Bug 1465833 - Permission denied when hotplug the chardev with source path as "dev/ttyS0" to the guest
Permission denied when hotplug the chardev with source path as "dev/ttyS0" to...
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: libvirt (Show other bugs)
x86_64 Linux
unspecified Severity unspecified
: rc
: ---
Assigned To: Pavel Hrdina
Depends On:
Blocks: 1473046
  Show dependency treegraph
Reported: 2017-06-28 06:22 EDT by yafu
Modified: 2018-01-12 00:45 EST (History)
10 users (show)

See Also:
Fixed In Version: libvirt-3.9.0-6.el7
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description yafu 2017-06-28 06:22:18 EDT
Description of problem:
Permission denied when hotplug the chardev with source path as "dev/ttyS0" to the guest

Version-Release number of selected component (if applicable):

How reproducible:

Steps to reproduce:
1.Prepare a chardev with source path as "dev/ttyS0":
#cat console.xml
<console type='dev'>
      <source path='/dev/ttyS0'/>
      <target type='virtio' port='1'/>

2.Attach the chardev to a running guest:
# virsh attach-device V console.xml
error: Failed to attach device from console.xml
error: internal error: unable to execute QEMU command 'chardev-add': Could not open '/dev/ttyS0': Permission denied

3.Start a guest with /dev/ttySO chardev device:
#virsh edit V
<console type='dev'>
      <source path='/dev/ttyS0'/>
      <target type='virtio' port='1'/>
#virsh start V
Domain V started

#virsh dumpxml V | grep -A5 ttyS0
  <console type='dev'>
      <source path='/dev/ttyS0'/>
      <target type='virtio' port='1'/>
      <alias name='console1'/>

Actual results:
/dev/ttyS0 chardev failed to hotplug to the guest with permission denied error, but the guest with this device can start successfully.

Expected results:
If libvirt relabel the source file while starting the guest, it also should relabel the source file while hotpluging the device.

Additional info:
The /dev/ttyS0 chardev can hotunplug from the guest successfully.
Comment 2 Michal Privoznik 2017-08-18 03:00:01 EDT
I think this is fixed upstream by:

commit e93d844b90aab2676a1ad910a165c9c83c99de3d
Author:     Michal Privoznik <mprivozn@redhat.com>
AuthorDate: Mon Jun 19 17:05:31 2017 +0200
Commit:     Michal Privoznik <mprivozn@redhat.com>
CommitDate: Tue Jul 11 14:45:15 2017 +0200

    qemu ns: Create chardev backends more frequently
    Currently, the only type of chardev that we create the backend
    for in the namespace is type='dev'. This is not enough, other
    backends might have files under /dev too. For instance channels
    might have a unix socket under /dev (well, bind mounted under
    /dev from a different place).
    Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
    Reviewed-by: John Ferlan <jferlan@redhat.com>

It is part of the 3.6.0 release. This commit was a part of bigger patch set that tried to fix bug 1462060. Therefore I suggest closing this one as a duplicate of that one.
Comment 3 Pavel Hrdina 2017-12-01 07:55:34 EST
That patch is not good enough, the permission denied failure is still valid.

Upstream patches posted:

Comment 4 Pavel Hrdina 2017-12-05 08:00:06 EST
Upstream commit:

commit 1c57eea3625f59a80bea08d8779837a40acc4660
Author: Pavel Hrdina <phrdina@redhat.com>
Date:   Fri Dec 1 13:10:35 2017 +0100

    qemu: fix security labeling for attach/detach of char devices
Comment 7 chhu 2018-01-11 22:51:24 EST
Reproduced on packages:

Verified on packages:

Test steps:
1. Start a guest.
2. Prepare a chardev with source path as "/dev/ttyS0".
#cat console.xml
<console type='dev'>
      <source path='/dev/ttyS0'/>
      <target type='virtio' port='1'/>

3. Attach the chardev to the running guest successfully.
# virsh attach-device r7 console.xml 
Device attached successfully
# virsh dumpxml r7|grep -A5 ttyS0
      <source path='/dev/ttyS0'/>
      <target type='virtio' port='1'/>
      <alias name='console1'/>
4. Login to the guest, check there is new added: /dev/vport1p0

5. Detach the chardev from the running guest successfully, 
   login to the guest, check /dev/vport1p0 is no longer exist.
# virsh detach-device r7 console.xml 
Device detached successfully

# virsh dumpxml r7|grep -A5 console
    <console type='pty' tty='/dev/pts/1'>
      <source path='/dev/pts/1'/>
      <target type='serial' port='0'/>
      <alias name='serial0'/>

According to the test above, set the status to "VERIFIED".

Note You need to log in before you can comment on or make changes to this bug.