Bug 2291273 - avc denied when connect to virtnetworkd by virt-admin
Summary: avc denied when connect to virtnetworkd by virt-admin
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-06-11 07:04 UTC by Han Han
Modified: 2024-07-09 13:21 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2024-07-09 13:21:04 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Han Han 2024-06-11 07:04:15 UTC
As the summary.
Version:
libvirt-10.4.0-2.fc41.x86_64
selinux-policy-41.2-1.fc41.noarch

Reproducible: Always

Steps to Reproduce:
# virt-admin -c virtnetworkd:///system 
error: Failed to connect to the admin server
error: Cannot recv data: Connection reset by peer

Audit log:
type=AVC msg=audit(1718089217.645:803522): avc:  denied  { search } for  pid=3942531 comm="virtnetworkd" name="3942735" dev="proc" ino=29488503 scontext=system_u:system_r:virtnetworkd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir permissive=0

Actual Results:  
As above

Expected Results:  
virt-admin login to the shell

Comment 1 Han Han 2024-06-11 07:13:53 UTC
It doesn't work on libvirt-10.1.0-2.fc40.x86_64 selinux-policy-40.20-1.fc40.noarch either

Comment 2 Milos Malik 2024-06-11 07:38:38 UTC
The following SELinux denial appeared in enforcing mode:
----
type=PROCTITLE msg=audit(06/11/2024 03:35:58.951:1746) : proctitle=/usr/sbin/virtnetworkd --timeout 120 
type=PATH msg=audit(06/11/2024 03:35:58.951:1746) : item=0 name=/proc/5741/stat nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(06/11/2024 03:35:58.951:1746) : cwd=/ 
type=SYSCALL msg=audit(06/11/2024 03:35:58.951:1746) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x55d5506deb30 a2=O_RDONLY a3=0x0 items=1 ppid=1 pid=5646 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=virtnetworkd exe=/usr/sbin/virtnetworkd subj=system_u:system_r:virtnetworkd_t:s0 key=(null) 
type=AVC msg=audit(06/11/2024 03:35:58.951:1746) : avc:  denied  { search } for  pid=5646 comm=virtnetworkd name=5741 dev="proc" ino=34144 scontext=system_u:system_r:virtnetworkd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir permissive=0 
----

The following SELinux denials appeared in permissive mode:
----
type=PROCTITLE msg=audit(06/11/2024 03:37:56.377:1776) : proctitle=/usr/sbin/virtnetworkd --timeout 120 
type=PATH msg=audit(06/11/2024 03:37:56.377:1776) : item=0 name=/proc/5773/stat inode=35154 dev=00:16 mode=file,444 ouid=root ogid=root rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(06/11/2024 03:37:56.377:1776) : cwd=/ 
type=SYSCALL msg=audit(06/11/2024 03:37:56.377:1776) : arch=x86_64 syscall=openat success=yes exit=18 a0=AT_FDCWD a1=0x55f3cb26cb90 a2=O_RDONLY a3=0x0 items=1 ppid=1 pid=5775 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=virtnetworkd exe=/usr/sbin/virtnetworkd subj=system_u:system_r:virtnetworkd_t:s0 key=(null) 
type=AVC msg=audit(06/11/2024 03:37:56.377:1776) : avc:  denied  { open } for  pid=5775 comm=virtnetworkd path=/proc/5773/stat dev="proc" ino=35154 scontext=system_u:system_r:virtnetworkd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file permissive=1 
type=AVC msg=audit(06/11/2024 03:37:56.377:1776) : avc:  denied  { read } for  pid=5775 comm=virtnetworkd name=stat dev="proc" ino=35154 scontext=system_u:system_r:virtnetworkd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file permissive=1 
type=AVC msg=audit(06/11/2024 03:37:56.377:1776) : avc:  denied  { search } for  pid=5775 comm=virtnetworkd name=5773 dev="proc" ino=35035 scontext=system_u:system_r:virtnetworkd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir permissive=1 
----

Comment 3 Milos Malik 2024-06-11 07:47:41 UTC
Using the virt-admin command, similar issues can be reproduced for other virt* services.

Comment 4 Milos Malik 2024-06-11 07:55:17 UTC
# for I in `find /usr/lib/systemd/system -type f -name virt\*.service | cut -d / -f 6 | cut -d . -f 1` ; do service $I start ; virt-admin -c $I:///system exit ; done

When all SELinux denials that appeared in enforcing mode are analyzed by audit2allow, the output looks this way:

#============= virtnetworkd_t ==============
allow virtnetworkd_t unconfined_t:dir search;
allow virtnetworkd_t unconfined_t:file { open read };

#============= virtnodedevd_t ==============
allow virtnodedevd_t unconfined_t:dir search;

#============= virtnwfilterd_t ==============
allow virtnwfilterd_t unconfined_t:dir search;

#============= virtsecretd_t ==============
allow virtsecretd_t unconfined_t:dir search;
allow virtsecretd_t unconfined_t:file { open read };

#============= virtstoraged_t ==============
allow virtstoraged_t unconfined_t:dir search;
allow virtstoraged_t unconfined_t:file { open read };

#============= virtvboxd_t ==============
allow virtvboxd_t unconfined_t:dir search;
allow virtvboxd_t unconfined_t:file { open read };

Comment 5 Milos Malik 2024-06-11 07:57:44 UTC
When all SELinux denials that appeared in permissive mode are analyzed by audit2allow, the output looks this way:

#============= virtnetworkd_t ==============
allow virtnetworkd_t unconfined_t:dir search;
allow virtnetworkd_t unconfined_t:file { open read };

#============= virtnodedevd_t ==============
allow virtnodedevd_t unconfined_t:dir search;
allow virtnodedevd_t unconfined_t:file { open read };

#============= virtnwfilterd_t ==============
allow virtnwfilterd_t unconfined_t:dir search;
allow virtnwfilterd_t unconfined_t:file { open read };

#============= virtsecretd_t ==============
allow virtsecretd_t unconfined_t:dir search;
allow virtsecretd_t unconfined_t:file { open read };

#============= virtstoraged_t ==============
allow virtstoraged_t unconfined_t:dir search;
allow virtstoraged_t unconfined_t:file { open read };

#============= virtvboxd_t ==============
allow virtvboxd_t unconfined_t:dir search;
allow virtvboxd_t unconfined_t:file { open read };

Comment 6 Milos Malik 2024-06-11 08:36:35 UTC
Test coverage for this bug exists in a form of PR:
 * https://src.fedoraproject.org/tests/selinux/pull-request/510

The PR waits for a review.


Note You need to log in before you can comment on or make changes to this bug.