bug.