Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 958839 - Cgroup audit events with path are not escaped
Cgroup audit events with path are not escaped
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libvirt (Show other bugs)
6.4
Unspecified Unspecified
urgent Severity urgent
: rc
: ---
Assigned To: Eric Blake
Virtualization Bugs
: ZStream
Depends On: 922203
Blocks:
  Show dependency tree / graph
 
Reported: 2013-05-02 09:55 EDT by Chris Pelland
Modified: 2013-05-16 10:34 EDT (History)
21 users (show)

See Also:
Fixed In Version: libvirt-0.10.2-18.el6_4.5
Doc Type: Bug Fix
Doc Text:
Previously, libvirt used the wrong variable when constructing audit messages. This led to invalid audit messages, causing ausearch to format certain entries as having "path=(null)" instead of the correct path. This could prevent ausearch from locating events related to cgroup device ACL modifications for guests managed by libvirt. With this update, the audit messages are generated correctly, preventing loss of audit coverage.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-05-16 10:34:45 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0831 normal SHIPPED_LIVE Moderate: libvirt security and bug fix update 2013-05-16 14:33:32 EDT

  None (edit)
Description Chris Pelland 2013-05-02 09:55:22 EDT 
This bug has been copied from bug #922203 and has been proposed
to be backported to 6.4 z-stream (EUS).
Comment 6 Huang Wenlong 2013-05-05 23:26:54 EDT 
Hi, Eric
I try to verify this bug with libvirt-0.10.2-18.el6_4.5.x86_64
But I still get some log in audit like the issue one  
Is there some new issues ?

steps : 
1) start a vm 

2) 

#ausearch --start recent -m VIRT_RESOURCE -i  | grep cgroup | grep '/dev'

...
type=VIRT_RESOURCE msg=audit(06/05/13 11:21:08.388:37064) : user pid=30449 uid=root auid=root ses=2388 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup reason=allow vm=s uuid=f3641c4c-7174-3464-6682-0d0cdfa9c3bd cgroup=/cgroup/devices/libvirt/qemu/s/ class=path path=/dev/hpet rdev=0A:E4 acl=rw exe=/usr/sbin/libvirtd hostname=? addr=? terminal=? res=success' 

...

3)
$ rpm -q libvirt
libvirt-0.10.2-18.el6_4.5.x86_64
Comment 7 Huang Wenlong 2013-05-06 05:53:01 EDT 
#rpm -q libvirt
libvirt-0.10.2-18.el6_4.5.x86_64



#virsh start s 

#cat /var/log/audit/audit.log  |grep cgroup

type=VIRT_RESOURCE msg=audit(1367833495.894:37444): user pid=1183 uid=0 auid=0 ses=2388 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup reason=deny vm="s" uuid=f3641c4c-7174-3464-6682-0d0cdfa9c3bd cgroup="/cgroup/devices/libvirt/qemu/s/" class=all exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1367833495.894:37445): user pid=1183 uid=0 auid=0 ses=2388 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup reason=allow vm="s" uuid=f3641c4c-7174-3464-6682-0d0cdfa9c3bd cgroup="/cgroup/devices/libvirt/qemu/s/" class=major category=pty maj=88 acl=rw exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1367833495.894:37446): user pid=1183 uid=0 auid=0 ses=2388 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup reason=allow vm="s" uuid=f3641c4c-7174-3464-6682-0d0cdfa9c3bd cgroup="/cgroup/devices/libvirt/qemu/s/" class=path path="/dev/null" rdev=01:03 acl=rw exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1367833495.894:37447): user pid=1183 uid=0 auid=0 ses=2388 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup reason=allow vm="s" uuid=f3641c4c-7174-3464-6682-0d0cdfa9c3bd cgroup="/cgroup/devices/libvirt/qemu/s/" class=path path="/dev/full" rdev=01:07 acl=rw exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1367833495.895:37448): user pid=1183 uid=0 auid=0 ses=2388 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup reason=allow vm="s" uuid=f3641c4c-7174-3464-6682-0d0cdfa9c3bd cgroup="/cgroup/devices/libvirt/qemu/s/" class=path path="/dev/zero" rdev=01:05 acl=rw exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1367833495.895:37449): user pid=1183 uid=0 auid=0 ses=2388 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup reason=allow vm="s" uuid=f3641c4c-7174-3464-6682-0d0cdfa9c3bd cgroup="/cgroup/devices/libvirt/qemu/s/" class=path path="/dev/random" rdev=01:08 acl=rw exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1367833495.895:37450): user pid=1183 uid=0 auid=0 ses=2388 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup reason=allow vm="s" uuid=f3641c4c-7174-3464-6682-0d0cdfa9c3bd cgroup="/cgroup/devices/libvirt/qemu/s/" class=path path="/dev/urandom" rdev=01:09 acl=rw exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1367833495.895:37451): user pid=1183 uid=0 auid=0 ses=2388 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup reason=allow vm="s" uuid=f3641c4c-7174-3464-6682-0d0cdfa9c3bd cgroup="/cgroup/devices/libvirt/qemu/s/" class=path path="/dev/ptmx" rdev=05:02 acl=rw exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1367833495.895:37452): user pid=1183 uid=0 auid=0 ses=2388 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup reason=allow vm="s" uuid=f3641c4c-7174-3464-6682-0d0cdfa9c3bd cgroup="/cgroup/devices/libvirt/qemu/s/" class=path path="/dev/kvm" rdev=0A:E8 acl=rw exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1367833495.895:37453): user pid=1183 uid=0 auid=0 ses=2388 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup reason=allow vm="s" uuid=f3641c4c-7174-3464-6682-0d0cdfa9c3bd cgroup="/cgroup/devices/libvirt/qemu/s/" class=path path="/dev/rtc" rdev=FE:00 acl=rw exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
type=VIRT_RESOURCE msg=audit(1367833495.895:37454): user pid=1183 uid=0 auid=0 ses=2388 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup reason=allow vm="s" uuid=f3641c4c-7174-3464-6682-0d0cdfa9c3bd cgroup="/cgroup/devices/libvirt/qemu/s/" class=path path="/dev/hpet" rdev=0A:E4 acl=rw exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
Comment 8 Eric Blake 2013-05-06 08:29:28 EDT 
(In reply to comment #6)
> Hi, Eric
> I try to verify this bug with libvirt-0.10.2-18.el6_4.5.x86_64
> But I still get some log in audit like the issue one  
> Is there some new issues ?

You _want_ audit log entries.  The bug was that since the audit entries were malformed, the grep would previously list nothing.

> #ausearch --start recent -m VIRT_RESOURCE -i  | grep cgroup | grep '/dev'

This command would fail when the bug was present, but should now have hits.

> 
> ...
> type=VIRT_RESOURCE msg=audit(06/05/13 11:21:08.388:37064) : user pid=30449
> uid=root auid=root ses=2388
> subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup
> reason=allow vm=s uuid=f3641c4c-7174-3464-6682-0d0cdfa9c3bd
> cgroup=/cgroup/devices/libvirt/qemu/s/ class=path path=/dev/hpet rdev=0A:E4

When libvirt was broken, ausearch would say path=(null) instead of path=/dev/hpet.

(In reply to comment #7)

> type=VIRT_RESOURCE msg=audit(1367833495.894:37446): user pid=1183 uid=0
> auid=0 ses=2388 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023
> msg='virt=kvm resrc=cgroup reason=allow vm="s"
> uuid=f3641c4c-7174-3464-6682-0d0cdfa9c3bd
> cgroup="/cgroup/devices/libvirt/qemu/s/" class=path path="/dev/null"
> rdev=01:03 acl=rw exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=?
> res=success'

and when libvirt was broken, audit.log would say path=/dev/null instead of the correct path="/dev/null".

You have verified that the fix made it in.
Comment 9 Huang Wenlong 2013-05-06 22:27:26 EDT 
Thanks very much Eric 

set Verified according to Comment 8
Comment 11 errata-xmlrpc 2013-05-16 10:34:45 EDT 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0831.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.