Bug 1335733 - [Hyper-V][RHEL6.9]hypervvssd and selinux denials
Summary: [Hyper-V][RHEL6.9]hypervvssd and selinux denials
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.9
Hardware: x86_64
OS: Linux
unspecified
low
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On: 1331309
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-05-13 06:46 UTC by xuli
Modified: 2017-03-21 09:46 UTC (History)
18 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of: 1331309
Environment:
Last Closed: 2017-03-21 09:46:39 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:0627 normal SHIPPED_LIVE selinux-policy bug fix update 2017-03-21 12:29:23 UTC

Comment 4 Lukas Vrabec 2016-10-05 09:48:44 UTC
Xuli, 
Could you attach RAW AVC msgs?

Comment 5 xuli 2016-10-10 05:33:37 UTC
Test on kernel 2.6.32-642.el6.x86_64 with selinux-policy-3.7.19-292.el6.noarch.

Reproduce steps:
1) Attach a new scsi disc to VM, create ext4 fs there
2) Mount it to some location, e.g. I created /mnt/mydrive and mounted /dev/sdb there.
3) change context to something non-standard,e.g. 'chcon -R -t mysqld_db_t /mnt/mydrive/'
4) execute backup vm action from host, observe that backup action is failed.

ausearch -m avc

time->Mon Oct 10 13:25:10 2016
type=SYSCALL msg=audit(1476077110.163:57): arch=c000003e syscall=2 success=no exit=-13 a0=139525a a1=0 a2=3 a3=1 items=0 ppid=1 pid=1806 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hv_vss_daemon" exe="/usr/sbin/hv_vss_daemon" subj=system_u:system_r:hypervvssd_t:s0 key=(null)
type=AVC msg=audit(1476077110.163:57): avc:  denied  { read } for  pid=1806 comm="hv_vss_daemon" name="/" dev=sdb1 ino=2 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:object_r:mysqld_db_t:s0 tclass=dir
----
time->Mon Oct 10 13:25:10 2016
type=SYSCALL msg=audit(1476077110.165:58): arch=c000003e syscall=2 success=no exit=-13 a0=139525a a1=0 a2=3 a3=1 items=0 ppid=1 pid=1806 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hv_vss_daemon" exe="/usr/sbin/hv_vss_daemon" subj=system_u:system_r:hypervvssd_t:s0 key=(null)
type=AVC msg=audit(1476077110.165:58): avc:  denied  { read } for  pid=1806 comm="hv_vss_daemon" name="/" dev=sdb1 ino=2 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:object_r:mysqld_db_t:s0 tclass=dir

Comment 9 xuli 2016-11-25 04:16:47 UTC
Thank you for your reminder,  I should verify this bug early, test on latest selinux-policy-3.7.19-305.el6.noarch, it still has issue.
Kernel Version: 2.6.32-671.el6.x86_64
Windows host: Hyper-v 2016 and 2012R2 


Reproduce steps:
1) Attach a new scsi disc to VM, create ext4 fs there
2) Mount it to some location, e.g. I created /mnt/mydrive and mounted /dev/sdb there.
3) change context to something non-standard,e.g. 'chcon -R -t mysqld_db_t /mnt/mydrive/'
4) execute backup vm action from host, observe that backup action is failed.

ausearch -m avc
----
time->Fri Nov 25 11:03:59 2016
type=SYSCALL msg=audit(1480043039.797:62): arch=c000003e syscall=16 success=no exit=-13 a0=6 a1=c0045877 a2=0 a3=1 items=0 ppid=1 pid=1683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hv_vss_daemon" exe="/usr/sbin/hv_vss_daemon" subj=system_u:system_r:hypervvssd_t:s0 key=(null)
type=AVC msg=audit(1480043039.797:62): avc:  denied  { write } for  pid=1683 comm="hv_vss_daemon" path="/mnt/mydrive" dev=sdb1 ino=2 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:object_r:mysqld_db_t:s0 tclass=dir
----
time->Fri Nov 25 11:03:59 2016
type=SYSCALL msg=audit(1480043039.797:63): arch=c000003e syscall=16 success=no exit=-13 a0=7 a1=c0045878 a2=0 a3=1 items=0 ppid=1 pid=1683 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hv_vss_daemon" exe="/usr/sbin/hv_vss_daemon" subj=system_u:system_r:hypervvssd_t:s0 key=(null)
type=AVC msg=audit(1480043039.797:63): avc:  denied  { write } for  pid=1683 comm="hv_vss_daemon" path="/mnt/mydrive" dev=sdb1 ino=2 scontext=system_u:system_r:hypervvssd_t:s0 tcontext=system_u:object_r:mysqld_db_t:s0 tclass=dir

Comment 20 errata-xmlrpc 2017-03-21 09:46:39 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2017-0627.html


Note You need to log in before you can comment on or make changes to this bug.