RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1238079 - libStorageMgmt: SELinux is preventing HP SmartArray plugin
Summary: libStorageMgmt: SELinux is preventing HP SmartArray plugin
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.2
Hardware: x86_64
OS: Linux
low
low
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-07-01 07:19 UTC by Gris Ge
Modified: 2015-11-19 10:38 UTC (History)
9 users (show)

Fixed In Version: selinux-policy-3.13.1-50.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-11-19 10:38:34 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
LibStorageMgmt hpsa plugin selinux AVC logs. (3.04 KB, application/x-gzip)
2015-07-16 13:14 UTC, Gris Ge 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:2300 0 normal SHIPPED_LIVE selinux-policy bug fix update 2015-11-19 09:55:26 UTC

Description Gris Ge 2015-07-01 07:19:23 UTC 
Description of problem:
SELinux is stopping libstoragemgmt MegaRAID plugin

/usr/lib/python2.7/site-packages/lsm/plugin/hpsa/hpsa.py


The HP Smart Array plugin will execute vendor binrary tool -- 
hpssacli as root user to:

* IOCTL CCISS_PASSTHRU against /dev/sdX
* Read sysfs files.

Version-Release number of selected component (if applicable):
libstoragemgmt-1.2.3-2.el7.x86_64
libstoragemgmt-hpsa-plugin-1.2.3-2.el7.noarch
storcli-1.14.12-1.noarch (vendor binary tool)
selinux-policy-targeted-3.13.1-23.el7.noarch

How reproducible:
100%

Steps to Reproduce:
1. Find a server with HP Smart Array card installed.
2. Install libstoragemgmt-hpsa-plugin-1.2.3-2.el7.noarch 
3. Use this repo to install hpssacli:
http://file.nay.redhat.com/~fge/lsm/HP/HP_hpssacli.repo
4. modprobe sg
5. lsmcli ls -u hpsa://

Actual results:

SELinux stopped the libstoragemgmt HP SmartArray plugin.

Expected results:
HP SmartArray plugin works.

Additional info:
No sure SELinux should include policy for their party binrary tools or not.
I will post the 12 logs if we decide to do so.
Comment 1 Miroslav Grepl 2015-07-16 11:33:57 UTC 
Could you attach AVC messages?
Comment 2 Gris Ge 2015-07-16 13:14:33 UTC 
Created attachment 1052690 [details]
LibStorageMgmt hpsa plugin selinux AVC logs.

Since we have 12 AVC reports, I create a tarball.
Let me know if you prefer copy&paste way.
Comment 3 Miroslav Grepl 2015-08-05 07:51:08 UTC 
Lukas,
could you check these AVCs and see if we can add fixes to 7.2?
Comment 4 Lukas Vrabec 2015-08-05 08:31:55 UTC 
Yes, we can Add this rules to 7.2
Comment 5 Lukas Vrabec 2015-08-05 09:09:37 UTC 
HI, 

There is one rule: 
allow lsmd_plugin_t fixed_disk_device_t:blk_file { read write open };

fixed_disk_device_t is labeled on this files:
$ sudo semanage fcontext -l | grep fixed_disk_device_t
/dev/(raw/)?rawctl                                 character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/[shmxv]d[^/]*                                 block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/\.tmp-block-.*                                character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/ataraid/.*                                    block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/bcache[0-9]+                                  block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/cciss/[^/]*                                   block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/dasd[^/]*                                     block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/dasd[^/]*                                     character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/device-mapper                                 character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/dm-[0-9]+                                     block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/drbd[^/]*                                     block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/etherd/.+                                     block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/flash[^/]*                                    block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/i2o/hd[^/]*                                   block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/ida/[^/]*                                     block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/initrd                                        block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/jsfd                                          block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/jsflash                                       character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/loop.*                                        block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/lvm                                           character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/mapper/.*                                     block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/md/.*                                         block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/megadev.*                                     character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/megaraid_sas_ioctl_node                       character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/mtd.*                                         block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/nb[^/]+                                       block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/ps3d.*                                        block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/ram.*                                         block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/raw/raw[0-9]+                                 character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/rd.*                                          block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/root                                          block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/scramdisk/.*                                  block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/tw[a-z][^/]*                                  character device   system_u:object_r:fixed_disk_device_t:s0 
/dev/ubd[^/]*                                      block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/vd[^/]*                                       block device       system_u:object_r:fixed_disk_device_t:s0 
/dev/xvd[^/]*                                      block device       system_u:object_r:fixed_disk_device_t:s0 
/lib/udev/devices/loop.*                           block device       system_u:object_r:fixed_disk_device_t:s0 
/usr/lib/udev/devices/loop.*                       block device       system_u:object_r:fixed_disk_device_t:s0 

Is really necessary to write to this devices?
Comment 7 Lukas Vrabec 2015-08-05 10:30:53 UTC 
commit abac06ff2d2c21a6a92dbf60e1c2e19ed2cf796d
Author: Lukas Vrabec <lvrabec>
Date:   Wed Aug 5 12:27:18 2015 +0200

    Allow lsm_plugin_t to rw raw_fixed_disk.
    Resolves:#1238079

commit cba244bf08396e23ec7e56c8c63f7654cf77c20b
Author: Lukas Vrabec <lvrabec>
Date:   Wed Aug 5 11:13:56 2015 +0200

    Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device
    Resolves: #1238079
Comment 8 Gris Ge 2015-08-05 13:36:04 UTC 
Hi Lukas,

Base on the code of HP opensource tool(cciss_vol_status, not the binary tool 
hpssacli we use here), they need the write access to /dev/sgX (char device)
and /dev/sdX(block device) in order to generate the query IOCTL.

The manpage of 'hpsa(4)' mentioned this:
============
Supported ioctl() operations
    CCISS_PASSTHRU, CCISS_BIG_PASSTHRU
        Allows  "BMIC" and "CISS" commands to be passed through to the Smart Array.
        These are used extensively by the HP Array Configuration Utility, SNMP 
        storage agents, etc.  See cciss_vol_status at  ⟨http://cciss.sf.net⟩ for
        some examples.
============
Comment 9 Gris Ge 2015-08-06 13:23:55 UTC 
Hi Lukas,

In stead of giving lsmd_plugin_t (all lsm plugin) for this wide
permission, is there anyway to limit this permission only for:
/usr/lib/python2.7/site-packages/lsm/plugin/hpsa/hpsa.py
?

Thank you.
Comment 10 Miroslav Grepl 2015-08-07 09:49:30 UTC 
(In reply to Gris Ge from comment #9)
> Hi Lukas,
> 
> In stead of giving lsmd_plugin_t (all lsm plugin) for this wide
> permission, is there anyway to limit this permission only for:
> /usr/lib/python2.7/site-packages/lsm/plugin/hpsa/hpsa.py
> ?
> 
> Thank you.

Yes, but I don't see as a big security advantage. Basically we treat all these plugins under lsmd_plugin_t.

So I am fine with fixes in -39.el7.
Comment 13 Gris Ge 2015-09-14 07:18:27 UTC 
Hi Milos Malik,

Still got warnnings on selinux-policy-targeted-3.13.1-47.el7.noarch.
But 'sealert' failed(exist bug?) to provide detail information:
====
[root@hp-dl360pgen8-08 ~]# grep 'sealert -l ' /var/log/messages |perl -ne 'print "$1\n" if /(sealert -l.+)$/'|sort -u
sealert -l 8666433b-b792-4f7e-a40a-10c53fb01940
sealert -l e44c22f1-19c6-45fd-a6f6-f7b166525ab1
[root@hp-dl360pgen8-08 ~]# sealert -l 8666433b-b792-4f7e-a40a-10c53fb01940
failed to connect to server: No such file or directory
[root@hp-dl360pgen8-08 ~]# sealert -l e44c22f1-19c6-45fd-a6f6-f7b166525ab1
failed to connect to server: No such file or directory
====

/var/log/audit/audit.log contains.
====
type=AVC msg=audit(1442214534.788:6114): avc:  denied  { sys_admin } for  pid=21374 comm="hpssacli" capability=21  scontext=system_u:system_r:lsmd_plugin_t:s0 tcontext=system_u:system_r:lsmd_plugin_t:s0 tclass=capability
type=SYSCALL msg=audit(1442214534.788:6114): arch=c000003e syscall=2 success=yes exit=5 a0=7f5728047708 a1=2 a2=7f57309f23f8 a3=3 items=0 ppid=21351 pid=21374 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hpssacli" exe="/opt/hp/hpssacli/bld/hpssacli" subj=system_u:system_r:lsmd_plugin_t:s0 key=(null)
type=AVC msg=audit(1442214641.159:6116): avc:  denied  { getattr } for  pid=21704 comm="hpssacli" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:lsmd_plugin_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
type=SYSCALL msg=audit(1442214641.159:6116): arch=c000003e syscall=137 success=yes exit=0 a0=7f3538013a48 a1=7f353fb1bd30 a2=fffffffffff473b8 a3=7f353fb1bb60 items=0 ppid=21702 pid=21704 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hpssacli" exe="/opt/hp/hpssacli/bld/hpssacli" subj=system_u:system_r:lsmd_plugin_t:s0 key=(null)
====
Comment 17 errata-xmlrpc 2015-11-19 10:38:34 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2300.html
Note You need to log in before you can comment on or make changes to this bug.