Bug 1584318
| Summary: | /usr/bin/qemu-ga tries to read root directory of other disk mount points | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Robert Scheck <redhat-bugzilla> |
| Component: | qemu-guest-agent | Assignee: | Marc-Andre Lureau <marcandre.lureau> |
| Status: | CLOSED NOTABUG | QA Contact: | FuXiangChun <xfu> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.5 | CC: | chayang, juzhang, knoel, lvrabec, marcandre.lureau, mgrepl, michen, mmalik, plautrba, redhat-bugzilla, robert.scheck, ssekidde, xfu, xiaohli |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-12-17 17:15:08 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Cross-filed ticket 02110190 at the Red Hat customer portal. I have no idea whats going on in qemu-guest-agent. Moving to that component. There are various commands that manipulate the mount points, but I am not sure how you could reach the read() error: guest-fstrim, guest-get-fsinfo, guest-fsfreeze* (and more that could, but are disabled by default) I mounted a loopback file, and tried to reproduce the SElinux error by running various qemu-ga commands: without success. Could you isolate the command triggering the error? thanks I am sorry, we haven't been able to figure out a specific command, given we also did not do anything "exotic" when it appeared. It's not clear if it's qemu-ga fault or user fault. Let's keep it in needinfo state until we have a reproducer. moving to 7.7 (In reply to Li Xiaohui from comment #8) > Hi All, > I tested this bug in kernel-3.10.0-862.el7.x86_64 & > qemu-kvm-rhev-2.10.0-21.el7.x86_64 & qemu-guest-agent-2.8.0-2.el7.x86_64, > get results like followings: > > Test Steps: > 1.Boot guest with one usb-storage and virtio-serial chardev as qemu-ga > front-end: > /usr/libexec/qemu-kvm -M pc \ > -cpu SandyBridge \ > -enable-kvm \ > -m 4G \ > -smp 4 \ > -rtc base=utc,clock=host,driftfix=slew \ > -device virtio-scsi-pci,id=scsi0,bus=pci.0,addr=0x6 \ > -drive > file=/mnt/rhel-image/rhel75.qcow2,format=qcow2,if=none,id=drive-scsi0-0-0-0, > media=disk,cache=none,werror=stop,rerror=stop \ > -device scsi-hd,bus=scsi0.0,drive=drive-scsi0-0-0-0,id=scsi0-0-0-0 \ > -device > virtio-net-pci,mac=2c:76:8a:b0:e0:1c,id=netdev1,vectors=4,netdev=net1 > -netdev tap,id=net1,vhost=on \ > -device ich9-usb-uhci1,id=controller \ > -drive > file=data1.qcow2,id=drive-storage0,if=none,media=disk,cache=none, > format=qcow2 \ > -device usb-storage,drive=drive-storage0,bus=controller.0,id=storage0 \ > -chardev socket,id=serial0,path=/tmp/serial,server,nowait \ > -device isa-serial,chardev=serial0 \ > -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x7 \ > -chardev socket,path=/tmp/qga.sock,server,nowait,id=qga0 \ > -qmp tcp:0:4443,server,nowait \ > -vnc :3 \ > -monitor stdio \ > -vga qxl \ > -boot menu=on \ > > 2.After guest started, mount usb-storage to /var/www: > [root@localhost /]# fdisk -l > Disk /dev/sda: 53.7 GB, 53687091200 bytes, 104857600 sectors > Units = sectors of 1 * 512 = 512 bytes > Sector size (logical/physical): 512 bytes / 512 bytes > I/O size (minimum/optimal): 512 bytes / 512 bytes > Disk label type: dos > Disk identifier: 0x0009c4dc > > Device Boot Start End Blocks Id System > /dev/sda1 * 2048 2099199 1048576 83 Linux > /dev/sda2 2099200 104857599 51379200 8e Linux LVM > > ... > > Disk /dev/sdb: 2147 MB, 2147483648 bytes, 4194304 sectors > Units = sectors of 1 * 512 = 512 bytes > Sector size (logical/physical): 512 bytes / 512 bytes > I/O size (minimum/optimal): 512 bytes / 512 bytes > [root@localhost ~]# mount /dev/sdb /var/www > > 4.In guest, remove > "guest-file-open,guest-file-close,guest-file-read,guest-file-write" from > BLACKLIST_RPC in /etc/sysconfig/qemu-ga file. > > 3.In guest, restart qemu-guest-agent service and keep selinux enabled > > 4.On host, connect to qemu-ga via "nc -U" > [root@hp-dl385g7-06 ~]# nc -U /tmp/qga.sock > > 5.Try to open file through qemu-ga > > > Actual Result: > 1.open local file, it's successful, and nothing in /var/log/audit/audit.log > from guest: > [root@hp-dl385g7-06 ~]# nc -U /tmp/qga.sock > {"execute":"guest-file-open","arguments":{"path":"/tmp/test","mode":"r"}} > {"return": 1002} > > 2.open mounted file, permission denied, and get some log in > /var/log/audit/audit.log from guest: > [root@hp-dl385g7-06 ~]# nc -U /tmp/qga.sock > {"execute":"guest-file-open","arguments":{"path":"/dev/sdb","mode":"r"}} > {"error": {"class": "GenericError", "desc": "failed to open file '/dev/sdb' > (mode: 'r'): Permission denied"}} Opening the device itself is probably not what you wanted. I guess you wanted to check a mounted file. > > [root@localhost /]# cat /var/log/audit/audit.log > type=AVC msg=audit(1543476888.274:511): avc: denied { read } for pid=701 > comm="qemu-ga" name="sdb" dev="devtmpfs" ino=14026 > scontext=system_u:system_r:virt_qemu_ga_t:s0 > tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file > type=SYSCALL msg=audit(1543476888.274:511): arch=c000003e syscall=2 > success=no exit=-13 a0=55bde85c5520 a1=900 a2=0 a3=4000 items=0 ppid=1 > pid=701 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 > fsgid=0 tty=(none) ses=4294967295 comm="qemu-ga" exe="/usr/bin/qemu-ga" > subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null) > > > Robert, > Is Actual Result's 2 your expected reproduce result? > > Marc-Andre, > when selinux is enabled, shouldn't allow to read/write file(local or mounted > file) via qemu-ga, is right? I think it may depend on the file. Under /tmp, the default rule may allow you to open/read it. TBH I don't know what level of support we want for qemu-ga functions that are blacklisted... (In reply to Marc-Andre Lureau from comment #9) > > Actual Result: > > 1.open local file, it's successful, and nothing in /var/log/audit/audit.log > > from guest: > > [root@hp-dl385g7-06 ~]# nc -U /tmp/qga.sock > > {"execute":"guest-file-open","arguments":{"path":"/tmp/test","mode":"r"}} > > {"return": 1002} > > > > 2.open mounted file, permission denied, and get some log in > > /var/log/audit/audit.log from guest: > > [root@hp-dl385g7-06 ~]# nc -U /tmp/qga.sock > > {"execute":"guest-file-open","arguments":{"path":"/dev/sdb","mode":"r"}} > > {"error": {"class": "GenericError", "desc": "failed to open file '/dev/sdb' > > (mode: 'r'): Permission denied"}} > > Opening the device itself is probably not what you wanted. I guess you > wanted to check a mounted file. emmm, I just want to reproduce this bug, and make audit.log is more similar to Comment 1. and found only when selinux is enabled, then can get similar log in guest's audit.log > > > > > [root@localhost /]# cat /var/log/audit/audit.log > > type=AVC msg=audit(1543476888.274:511): avc: denied { read } for pid=701 > > comm="qemu-ga" name="sdb" dev="devtmpfs" ino=14026 > > scontext=system_u:system_r:virt_qemu_ga_t:s0 > > tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file > > type=SYSCALL msg=audit(1543476888.274:511): arch=c000003e syscall=2 > > success=no exit=-13 a0=55bde85c5520 a1=900 a2=0 a3=4000 items=0 ppid=1 > > pid=701 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 > > fsgid=0 tty=(none) ses=4294967295 comm="qemu-ga" exe="/usr/bin/qemu-ga" > > subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null) > > > > > > Robert, > > Is Actual Result's 2 your expected reproduce result? > > > > Marc-Andre, > > when selinux is enabled, shouldn't allow to read/write file(local or mounted > > file) via qemu-ga, is right? > > I think it may depend on the file. Under /tmp, the default rule may allow > you to open/read it. Yes, tried again, you're right. > > TBH I don't know what level of support we want for qemu-ga functions that > are blacklisted... |
Description of problem: type=AVC msg=audit(1527666449.109:60162): avc: denied { read } for pid=514 comm="qemu-ga" name="/" dev="sdb" ino=2 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir type=SYSCALL msg=audit(1527666449.109:60162): arch=x86_64 syscall=open success=no exit=EACCES a0=55a746faf5c0 a1=80000 a2=0 a3=55a74573de90 items=0 ppid=1 pid=514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=qemu-ga exe=/usr/bin/qemu-ga subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null) Given it helps for the understanding of the issue: - /dev/sda1 mounted on /boot - /dev/sdb mounted on /var/www - /dev/sdc is swap - /dev/sdd mounted on / The wild mixture of /dev/sdX is caused by RHV, but not an issue here. Version-Release number of selected component (if applicable): qemu-guest-agent-2.8.0-2.el7.x86_64 httpd-2.4.6-80.el7.x86_64 selinux-policy-3.13.1-192.el7_5.3.noarch How reproducible: Not sure. Actual results: /usr/bin/qemu-ga tries to read root directory of other disk mount points. Expected results: If this is fine, it should be allowed in general in the SELinux policy. If it is not fine, qemu-guest-agent needs to be fixed.