Bug 543941
| Summary: | The new vhostmd daemon runs under 'initrc_t' context & triggers AVCs | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Daniel Berrangé <berrange> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | 5.4 | CC: | dwalsh, fdanapfe, mgrepl, mmalik, mwaite, rdoty, rjones |
| Target Milestone: | rc | ||
| Target Release: | 5.5 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-03-30 07:49:28 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 514579 | ||
| Bug Blocks: | 514577 | ||
|
Description
Daniel Berrangé
2009-12-03 14:51:02 UTC
Miroslav, can you write a policy for F12/Rawhide, that we can get tested and maybe backport to RHEL5 We use the same configuration in Rawhide and RHEL 5.x, so you can have a look at the commands that vhostmd runs in the configuration file: http://cvs.fedoraproject.org/viewvc/devel/vhostmd/vhostmd.conf?view=markup (look for <action>...</action>) eg: It will run this command every 60 seconds: virsh -r CONNECT version | grep API | gawk -F': ' '{print $2}' The magic word "CONNECT" is replaced by some connection URI, or possibly by nothing. This depends on how the system administrator has adjusted the file /etc/sysconfig/vhostmd. The default file is here: http://cvs.fedoraproject.org/viewvc/devel/vhostmd/vhostmd.sysconfig?view=markup As noted above, because the virsh command isn't running as root (it runs as special user:group vhostmd:vhostmd), it will probably spawn some external program in the Xen case, or connect to libvirtd in the KVM case. <SNIP> S 09:45 0:00 /usr/sbin/vhostmd --user vhostmd --connect xen:/// <END SNIP> I am not the brightest bulb on the tree but please affirm that you are making this policy for KVM yes? The business driver is SAP certification for RHEV which we do not have which is allowing for Novell to compete against us in this workload. Any SELinux policy testing for XEN should be secondary to KVM because there is no need: SAP certified Xen already and does not require vmhostd. Keep in mind that vmhostd is the solution to SAP's change in certification requirements after Xen was certified. > I am not the brightest bulb on the tree but please affirm that you are making
> this policy for KVM yes?
The policy is for vhostmd, and it should work regardless of what hypervisor is in use, because it uses libvirt.
Yeah Dan's right I think. vhostmd itself connects via libvirt to get the list of domains, and then all the metrics gathering happens by running external commands (eg. virsh). There shouldn't be any direct access to Xen or KVM. You can change the libvirt connection URL by editing /etc/sysconfig/vhostmd (the VHOSTMD_URI setting). Miroslav, is the policy done now? Richard, yes, the policy is done. Fixed in selinux-policy-2.4.6-266.el5.noarch An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2010-0182.html |