Bug 1331309 - [Hyper-V][RHEL7.3]hypervvssd and selinux denials
Summary: [Hyper-V][RHEL7.3]hypervvssd and selinux denials
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.2
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks: 1401400 1335733
TreeView+ depends on / blocked
 
Reported: 2016-04-28 09:17 UTC by Jarno Huuskonen
Modified: 2018-01-29 22:38 UTC (History)
18 users (show)

Fixed In Version: selinux-policy-3.13.1-133.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1335733 (view as bug list)
Environment:
Last Closed: 2017-08-01 15:10:10 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:1861 normal SHIPPED_LIVE selinux-policy bug fix update 2017-08-01 17:50:24 UTC

Description Jarno Huuskonen 2016-04-28 09:17:14 UTC
Description of problem:
We're using UDP(arcserve) to backup linux VMs (on win2012R2 hyper-v). UDP/hyperv uses hypervvssd to freeze/thaw filesystems during backup(snapshot).

Default selinux-policy doesn't allow hypervvssd to freeze/thaw filesystems.

Second problem we've encountered with hypervvssd/UDP backups is that few times
creating the snapshot has left all filesystems in frozen state. (AFAIK UDP/vss writer managed to freeze filesystems but for some reason didn't call THAW).

So would it be possible to add (for example -s|--syncfs) cli option to hypervvssd. This would change hypervvssd behaviour:
hypervvssd would call syncfs(fd) instead of ioctl(fd, FIFREEZE (and basically
do noop on VSS_OP_THAW).
With this option it would be possible to make sure that filesystems are not
left in frozen state (and probably sacrifice some snapshot consistency).
(I made initial syncfs patch for hypervvssd, and if this option sounds reasonable I can attach the patch).

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.13.1-60.el7_2.3.noarch
hypervvssd-0-0.26.20150402git.el7.x86_64
(same problem happens with RHEL6.7).

How reproducible:
always when using UDP to backup linux guest VM (on hyperv).

Steps to Reproduce:
1. use UDP(arcserve) to backup linux guest (I guess anything that calls hypervvssd with freeze/thaw will do). (AFAIK "normal" hyper-v checkpoint doesn't call hypervvssd+freeze/thaw).

Actual results:
avc:  denied  { read } for  pid=47775 comm="hypervvssd" name="/" dev="dm-5" ino=128 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:object_r:mysqld_db_t:s0 tclass=dir

avc:  denied  { dac_read_search } for  pid=47775 comm="hypervvssd" capability=2  scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:system_r:hypervvssd_t:s0 tclass=capability

avc:  denied  { dac_override } for  pid=47775 comm="hypervvssd" capability=1  scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:system_r:hypervvssd_t:s0 tclass=capability

and UDP backup fails because VSS writer didn't create snapshot.


Expected results:
journal: Hyper-V VSS: VSS: op=FREEZE: succeeded
journal: Hyper-V VSS: VSS: op=THAW: succeeded

Additional info:
creating selinux module with something like this allows hypervvsd to freeze/thaw
filesystems:
allow hypervvssd_t mysqld_db_t:dir { read write ioctl open };
allow hypervvssd_t postgresql_db_t:dir { read write ioctl open };
allow hypervvssd_t tmp_t:dir { read write ioctl open };
allow hypervvssd_t usr_t:dir { read write ioctl open };
allow hypervvssd_t var_lib_t:dir { read write ioctl open };
allow hypervvssd_t var_log_t:dir { read write ioctl open };
allow hypervvssd_t self:capability { dac_read_search dac_override };

Comment 6 Lukas Vrabec 2016-06-28 11:26:24 UTC
What is fix here? hypervvssd_t should read all dirs on system?

Comment 7 xuli 2016-06-29 02:30:55 UTC
Could please Vitaly help to comment on what the fix is?

Thank you.

Comment 8 Vitaly Kuznetsov 2016-06-29 09:27:24 UTC
hypervvssd is very simple, it does the following:

For all mountpoints in /proc/mounts (including '/'):

on freeze request from the host:

1) fd = open(dir, O_RDONLY);
2) ioctl(fd, FIFREEZE, 0);
3) close(fd);

on thaw request from the host:

1) fd = open(dir, O_RDONLY);
2) ioctl(fd, FITHAW, 0);
3) close(fd);

this should always succeed. So, answering the question, hypervvssd_t should be able to open any dir on the system and (I'm not sure what it means for SELinux) do appropriate ioctls. The daemon only talks to kernel so giving it such permissions is relatively safe.

Comment 14 errata-xmlrpc 2017-08-01 15:10:10 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1861


Note You need to log in before you can comment on or make changes to this bug.