Bug 1075870
| Summary: | cimserver is blocked by selinux | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Jincheng Miao <jmiao> | |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | |
| Severity: | high | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 7.0 | CC: | dyuan, jmiao, lvrabec, mgrepl, mmalik, mzhan, psklenar, ydu | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | x86_64 | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | selinux-policy-3.13.1-21.el7 | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1152104 (view as bug list) | Environment: | ||
| Last Closed: | 2015-03-05 10:38:02 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1152104 | |||
Could you re-test it in permissive mode? (In reply to Miroslav Grepl from comment #1) > Could you re-test it in permissive mode? Yes, Miroslav, I had tested it in permissive mode, both cimservers could pass that cim test case, and sfcb also could name_bind. (In reply to Miroslav Grepl from comment #1) > Could you re-test it in permissive mode? (In reply to Jincheng Miao from comment #2) > Yes, Miroslav, I had tested it in permissive mode, both cimservers could > pass that cim test case, and sfcb also could name_bind. Sorry, I just saw a new brew of selinux-policy from you, and these operations also are blocked. # rpm -q selinux-policy selinux-policy-3.12.1-137.el7.noarch # getenforce Enforcing # service tog-pegasus start Redirecting to /bin/systemctl start tog-pegasus.service # CIM_NS=root/virt CIM_USER=root CIM_PASS=password ./runtests libvirt-cim -v KVM localhost -g ComputerSystem -t 03_defineVS.py Starting test suite: libvirt-cim Testing KVM hypervisor -------------------------------------------------------------------- ComputerSystem - 03_defineVS.py: FAIL ERROR - Got CIM error CIM_ERR_FAILED: ResourceSettings Error: Can't get a valid disk type, Device vda, Address /var/lib/libvirt/images/default-kvm-dimage, make sure Address can be accessed on host system. with return code 1 ERROR - Failed to define a domain with the name domU1 from virsh InvokeMethod(DefineSystem): CIM_ERR_FAILED: ResourceSettings Error: Can't get a valid disk type, Device vda, Address /var/lib/libvirt/images/default-kvm-dimage, make sure Address can be accessed on host system. -------------------------------------------------------------------- # cat /var/log/audit/audit.log | grep cimprovagt type=AVC msg=audit(1394765258.481:155): avc: denied { getattr } for pid=2527 comm="cimprovagt" path="/var/lib/libvirt/images/default-kvm-dimage" dev="sda1" ino=69523305 scontext=system_u:system_r:pegasus_t:s0 tcontext=system_u:object_r:virt_content_t:s0 tclass=file # service tog-pegasus stop Redirecting to /bin/systemctl stop tog-pegasus.service # service sblim-sfcb start Redirecting to /bin/systemctl start sblim-sfcb.service # cat /var/log/audit/audit.log | grep sfcbd type=AVC msg=audit(1394765426.071:183): avc: denied { name_bind } for pid=3011 comm="sfcbd" src=5988 scontext=system_u:system_r:sblim_sfcbd_t:s0 tcontext=system_u:object_r:pegasus_http_port_t:s0 tclass=tcp_socket commit 78a2f1ddc2d41a4db7abff5b4f4fd156e174a24b
Author: Lukas Vrabec <lvrabec>
Date: Mon Mar 31 13:47:52 2014 +0200
Allow pegasus to getattr virt_content
(In reply to Lukas Vrabec from comment #5) > commit 78a2f1ddc2d41a4db7abff5b4f4fd156e174a24b > Author: Lukas Vrabec <lvrabec> > Date: Mon Mar 31 13:47:52 2014 +0200 > > Allow pegasus to getattr virt_content Added only to F20. #============= sblim_sfcbd_t ============== #!!!! This avc is allowed in the current policy allow sblim_sfcbd_t pegasus_https_port_t:tcp_socket name_bind; commit 3658b93369f1ad5bcd20e9f5ff1bcc447ddb97f7
Author: Miroslav Grepl <mgrepl>
Date: Mon Jan 26 10:39:27 2015 +0100
Allow sblim-sfcb to search images
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0458.html |
Description of problem: The getattr operation of tog-pegasus to qemu image is blocked by selinux. And selinux will block sfcb to name_bind. Version-Release number of selected component (if applicable): selinux-policy-3.12.1-135.el7.noarch libvirt-cim-0.6.3-6.el7.x86_64 tog-pegasus-2.12.1-16.el7.x86_64 How reproducible: 100% Steps to Reproduce: 1. run cimtest script 03_defineVS.py of ComputerSystem group # CIM_NS=root/virt CIM_USER=root CIM_PASS=password ./runtests libvirt-cim -v KVM localhost -g ComputerSystem -t 03_defineVS.py Starting test suite: libvirt-cim Testing KVM hypervisor -------------------------------------------------------------------- ComputerSystem - 03_defineVS.py: FAIL ERROR - Got CIM error CIM_ERR_FAILED: ResourceSettings Error: Can't get a valid disk type, Device vda, Address /var/lib/libvirt/images/default-kvm-dimage, make sure Address can be accessed on host system. with return code 1 ERROR - Failed to define a domain with the name domU1 from virsh InvokeMethod(DefineSystem): CIM_ERR_FAILED: ResourceSettings Error: Can't get a valid disk type, Device vda, Address /var/lib/libvirt/images/default-kvm-dimage, make sure Address can be accessed on host system. -------------------------------------------------------------------- 2. check the audit.log # tailf /var/log/audit/audit.log | grep avc type=AVC msg=audit(1394602219.138:11597): avc: denied { getattr } for pid=5138 comm="cimprovagt" path="/var/lib/libvirt/images/default-kvm-dimage" dev="sda1" ino=69523305 scontext=system_u:system_r:pegasus_t:s0 tcontext=system_u:object_r:virt_image_t:s0 tclass=file 3. change the cimserver from tog-pegasus to sblim-sfcb, selinux will block sblim-sfcb bind 5988 port # service sblim-sfcb start # tailf /var/log/audit/audit.log | grep avc type=AVC msg=audit(1394602821.738:11662): avc: denied { name_bind } for pid=5652 comm="sfcbd" src=5988 scontext=system_u:system_r:sblim_sfcbd_t:s0 tcontext=system_u:object_r:pegasus_http_port_t:s0 tclass=tcp_socket This will make sfcb failed to listen Mar 12 13:44:34 localhost.localdomain sfcb[5901]: --- Cannot listen on port 5988 (Permission denied) Mar 12 13:44:35 localhost.localdomain sfcbd[5900]: --- Winding down sfcbd Mar 12 13:44:35 localhost.localdomain sfcbd[5900]: spGetMsg receiving from 0 5903-88 Socket operation on non-socket Mar 12 13:44:35 localhost.localdomain sfcbd[5900]: rcvMsg receiving from 0 5903-88 Socket operation on non-socket Mar 12 13:44:35 localhost.localdomain sfcbd[5900]: --- forkProvider failed in _methProvider ($ClassProvider$) Mar 12 13:44:35 localhost.localdomain sfcbd[5900]: spSendMsg sending to 0 5904-88 Socket operation on non-socket Mar 12 13:44:35 localhost.localdomain sfcb[5901]: spGetMsg receiving from 0 5903-88 Socket operation on non-socket Mar 12 13:44:35 localhost.localdomain sfcb[5901]: rcvMsg receiving from 0 5903-88 Socket operation on non-socket Mar 12 13:44:35 localhost.localdomain sfcb[5901]: --- forkProvider failed in _methProvider ($ClassProvider$) Mar 12 13:44:35 localhost.localdomain sfcb[5901]: spSendMsg sending to 0 5904-88 Socket operation on non-socket Additional info: if disable selinux, the operations as above are passed.