Description of problem:
We're using UDP(arcserve) to backup linux VMs (on win2012R2 hyper-v). UDP/hyperv uses hypervvssd to freeze/thaw filesystems during backup(snapshot).

Default selinux-policy doesn't allow hypervvssd to freeze/thaw filesystems.

Second problem we've encountered with hypervvssd/UDP backups is that few times
creating the snapshot has left all filesystems in frozen state. (AFAIK UDP/vss writer managed to freeze filesystems but for some reason didn't call THAW).

So would it be possible to add (for example -s|--syncfs) cli option to hypervvssd. This would change hypervvssd behaviour:
hypervvssd would call syncfs(fd) instead of ioctl(fd, FIFREEZE (and basically
do noop on VSS_OP_THAW).
With this option it would be possible to make sure that filesystems are not
left in frozen state (and probably sacrifice some snapshot consistency).
(I made initial syncfs patch for hypervvssd, and if this option sounds reasonable I can attach the patch).

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.13.1-60.el7_2.3.noarch
hypervvssd-0-0.26.20150402git.el7.x86_64
(same problem happens with RHEL6.7).

How reproducible:
always when using UDP to backup linux guest VM (on hyperv).

Steps to Reproduce:
1. use UDP(arcserve) to backup linux guest (I guess anything that calls hypervvssd with freeze/thaw will do). (AFAIK "normal" hyper-v checkpoint doesn't call hypervvssd+freeze/thaw).

Actual results:
avc:  denied  { read } for  pid=47775 comm="hypervvssd" name="/" dev="dm-5" ino=128 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:object_r:mysqld_db_t:s0 tclass=dir

avc:  denied  { dac_read_search } for  pid=47775 comm="hypervvssd" capability=2  scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:system_r:hypervvssd_t:s0 tclass=capability

avc:  denied  { dac_override } for  pid=47775 comm="hypervvssd" capability=1  scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:system_r:hypervvssd_t:s0 tclass=capability

and UDP backup fails because VSS writer didn't create snapshot.


Expected results:
journal: Hyper-V VSS: VSS: op=FREEZE: succeeded
journal: Hyper-V VSS: VSS: op=THAW: succeeded

Additional info:
creating selinux module with something like this allows hypervvsd to freeze/thaw
filesystems:
allow hypervvssd_t mysqld_db_t:dir { read write ioctl open };
allow hypervvssd_t postgresql_db_t:dir { read write ioctl open };
allow hypervvssd_t tmp_t:dir { read write ioctl open };
allow hypervvssd_t usr_t:dir { read write ioctl open };
allow hypervvssd_t var_lib_t:dir { read write ioctl open };
allow hypervvssd_t var_log_t:dir { read write ioctl open };
allow hypervvssd_t self:capability { dac_read_search dac_override };