Bug 607268 - QEMU not allowed to access fifo files labelled as svirt_image_t
QEMU not allowed to access fifo files labelled as svirt_image_t
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
6.0
All Linux
low Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
Milos Malik
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-06-23 12:40 EDT by Daniel Berrange
Modified: 2012-10-15 10:27 EDT (History)
3 users (show)

See Also:
Fixed In Version: selinux-policy-3.7.19-28.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-11-10 16:34:52 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Daniel Berrange 2010-06-23 12:40:11 EDT
Description of problem:

I've been working on fixing SELinux labelling in svirt for character devices in QEMU, eg a vmchannel:

    <channel type='pipe'>
      <source path='/var/lib/libvirt/channel-bar'/>
      <target type='virtio' name='org.linux-kvm.port.bar'/>
      <address type='virtio-serial' controller='0' bus='0' port='1'/>
    </channel>

The /var/lib/libvirt/channel-bar is a fifo file (as created by mkfifo).

I have libvirt labelling this with  system_u:object_r:svirt_image_t:s0:c265,c657, but the policy still denies it

type=AVC msg=audit(1277307748.996:31411): avc:  denied  { read write } for  pid=23742 comm="qemu-kvm" name="channel-bar.out" dev=dm-1 ino=12135 scontext=system_u:system_r:svirt_t:s0:c265,c657 tcontext=system_u:object_r:svirt_image_t:s0:c265,c657 tclass=fifo_file


We need to allow access to fifo_file when it is appropriately labeled with the guest's MCS category.


Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-24.el6.noarch

How reproducible:
Always

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:
Comment 2 RHEL Product and Program Management 2010-06-23 12:52:59 EDT
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.
Comment 3 Daniel Walsh 2010-06-25 15:29:14 EDT
Miroslav add 
manage_fifo_files_pattern(svirt_t, svirt_image_t, svirt_image_t)

To virt.te
Comment 4 Daniel Walsh 2010-06-25 15:33:07 EDT
Actually we want to add

	manage_fifo_files_pattern($1_t, $1_image_t, $1_image_t)

To virt_domain_template
Comment 5 Miroslav Grepl 2010-06-29 11:32:37 EDT
Fixed in selinux-policy-3.7.19-28.el6.noarch
Comment 9 releng-rhel@redhat.com 2010-11-10 16:34:52 EST
Red Hat Enterprise Linux 6.0 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.

Note You need to log in before you can comment on or make changes to this bug.