Description of problem:
Looks like selinux policy does not know about virtiofs filesystem. So when
I do "chcon unconfined_u:object_r:admin_home_t:s0 /mnt/virtiofs/bar.txt", I
get error "-EOPNOTSUPP" from guest kernel.
Daniel Walsh mentioned that we need to modify selinux policy so that it knows about virtiofs. He opened a PR quickly.
Users want to support SELinux in guest and keep it disabled on host (for virtiofs). And package installation in guest is failing because restorecon
failed. Following is one of the reports.
Opening this bug to make sure we modify the policy to support this use case.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
Note a custom selinux policy module can be used to work around:
# echo '(fsuse xattr virtiofs (system_u object_r fs_t ((s0) (s0))))' > virtiofs.cil
# semodule -i virtiofs.cil
# seinfo --fs_use | grep virtiofs
fs_use_xattr virtiofs system_u:object_r:fs_t:s0;
(In reply to Zdenek Pytela from comment #1)
> Note a custom selinux policy module can be used to work around:
> # echo '(fsuse xattr virtiofs (system_u object_r fs_t ((s0) (s0))))' >
> # semodule -i virtiofs.cil
> # seinfo --fs_use | grep virtiofs
> fs_use_xattr virtiofs system_u:object_r:fs_t:s0;
Thanks. I tried it and it works for me. I can successfully change the label on virtiofs file.
This bz depends on bz#1915825, which may be in turn resolved with major kernel selinux subsystem backport in Red Hatbz#1934093.
Adding the rule as indicated in #c1 without the appropriate kernel change would lead to regression: new virtiofs mounts would have unlabeled_t type if the original fs did not support xattr or had selinux disabled.
Commit to backport:
Author: Daniel J Walsh <dwalsh>
Date: Fri Jan 29 10:46:20 2021 -0500
virtiofs supports Xattrs and SELinux
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
@Vivek Goyal Could you please share the buffer value received from host for the opcode fuse_xattribute from Guest.