Could you gather all SELinux denials from that machine and attach them here?

# ausearch -m avc -m user_avc -m selinux_err -i -ts today

The AVC mentioned in comment#0 comes from enforcing mode, because of "success=no". I would like to see if there are other problems. Thnak you.

Created attachment 954813 [details]
selinux denied log with hypervkvpd

(In reply to Milos Malik from comment #3)
> Could you gather all SELinux denials from that machine and attach them here?
> 
> # ausearch -m avc -m user_avc -m selinux_err -i -ts today
> 
> The AVC mentioned in comment#0 comes from enforcing mode, because of
> "success=no". I would like to see if there are other problems. Thnak you.

Hi Milos, 

Please check the log in the attachment.

Thanks

type=AVC msg=audit(11/07/2014 10:08:34.917:265) : avc:  denied  { execute } for  pid=4297 comm=dhclient-script name=setfiles dev="dm-0" ino=34849754 scontext=system_u:system_r:hypervkvp_t:s0 tcontext=system_u:object_r:setfiles_exec_t:s0 tclass=file

Is there a dhclient-script running setfiles? This is definitely bug in hypervkvp.

commit da25a6ba00dff7cc196511efdf85b26b348856bb
Author: Miroslav Grepl <mgrepl>
Date:   Fri Nov 7 10:42:55 2014 +0100

    Add fixes for hypervkvp daemon
     * allow to execute arping
     * allow to execute ifup-eth
     * allow to execute pidof
     * allow to exec chrony-helper

commit 077d3cc087d63bd519b0c7ba1795d90a5a4bfcc7
Author: Miroslav Grepl <mgrepl>
Date:   Tue Jan 6 11:38:48 2015 +0100

    Allow hypervkvp to execute arping in own domain and make it as nsswitch domain.

We need to get AVC msgs from permissive mode?

Why does it write to /etc?

(In reply to Miroslav Grepl from comment #17)
> We need to get AVC msgs from permissive mode?
> 
> Why does it write to /etc?

Hi Miroslave, 

Do you need to get the AVC msgs as permissive mode? the AVC msg is collected as Enforcing in the attachment . 

the IP injection can run successful with permissive, anyhow,  the hypervkvpd does the following things when I ran the powershell script on Hyper-V host:

1) Creates new ifcfg-{name} file
2) Runs hv_set_ifconfig.sh, which does the following
3) Copies ifcfg-{name} to /etc/sysconfig/network-scripts
4) ifdown {name}
5) ifup {name}

(In reply to lijing from comment #18)
> (In reply to Miroslav Grepl from comment #17)
> > We need to get AVC msgs from permissive mode?
> > 
> > Why does it write to /etc?
> 
> Hi Miroslave, 
> 
> Do you need to get the AVC msgs as permissive mode? 

Yes,
we need to get AVCs from permissive mode.

>the AVC msg is collected
> as Enforcing in the attachment . 
> 
> the IP injection can run successful with permissive, anyhow,  the hypervkvpd
> does the following things when I ran the powershell script on Hyper-V host:
> 
> 1) Creates new ifcfg-{name} file
> 2) Runs hv_set_ifconfig.sh, which does the following
> 3) Copies ifcfg-{name} to /etc/sysconfig/network-scripts
> 4) ifdown {name}
> 5) ifup {name}

Created attachment 980794 [details]
The log is from permissive

commit d9de065fde48d5884b609f3d421f4e975f378c22
Author: Miroslav Grepl <mgrepl>
Date:   Tue Jan 20 21:16:12 2015 +0100

    Add additional fixes for hyperkvp
     * creates new ifcfg-{name} file
     * Runs hv_set_ifconfig.sh, which does the following
     * Copies ifcfg-{name} to /etc/sysconfig/network-scripts


But it needs to be re-tested in the real scenario.

Hi Miroslav, 

I had a try with selinux-policy-3.13.1-16.el7, the ifcfg-{name} still can't be copied into /etc/sysconfig/network-scripts with hv_set_ifconfig.sh as Enforcing. 

the log is in the attenchment.

Created attachment 982583 [details]
the log of selinux-policy-3.13.1-16.el7.noarch for hypervkvpd

(In reply to lijing from comment #23)
> Hi Miroslav, 
> 
> I had a try with selinux-policy-3.13.1-16.el7, the ifcfg-{name} still can't
> be copied into /etc/sysconfig/network-scripts with hv_set_ifconfig.sh as
> Enforcing. 
> 
> the log is in the attenchment.

I checked the log of selinux packages in brew, it fixed in selinux-policy-3.13.1-17.el7 but not in selinux-policy-3.13.1-16.el7, it works well now.

Thanks a lot for the testing.

Hi Miroslav, 

For this bug, the IP Injection has worked very well but there is still some other problem in selinux, when I checked the status of hypervkvpd, the log below is displayed. 

[root@classroom ~]# systemctl status hypervkvpd
hypervkvpd.service - Hyper-V KVP daemon
   Loaded: loaded (/usr/lib/systemd/system/hypervkvpd.service; enabled)
   Active: active (running) since Sun 2015-01-25 21:50:24 EST; 8min ago
 Main PID: 749 (hypervkvpd)
   CGroup: /system.slice/hypervkvpd.service
           └─749 /usr/sbin/hypervkvpd

Jan 25 21:50:24 classroom.example.com systemd[1]: Started Hyper-V KVP daemon.
Jan 25 21:50:24 classroom.example.com KVP[749]: KVP starting; pid is:749
Jan 25 21:50:24 classroom.example.com KVP[749]: KVP LIC Version: 3.1
Jan 25 21:57:10 classroom.example.com python[4327]: detected unhandled Python exception in '/usr/bin/firewall-cmd'
Jan 25 21:57:14 classroom.example.com python[4399]: detected unhandled Python exception in '/usr/bin/firewall-cmd'
Jan 25 21:57:17 classroom.example.com python[4472]: detected unhandled Python exception in '/usr/bin/firewall-cmd'


time->Wed Jan 21 06:22:05 2015
type=SYSCALL msg=audit(1421839325.703:424): arch=c000003e syscall=2 success=no exit=-13 a0=7f99f91b1889 a1=80000 a2=1b6 a3=1 items=0 ppid=3591 pid=3605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="firewall-cmd" exe="/usr/bin/python2.7" subj=system_u:system_r:hypervkvp_t:s0 key=(null)
type=AVC msg=audit(1421839325.703:424): avc:  denied  { read } for  pid=3605 comm="firewall-cmd" name="meminfo" dev="proc" ino=4026532027 scontext=system_u:system_r:hypervkvp_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file


You can check the detail log of selinux-policy-3.13.1-16.el7.noarch for hypervkvpd  in the attachment. 

so I think this bug can't be verified yet, anyhow, the Add additional fixes for hyperkvp is fixed selinux-policy-3.13.1-17.el7 but not in selinux-policy-3.13.1-16.el7. if you think the error log above is another issue we can open anther bug to trace.

commit 6fbe6729a6507f64ec9570c678ef926fd1f70a5d
Author: Miroslav Grepl <mgrepl>
Date:   Wed Jan 28 08:40:05 2015 +0100

    Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0458.html