Bug 1618839

Cross-filed case 02164447 at the Red Hat customer portal.

On another system where SELinux was not enforced it looks like this:

type=AVC msg=audit(1534508009.175:75922): avc:  denied  { read } for  pid=594 comm="qemu-ga" name="utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508009.175:75922): avc:  denied  { open } for  pid=594 comm="qemu-ga" path="/run/utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508009.176:75923): avc:  denied  { lock } for  pid=594 comm="qemu-ga" path="/run/utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508019.173:75924): avc:  denied  { read } for  pid=594 comm="qemu-ga" name="utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508019.173:75924): avc:  denied  { open } for  pid=594 comm="qemu-ga" path="/run/utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508019.174:75925): avc:  denied  { lock } for  pid=594 comm="qemu-ga" path="/run/utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508039.179:75988): avc:  denied  { read } for  pid=594 comm="qemu-ga" name="utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508039.179:75988): avc:  denied  { open } for  pid=594 comm="qemu-ga" path="/run/utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508039.180:75989): avc:  denied  { lock } for  pid=594 comm="qemu-ga" path="/run/utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508049.173:75997): avc:  denied  { read } for  pid=594 comm="qemu-ga" name="utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508049.173:75997): avc:  denied  { open } for  pid=594 comm="qemu-ga" path="/run/utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508049.173:75998): avc:  denied  { lock } for  pid=594 comm="qemu-ga" path="/run/utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508069.183:76011): avc:  denied  { read } for  pid=594 comm="qemu-ga" name="utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508069.183:76011): avc:  denied  { open } for  pid=594 comm="qemu-ga" path="/run/utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508069.183:76012): avc:  denied  { lock } for  pid=594 comm="qemu-ga" path="/run/utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508079.177:76031): avc:  denied  { read } for  pid=594 comm="qemu-ga" name="utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508079.177:76031): avc:  denied  { open } for  pid=594 comm="qemu-ga" path="/run/utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1534508079.177:76032): avc:  denied  { lock } for  pid=594 comm="qemu-ga" path="/run/utmp" dev="tmpfs" ino=13468 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file

Regarding "How reproducible": This likely happened on all guests during
upgrade from RHV 4.1 to RHV 4.2 on the RHV-H systems (interestingly, I do
not see any /usr/share/ovirt-guest-agent/* log stuff on other systems
around the same time, but before or after the AVC denied messages showed
up).

Hi all:

The reproduce step as follow, the Bug can be reproduce in RHEL7.6 on RHEL7.6 host. 

Step [1]: Boot the guest:
/usr/libexec/qemu-kvm -enable-kvm -M pc -cpu host -nodefaults -smp 4 -m 2G -name 001 \
-device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x7 -chardev socket,path=/tmp/qga.sock,server,nowait,id=qga0 -device virtserialport,bus=virtio-serial0.0,chardev=qga0,name=org.qemu.guest_agent.0 \
-vga qxl -monitor stdio -boot menu=on -vnc :2 \
-netdev tap,id=hostnet0 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=74:46:a0:8e:10:1a \
-drive file=/home/choma/rhel-7.6-915.qcow2,if=none,id=guest-img,format=qcow2,werror=stop,rerror=stop -device virtio-blk-pci,drive=guest-img,id=os-disk,bootindex=1

Make sure the qemu-guest-agent.service is at active running.


Step [2]:Open the socket in host
(host)#nc -U /tmp/qga.sock 

{"execute":"guest-file-open","arguments":{"path":"/run/utmp","mode":"r"}}
{"error": {"class": "GenericError", "desc": "failed to open file '/run/utmp' (mode: 'r'): Permission denied"}}

The Bug is reproduced. 

Step [3]: Then reset the SElinux in guest:
(guest)#setenforce 0 
(guest)#getenforce 
Permissive

Step [4]: reopen the socket and try to read the document:
{"execute":"guest-file-open","arguments":{"path":"/run/utmp","mode":"r"}}
{"return": 1000}

{"execute":"guest-file-read", "arguments":{"handle":1000,"count":1024}}
{"return": {"count": 1024, "buf-b64": "AgAAAAAAAAB+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH5+AAByZWJvb3QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADMuMTAuMC04NjIuMTMuMS5lbDcueDg2XzY0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC9NeltDkgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAADUAAAB+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH5+AABydW5sZXZlbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADMuMTAuMC04NjIuMTMuMS5lbDcueDg2XzY0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADJNelvBzg0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwAAAHsJAAA6MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAByb290AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADowAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==", "eof": false}}


{"execute":"guest-file-close", "arguments":{"handle":1000}}
{"return": {}}


The issue is gone. 


The system log as follow when the problem is happened:

Aug 20 13:57:41 dhcp-8-181 qemu-ga: info: guest-file-open called, filepath: /run/utmp, mode: r
Aug 20 13:57:44 dhcp-8-181 dbus[691]: [system] Activating service name='org.fedoraproject.Setroubleshootd' (using servicehelper)
Aug 20 13:57:44 dhcp-8-181 dbus[691]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd'
Aug 20 13:57:45 dhcp-8-181 setroubleshoot: SELinux is preventing qemu-ga from read access on the file utmp. For complete SELinux messages run: sealert -l f0ff3f34-d875-4238-96c3-2ff6c7f9898c
Aug 20 13:57:45 dhcp-8-181 python: SELinux is preventing qemu-ga from read access on the file utmp.#012#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012If you believe that qemu-ga should be allowed read access on the utmp file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'qemu-ga' --raw | audit2allow -M my-qemuga#012# semodule -i my-qemuga.pp#012


Thanks

(In reply to Michael from comment #5)
> Hi all:
> 
> The reproduce step as follow, the Bug can be reproduce in RHEL7.6 on RHEL7.6
> host. 
> 
> Step [1]: Boot the guest:
> /usr/libexec/qemu-kvm -enable-kvm -M pc -cpu host -nodefaults -smp 4 -m 2G
> -name 001 \
> -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x7 -chardev
> socket,path=/tmp/qga.sock,server,nowait,id=qga0 -device
> virtserialport,bus=virtio-serial0.0,chardev=qga0,name=org.qemu.guest_agent.0
> \
> -vga qxl -monitor stdio -boot menu=on -vnc :2 \
> -netdev tap,id=hostnet0 -device
> virtio-net-pci,netdev=hostnet0,id=net0,mac=74:46:a0:8e:10:1a \
> -drive
> file=/home/choma/rhel-7.6-915.qcow2,if=none,id=guest-img,format=qcow2,
> werror=stop,rerror=stop -device
> virtio-blk-pci,drive=guest-img,id=os-disk,bootindex=1
> 
> Make sure the qemu-guest-agent.service is at active running.
> 
> 
> Step [2]:Open the socket in host
> (host)#nc -U /tmp/qga.sock 
> 
> {"execute":"guest-file-open","arguments":{"path":"/run/utmp","mode":"r"}}
> {"error": {"class": "GenericError", "desc": "failed to open file '/run/utmp'
> (mode: 'r'): Permission denied"}}
> 
> The Bug is reproduced. 
> 
> Step [3]: Then reset the SElinux in guest:
> (guest)#setenforce 0 
> (guest)#getenforce 
> Permissive
> 
> Step [4]: reopen the socket and try to read the document:
> {"execute":"guest-file-open","arguments":{"path":"/run/utmp","mode":"r"}}
> {"return": 1000}
> 
> {"execute":"guest-file-read", "arguments":{"handle":1000,"count":1024}}
> {"return": {"count": 1024, "buf-b64":
> "AgAAAAAAAAB+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH5+AAByZWJvb3QAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAADMuMTAuMC04NjIuMTMuMS5lbDcueDg2XzY0AAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC9NeltDk
> gUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAADUAAAB+AAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAH5+AABydW5sZXZlbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADM
> uMTAuMC04NjIuMTMuMS5lbDcueDg2XzY0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADJNelvBzg0AAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAABwAAAHsJAAA6MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAByb290AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADowAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==", "eof": false}}
> 
> 
> {"execute":"guest-file-close", "arguments":{"handle":1000}}
> {"return": {}}
> 
> 
> The issue is gone. 
> 
> 
> The system log as follow when the problem is happened:
> 
> Aug 20 13:57:41 dhcp-8-181 qemu-ga: info: guest-file-open called, filepath:
> /run/utmp, mode: r
> Aug 20 13:57:44 dhcp-8-181 dbus[691]: [system] Activating service
> name='org.fedoraproject.Setroubleshootd' (using servicehelper)
> Aug 20 13:57:44 dhcp-8-181 dbus[691]: [system] Successfully activated
> service 'org.fedoraproject.Setroubleshootd'
> Aug 20 13:57:45 dhcp-8-181 setroubleshoot: SELinux is preventing qemu-ga
> from read access on the file utmp. For complete SELinux messages run:
> sealert -l f0ff3f34-d875-4238-96c3-2ff6c7f9898c
> Aug 20 13:57:45 dhcp-8-181 python: SELinux is preventing qemu-ga from read
> access on the file utmp.#012#012*****  Plugin catchall (100. confidence)
> suggests   **************************#012#012If you believe that qemu-ga
> should be allowed read access on the utmp file by default.#012Then you
> should report this as a bug.#012You can generate a local policy module to
> allow this access.#012Do#012allow this access for now by executing:#012#
> ausearch -c 'qemu-ga' --raw | audit2allow -M my-qemuga#012# semodule -i
> my-qemuga.pp#012
> 
> 
> Thanks

The Version-Release number as follow:
[1] qemu-guest-agent-2.12.0-2.el7.x86_64
[2] selinux-policy-3.13.1-202.el7.noarch

qmp_guest_get_users() calls getutxent()

stracing getutxent() shows that it needs to able to read: /var/run/utmpx and/or /var/run/utmp etc. 

SELinux maintainers may be familiar with that libc call, reassigning

When is this going to be addressed? This affects RHEL 7.5 guests on RHV 4.2.

# matchpathcon /var/run/utmp 
/var/run/utmp	system_u:object_r:initrc_var_run_t:s0
# sesearch -s virt_qemu_ga_t -t initrc_var_run_t -c file -p read -A -C
Found 1 semantic av rules:
   allow virt_qemu_ga_t initrc_var_run_t : file { ioctl read getattr lock open } ; 

# rpm -qa selinux\* | sortselinux-policy-3.13.1-226.el7.noarch
selinux-policy-devel-3.13.1-226.el7.noarch
selinux-policy-doc-3.13.1-226.el7.noarch
selinux-policy-minimum-3.13.1-226.el7.noarch
selinux-policy-mls-3.13.1-226.el7.noarch
selinux-policy-sandbox-3.13.1-226.el7.noarch
selinux-policy-targeted-3.13.1-226.el7.noarch
# 

Will be fixed as soon as RHEL-7.6 GA.

I believe this bug is a duplicate of BZ#1571202.

*** This bug has been marked as a duplicate of bug 1571202 ***

This is still an issue in RHEL 7.6.  Our audit logs are full of entries similar to below.  All packages included selinux-policy have been updated.

type=PROCTITLE msg=audit(1550172885.138:415972): proctitle=2F7573722F62696E2F71656D752D6761002D2D6D6574686F643D76697274696F2D73657269616C002D2D706174683D2F6465762F76697274696F2D706F7274732F6F72672E71656D752E67756573745F6167656E742E30002D2D626C61636B6C6973743D67756573742D66696C652D6F70656E2C67756573742D66696C652D63
type=AVC msg=audit(1550172885.138:415973): avc:  denied  { read } for  pid=28138 comm="qemu-ga" name="dev" dev="proc" ino=4026531976 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file

The SELinux denial mentioned in comment#12 is addressed in BZ#1630347 and the fix will be part of RHEL-7.7.