Cross-filed ticket 02110190 at the Red Hat customer portal.

I have no idea whats going on in qemu-guest-agent. Moving to that component.

There are various commands that manipulate the mount points, but I am not sure how you could reach the read() error: guest-fstrim, guest-get-fsinfo, guest-fsfreeze* (and more that could, but are disabled by default)

I mounted a loopback file, and tried to reproduce the SElinux error by running various qemu-ga commands: without success.

Could you isolate the command triggering the error? 

thanks

I am sorry, we haven't been able to figure out a specific command, given we
also did not do anything "exotic" when it appeared.

It's not clear if it's qemu-ga fault or user fault. Let's keep it in needinfo state until we have a reproducer.

moving to 7.7

(In reply to Li Xiaohui from comment #8)
> Hi All,
> I tested this bug in kernel-3.10.0-862.el7.x86_64 &
> qemu-kvm-rhev-2.10.0-21.el7.x86_64 & qemu-guest-agent-2.8.0-2.el7.x86_64,
> get results like followings:
> 
> Test Steps:
> 1.Boot guest with one usb-storage and virtio-serial chardev as qemu-ga
> front-end:
> /usr/libexec/qemu-kvm -M pc \
> -cpu SandyBridge \
> -enable-kvm \
> -m 4G \
> -smp 4 \
> -rtc base=utc,clock=host,driftfix=slew \
> -device virtio-scsi-pci,id=scsi0,bus=pci.0,addr=0x6 \
> -drive
> file=/mnt/rhel-image/rhel75.qcow2,format=qcow2,if=none,id=drive-scsi0-0-0-0,
> media=disk,cache=none,werror=stop,rerror=stop \
> -device scsi-hd,bus=scsi0.0,drive=drive-scsi0-0-0-0,id=scsi0-0-0-0 \
> -device
> virtio-net-pci,mac=2c:76:8a:b0:e0:1c,id=netdev1,vectors=4,netdev=net1
> -netdev tap,id=net1,vhost=on \
> -device ich9-usb-uhci1,id=controller \
> -drive
> file=data1.qcow2,id=drive-storage0,if=none,media=disk,cache=none,
> format=qcow2 \
> -device usb-storage,drive=drive-storage0,bus=controller.0,id=storage0 \
> -chardev socket,id=serial0,path=/tmp/serial,server,nowait \
> -device isa-serial,chardev=serial0  \
> -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x7 \
> -chardev socket,path=/tmp/qga.sock,server,nowait,id=qga0 \
> -qmp tcp:0:4443,server,nowait \
> -vnc :3 \
> -monitor stdio \
> -vga qxl \
> -boot menu=on \
> 
> 2.After guest started, mount usb-storage to /var/www:
> [root@localhost /]# fdisk -l
> Disk /dev/sda: 53.7 GB, 53687091200 bytes, 104857600 sectors
> Units = sectors of 1 * 512 = 512 bytes
> Sector size (logical/physical): 512 bytes / 512 bytes
> I/O size (minimum/optimal): 512 bytes / 512 bytes
> Disk label type: dos
> Disk identifier: 0x0009c4dc
> 
>    Device Boot      Start         End      Blocks   Id  System
> /dev/sda1   *        2048     2099199     1048576   83  Linux
> /dev/sda2         2099200   104857599    51379200   8e  Linux LVM
> 
> ...
> 
> Disk /dev/sdb: 2147 MB, 2147483648 bytes, 4194304 sectors
> Units = sectors of 1 * 512 = 512 bytes
> Sector size (logical/physical): 512 bytes / 512 bytes
> I/O size (minimum/optimal): 512 bytes / 512 bytes
> [root@localhost ~]# mount /dev/sdb /var/www
> 
> 4.In guest, remove
> "guest-file-open,guest-file-close,guest-file-read,guest-file-write" from
> BLACKLIST_RPC in /etc/sysconfig/qemu-ga file.
> 
> 3.In guest, restart qemu-guest-agent service and keep selinux enabled
> 
> 4.On host, connect to qemu-ga via "nc -U"
> [root@hp-dl385g7-06 ~]# nc -U /tmp/qga.sock
> 
> 5.Try to open file through qemu-ga
> 
> 
> Actual Result:
> 1.open local file, it's successful, and nothing in /var/log/audit/audit.log
> from guest:
> [root@hp-dl385g7-06 ~]# nc -U /tmp/qga.sock
> {"execute":"guest-file-open","arguments":{"path":"/tmp/test","mode":"r"}}
> {"return": 1002}
> 
> 2.open mounted file, permission denied, and get some log in
> /var/log/audit/audit.log from guest:
> [root@hp-dl385g7-06 ~]# nc -U /tmp/qga.sock
> {"execute":"guest-file-open","arguments":{"path":"/dev/sdb","mode":"r"}}
> {"error": {"class": "GenericError", "desc": "failed to open file '/dev/sdb'
> (mode: 'r'): Permission denied"}}

Opening the device itself is probably not what you wanted. I guess you wanted to check a mounted file. 

> 
> [root@localhost /]# cat /var/log/audit/audit.log
> type=AVC msg=audit(1543476888.274:511): avc:  denied  { read } for  pid=701
> comm="qemu-ga" name="sdb" dev="devtmpfs" ino=14026
> scontext=system_u:system_r:virt_qemu_ga_t:s0
> tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
> type=SYSCALL msg=audit(1543476888.274:511): arch=c000003e syscall=2
> success=no exit=-13 a0=55bde85c5520 a1=900 a2=0 a3=4000 items=0 ppid=1
> pid=701 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> fsgid=0 tty=(none) ses=4294967295 comm="qemu-ga" exe="/usr/bin/qemu-ga"
> subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null)
> 
> 
> Robert,
> Is Actual Result's 2 your expected reproduce result?
> 
> Marc-Andre,
> when selinux is enabled, shouldn't allow to read/write file(local or mounted
> file) via qemu-ga, is right? 

I think it may depend on the file. Under /tmp, the default rule may allow you to open/read it. 

TBH I don't know what level of support we want for qemu-ga functions that are blacklisted...

(In reply to Marc-Andre Lureau from comment #9)
> > Actual Result:
> > 1.open local file, it's successful, and nothing in /var/log/audit/audit.log
> > from guest:
> > [root@hp-dl385g7-06 ~]# nc -U /tmp/qga.sock
> > {"execute":"guest-file-open","arguments":{"path":"/tmp/test","mode":"r"}}
> > {"return": 1002}
> > 
> > 2.open mounted file, permission denied, and get some log in
> > /var/log/audit/audit.log from guest:
> > [root@hp-dl385g7-06 ~]# nc -U /tmp/qga.sock
> > {"execute":"guest-file-open","arguments":{"path":"/dev/sdb","mode":"r"}}
> > {"error": {"class": "GenericError", "desc": "failed to open file '/dev/sdb'
> > (mode: 'r'): Permission denied"}}
> 
> Opening the device itself is probably not what you wanted. I guess you
> wanted to check a mounted file. 
emmm, I just want to reproduce this bug, and make audit.log is more similar to Comment 1.

and found only when selinux is enabled, then can get similar log in guest's audit.log
> 
> > 
> > [root@localhost /]# cat /var/log/audit/audit.log
> > type=AVC msg=audit(1543476888.274:511): avc:  denied  { read } for  pid=701
> > comm="qemu-ga" name="sdb" dev="devtmpfs" ino=14026
> > scontext=system_u:system_r:virt_qemu_ga_t:s0
> > tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
> > type=SYSCALL msg=audit(1543476888.274:511): arch=c000003e syscall=2
> > success=no exit=-13 a0=55bde85c5520 a1=900 a2=0 a3=4000 items=0 ppid=1
> > pid=701 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> > fsgid=0 tty=(none) ses=4294967295 comm="qemu-ga" exe="/usr/bin/qemu-ga"
> > subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null)
> > 
> > 
> > Robert,
> > Is Actual Result's 2 your expected reproduce result?
> > 
> > Marc-Andre,
> > when selinux is enabled, shouldn't allow to read/write file(local or mounted
> > file) via qemu-ga, is right? 
> 
> I think it may depend on the file. Under /tmp, the default rule may allow
> you to open/read it. 
Yes, tried again, you're right.
> 
> TBH I don't know what level of support we want for qemu-ga functions that
> are blacklisted...