Bug 1782615 - Incomplete SELinux policy for virt_qemu_ga_t
Summary: Incomplete SELinux policy for virt_qemu_ga_t
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-guest-agent
Version: 7.6
Hardware: x86_64
OS: Linux
Target Milestone: rc
: ---
Assignee: Marc-Andre Lureau
QA Contact: xiagao
Depends On: 1779358
TreeView+ depends on / blocked
Reported: 2019-12-11 23:58 UTC by sawozny
Modified: 2020-02-28 07:25 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2020-02-03 15:48:50 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description sawozny 2019-12-11 23:58:44 UTC
Description of problem: When I attempt to create a snapshot in virsh on a machine with a second disk with a mysql instance on that mount point, the snapshot fails and the error message references the mount point of the second disk.  SELinux audit2allow shows missing capabilities for the qemu guest agent type.

Version-Release number of selected component (if applicable): EL 7.6; qemu-guest-agent.x86_64 - 10:2.12.0-2.el7

How reproducible: Every time

Steps to Reproduce:
1. On the host, install the qemu-ev repo and qemu-kvm-ev on top of qemu-kvm (so snapshot-create works)
2. Create a guest machine with a min install and qemu guest agent
3. Add a second disk on the host with qemu-img create and virsh attach-disk to the guest.
4. On the guest, format and mount the disk to /var/lib/mysql
5. On the guest, install Mysql (I used 5.7) and run it (this problem doesn't happen when the second disk is empty as a pure test) also note you'll need to add ignore-db-dir=lost+found to the [mysqld] section of the config file before your first run or mysql environment will refuse to manifest in the non-empty directory.
6. On the host in virsh, run a: snapshot-create-as <DOMAIN_NAME> test.snap --disk-only --quiesce --atomic

Actual results: error: internal error: unable to execute QEMU agent command 'guest-fsfreeze-freeze': failed to open /var/lib/mysql: Permission denied

audit2allow -a shows:
#============= virt_qemu_ga_t ==============
allow virt_qemu_ga_t self:capability { dac_override dac_read_search };

Expected results: Successful creation of snapshot

Additional info: Workarounds are to allow virt_qemu_ga_t to run in permissive mode while working with the snapped machine.  Also could add custom policy to address this, but I believe the production policy for this type is incomplete.  This was done on a CentOS 7.6 VM running on a CentOS 7.6 host, but I don't think the results on RHEL will be different.

Comment 5 John Ferlan 2020-02-03 15:48:50 UTC
Seeing as the dependent bz was closed as wontfix, so doing the same here.

Seems as though the SElinux level adjustments for RHEL7 would require more justification and a workaround exists (writing a custom policy), thus there are no plans to alter the RHEL7 default policies to resolve.

Comment 6 sawozny 2020-02-03 19:20:07 UTC
I don't agree that this should be closed as a won't fix, but not being a RH customer I'm only shouting into the wind.  

There is a clear gap in default policy that is not related to custom work, but will be found by any user who tries to snapshot and quiesce a machine with a USED off-disk mount point.  

When I hear people push back against setting SELinux to enforce and then see demonstrable out-of-the-box policy errors going unfixed I really can't blame them for feeling that way.

But at least this bug is now part of the public record and people affected by it will know the cause and how to work around it when they encounter it.  

I predict it will eventually be "discovered" and fixed in policy but probably only when an actual RH customer pushes the point.

In the meantime, I have my workaround so while I'm disappointed in this result, I thank everyone involved for their time.

Note You need to log in before you can comment on or make changes to this bug.