Bug 1161500
| Summary: | [Hyper-V][REHL 7.1] IP injection fail due to SELinux denied with gen2 guest | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Miroslav Grepl <mgrepl> | ||||||||
| Component: | dhcp | Assignee: | Jiri Popelka <jpopelka> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Release Test Team <release-test-team-automation> | ||||||||
| Severity: | high | Docs Contact: | |||||||||
| Priority: | high | ||||||||||
| Version: | 7.1 | CC: | dnie, jingli, knoel, kys, leiwang, ljozsa, lmiksik, lvrabec, mgrepl, mmalik, plautrba, pvrabec, shwang, thozza, vkuznets, yacao | ||||||||
| Target Milestone: | rc | Keywords: | Regression | ||||||||
| Target Release: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | dhcp-4.2.5-34.el7 | Doc Type: | Bug Fix | ||||||||
| Doc Text: |
Cause
Running IP injection script on Hyper-V 2012 (R2) host with RHEL-7.1 guest.
Consequence
IP injection fails due to SELinux denial.
Fix
dhclient-script was fixed.
Result
IP injection can run successfuly.
|
Story Points: | --- | ||||||||
| Clone Of: | 1161379 | Environment: | |||||||||
| Last Closed: | 2015-03-05 10:36:34 UTC | Type: | Bug | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Bug Depends On: | 1161379 | ||||||||||
| Bug Blocks: | |||||||||||
| Attachments: |
|
||||||||||
(In reply to Miroslav Grepl from comment #1) > type=AVC msg=audit(11/07/2014 10:08:34.917:265) : avc: denied { execute } > for pid=4297 comm=dhclient-script name=setfiles dev="dm-0" ino=34849754 > scontext=system_u:system_r:hypervkvp_t:s0 > tcontext=system_u:object_r:setfiles_exec_t:s0 tclass=file > > Is there a dhclient-script running setfiles? This is definitely bug in > hypervkvp. When changing network configuration hypervkvpd does the following: 1) Creates new ifcfg-{name} file 2) Runs hv_set_ifconfig.sh, which does the following 3) Copies ifcfg-{name} to /etc/sysconfig/network-scripts 4) ifdown {name} 5) ifup {name} dhclient-script belongs to dhclient package and I can see 'restorecon' (which is a symbolic link to 'setfiles') there. It is being called for two files: /etc/localtime /etc/resolv.conf It's not something new I suppose and has nothing to do with hyperv. You are right. It looks it has been fixed in dhcp pkg. I can't parse what do you think is wrong with dhclient-script. The restorecon calls have been there for very long time. Can somebody shed some light on it for me ? Thanks ! The problem is if a confine domain runs it we get this domain running setfiles. It should not be needed in RHEL7 because we have transition rules. (In reply to Jiri Popelka from comment #6) > The restorecon calls have been there for very long time. Since bug #488470. (In reply to Miroslav Grepl from comment #7) > It should not be needed in RHEL7 because we have transition rules. Are you telling me that I should remove those restorecon calls ? Yes. We cover it by $ sesearch -T |grep \"localtime\" $ sesearch -T |grep \"resolv.conf\" in RHEL7 and Fedoras. Waiting on bz#1161379 to be in ON_QA state. There still an error. Tested with the following versions of packages:
dhcp-common-4.2.5-34.el7.x86_64
dhclient-4.2.5-34.el7.x86_64
dhcp-libs-4.2.5-34.el7.x86_64
selinux-policy-3.13.1-14.el7.noarch
# systemctl status hypervkvpd reveals:
hypervkvpd.service - Hyper-V KVP daemon
Loaded: loaded (/usr/lib/systemd/system/hypervkvpd.service; enabled)
Active: active (running) since Thu 2015-01-08 20:26:21 HKT; 8min ago
Main PID: 748 (hypervkvpd)
CGroup: /system.slice/hypervkvpd.service
└─748 /usr/sbin/hypervkvpd
Jan 08 20:28:41 rhel7 dhclient[3013]: This version of ISC DHCP is based on the release available
Jan 08 20:28:41 rhel7 dhclient[3013]: on ftp.isc.org. Features have been added and other changes
Jan 08 20:28:41 rhel7 dhclient[3013]: have been made to the base software release in order to make
Jan 08 20:28:41 rhel7 dhclient[3013]: it work better with this distribution.
Jan 08 20:28:41 rhel7 dhclient[3013]:
Jan 08 20:28:41 rhel7 dhclient[3013]: Please report for this software via the Red Hat Bugzilla site:
Jan 08 20:28:41 rhel7 dhclient[3013]: http://bugzilla.redhat.com
Jan 08 20:28:41 rhel7 dhclient[3013]:
Jan 08 20:28:41 rhel7 hypervkvpd[748]: Determining IP information for eth0... failed.
Jan 08 20:28:41 rhel7 KVP[748]: Failed to execute cmd '/usr/libexec/hypervkvpd/hv_set_ifconfig /var/lib/hyperv/ifcfg-eth0'; error: 2 No such file or directory
Additional log output from hypervkvpd unit: [root@rhel7 ~]# journalctl -u hypervkvpd -- Logs begin at Sun 2015-02-22 17:10:23 HKT, end at Thu 2015-01-08 21:01:01 HKT. -- Jan 08 20:26:21 rhel7 systemd[1]: Starting Hyper-V KVP daemon... Jan 08 20:26:21 rhel7 systemd[1]: Started Hyper-V KVP daemon. Jan 08 20:26:21 rhel7 KVP[748]: KVP starting; pid is:748 Jan 08 20:26:21 rhel7 KVP[748]: KVP LIC Version: 3.1 Jan 08 20:28:40 rhel7 hypervkvpd[748]: cp: cannot create regular file ‘/etc/sysconfig/network-scripts/ifcfg-eth0’: Permission denied Jan 08 20:28:41 rhel7 dhclient[3013]: dhclient(833) is already running - exiting. Jan 08 20:28:41 rhel7 dhclient[3013]: Jan 08 20:28:41 rhel7 dhclient[3013]: This version of ISC DHCP is based on the release available Jan 08 20:28:41 rhel7 dhclient[3013]: on ftp.isc.org. Features have been added and other changes Jan 08 20:28:41 rhel7 dhclient[3013]: have been made to the base software release in order to make Jan 08 20:28:41 rhel7 dhclient[3013]: it work better with this distribution. Jan 08 20:28:41 rhel7 dhclient[3013]: Jan 08 20:28:41 rhel7 dhclient[3013]: Please report for this software via the Red Hat Bugzilla site: Jan 08 20:28:41 rhel7 dhclient[3013]: http://bugzilla.redhat.com Jan 08 20:28:41 rhel7 dhclient[3013]: Jan 08 20:28:41 rhel7 hypervkvpd[748]: Determining IP information for eth0... failed. Jan 08 20:28:41 rhel7 KVP[748]: Failed to execute cmd '/usr/libexec/hypervkvpd/hv_set_ifconfig /var/lib/hyperv/ifcfg-eth0'; error: 2 No such file or directory The bug needs to be re-tested as soon as bz#1161379 will be again in ON_QA state. The previous ON_QA state was erroneous because the selinux-policy in which the issue was fixed wasn't build and I have tested in vs older build. Retested again with the following version of packages: [root@rhel7 ~]# rpm -qa | grep sel selinux-policy-targeted-3.13.1-16.el7.noarch libselinux-2.2.2-6.el7.x86_64 libselinux-utils-2.2.2-6.el7.x86_64 libselinux-python-2.2.2-6.el7.x86_64 selinux-policy-3.13.1-16.el7.noarch [root@rhel7 ~]# rpm -qa | grep dhc dhcp-common-4.2.5-34.el7.x86_64 dhclient-4.2.5-34.el7.x86_64 dhcp-libs-4.2.5-34.el7.x86_64 The error is still present. Attaching joutnalctl output and audit.log. Created attachment 980048 [details]
journalctl output
Created attachment 980050 [details]
audit.log
Created attachment 980096 [details]
journalctl output - disabled NM
Tried with disabled Network Manager service, the result is the same. Find the journalctl output attached.
Can any hypervkvpd/selinux guru help me with parsing the log ? Thank you ! I'm afraid I don't have the whole picture, I was only following the instructions from comment #9. For me it looks like there's still some problem with hypervkvpd not being able to create ifcfg-eth0 in a first place. Jan 15 00:04:25 rhel7 network[740]: Bringing up interface eth0: Jan 15 00:04:25 rhel7 dhclient[971]: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 6 (xid=0x729bfc01) Jan 15 00:04:25 rhel7 dhclient[971]: DHCPREQUEST on eth0 to 255.255.255.255 port 67 (xid=0x729bfc01) Jan 15 00:04:25 rhel7 dhclient[971]: DHCPOFFER from 10.66.111.254 Jan 15 00:04:25 rhel7 dhclient[971]: DHCPACK from 10.66.111.254 (xid=0x729bfc01) Jan 15 00:04:28 rhel7 dhclient[971]: bound to 10.66.111.86 -- renewal in 16648 seconds. ... Jan 15 00:06:04 rhel7 hypervkvpd[750]: cp: cannot create regular file ‘/etc/sysconfig/network-scripts/ifcfg-eth0’: Permission denied Jan 15 00:06:04 rhel7 dhclient[1074]: receive_packet failed on eth0: Network is down Jan 15 00:06:06 rhel7 dhclient[2502]: dhclient(1074) is already running - exiting. Jan 15 00:06:06 rhel7 hypervkvpd[750]: Determining IP information for eth0... failed. Jan 15 00:06:06 rhel7 KVP[750]: Failed to execute cmd '/usr/libexec/hypervkvpd/hv_set_ifconfig /var/lib/hyperv/ifcfg-eth0'; error: 2 No such file or directory (In reply to Jiri Popelka from comment #22) > Can any hypervkvpd/selinux guru help me with parsing the log ? Thank you ! > I'm afraid I don't have the whole picture, I was only following the > instructions from comment #9. For me it looks like there's still some > problem with hypervkvpd not being able to create ifcfg-eth0 in a first place. > ... > Jan 15 00:06:04 rhel7 hypervkvpd[750]: cp: cannot create regular file > ‘/etc/sysconfig/network-scripts/ifcfg-eth0’: Permission denied hypervkvpd runs under root so SELinux is the only suspect here and I *think* the issue is tracked here: https://bugzilla.redhat.com/show_bug.cgi?id=1161379 Verified with dhcp-4.2.5-34.el7, selinux-policy-3.13.1-20.el7.noarch. The IP injection is successful. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0450.html |
type=AVC msg=audit(11/07/2014 10:08:34.917:265) : avc: denied { execute } for pid=4297 comm=dhclient-script name=setfiles dev="dm-0" ino=34849754 scontext=system_u:system_r:hypervkvp_t:s0 tcontext=system_u:object_r:setfiles_exec_t:s0 tclass=file Is there a dhclient-script running setfiles? This is definitely bug in hypervkvp.