Bug 968303 - Can't find the "detach" event for the auvirt command
Can't find the "detach" event for the auvirt command
Status: ASSIGNED
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: audit (Show other bugs)
7.0
x86_64 Linux
medium Severity medium
: rc
: ---
Assigned To: Steve Grubb
Ondrej Moriš
: Reopened
Depends On:
Blocks: 1476406
  Show dependency treegraph
 
Reported: 2013-05-29 08:28 EDT by zhenfeng wang
Modified: 2017-07-30 11:53 EDT (History)
10 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 968304 (view as bug list)
Environment:
Last Closed: 2014-02-19 03:46:35 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description zhenfeng wang 2013-05-29 08:28:03 EDT
Description of problem:
Can't find the "detach" event for the auvirt  command

Version-Release number of selected component (if applicable):
libvirt-1.0.5-2.el7.x86_64
kernel-3.9.0-0.55.el7.x86_64
qemu-kvm-1.4.0-4.el7.x86_64
libselinux-2.1.13-15.el7.x86_64
libselinux-utils-2.1.13-15.el7.x86_64
selinux-policy-targeted-3.12.1-46.el7.noarch
libselinux-python-2.1.13-15.el7.x86_64
selinux-policy-3.12.1-46.el7.noarch
audit-libs-2.3-2.el7.x86_64
audit-2.3-2.el7.x86_64
How reproducible:
100%

Steps
1. prepare a running guest
virsh list
 Id    Name                           State
----------------------------------------------------
 2     rhel7qcow2                     running

2.create a img
# qemu-img create -f qcow2 /var/lib/libvirt/images/test3.img 1G
Formatting '/var/lib/libvirt/images/test3.img', fmt=qcow2 size=1073741824 encryption=off cluster_size=65536 lazy_refcounts=off
3.attach the disk, then detach it
# virsh attach-disk rhel7qcow2 /var/lib/libvirt/images/test3.img vdb
Disk attached successfully

# virsh detach-disk rhel7qcow2 vdb
Disk detached successfully

4.check the audit log with ausearch, both the "attach" event and "detach"event can be found with ausearch command
# ausearch -m VIRT_RESOURCE --start recent |grep disk
type=VIRT_RESOURCE msg=audit(1369807593.539:511): pid=1720 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=attach vm="rhel7qcow2" uuid=5dc40c41-9ea2-4a44-9019-59dc56a1ef15 old-disk="?" new-disk="/var/lib/libvirt/images/test3.img" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'

type=VIRT_RESOURCE msg=audit(1369807640.676:512): pid=1720 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=detach vm="rhel7qcow2" uuid=5dc40c41-9ea2-4a44-9019-59dc56a1ef15 old-disk="/var/lib/libvirt/images/test3.img" new-disk="?" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'

5.check the audit log with auvirt again, we can just see the "attach" event ,can't find the "detach" event
# auvirt --all-events --start recent |grep disk
res   rhel7qcow2                       root               Wed May 29 14:06 - 14:07  (00:00)          disk                attach            /var/lib/libvirt/images/test3.img

6.this didn't work for "net" either.

7.the rhel6 has the same issue also.

Actual results:
Can't find the "detach" event with auvirt command

Expected results:
should find the "detach" event successfully ,which just like the "attach" event
Comment 2 Miroslav Grepl 2013-06-03 15:59:39 EDT
Any AVC messages?
Comment 3 zhenfeng wang 2013-06-03 21:35:23 EDT
Hi Miroslav
sorry to don't find any AVC messages in the audit.log
Comment 4 Miroslav Grepl 2013-10-03 17:05:14 EDT
Are you still getting this issue?
Comment 5 zhenfeng wang 2014-02-19 06:04:14 EST
Hi Miroslav
I'm so sorry to reply you so late , since i miss your needinfo before, i just re-test the comment0's steps with my latest environment, find that i can still hit this issue, and i found that it'll generate a deny event while i check the audit log with auvirt command after i detach the disk. I miss this event previous, I hope you help me have a look, thanks. BTW, since i can still reproduce this issue, so i think that we'd better re-open this bug, right ?

pkg info
qemu-kvm-rhev-1.5.3-47.el7.x86_64
libvirt-1.1.1-23.el7.x86_64
kernel-3.10.0-87.el7.x86_64
selinux-policy-3.12.1-125.el7.noarch
libselinux-2.2.2-5.el7.x86_64

steps
1. prepare a running guest
virsh list
 Id    Name                           State
----------------------------------------------------
 2     rhel75                       running

2.create a img
# qemu-img create -f qcow2 /var/lib/libvirt/images/test.img 1G
Formatting '/var/lib/libvirt/images/test.img', fmt=qcow2 size=1073741824 encryption=off cluster_size=65536 lazy_refcounts=off
3.attach the disk, then detach it
# virsh attach-disk rhel7qcow2 /var/lib/libvirt/images/test.img vdb
Disk attached successfully

# virsh detach-disk rhel75 vdb
Disk detached successfully

4.check the audit log with ausearch, both the "attach" event and "detach"event can be found with ausearch command, Meanwhile i also find a deny log afer i detach the disk

# ausearch -m VIRT_RESOURCE --start recent 
time->Wed Feb 19 18:59:18 2014
type=VIRT_RESOURCE msg=audit(1392807558.592:8018): pid=5234 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=attach vm="rhel75" uuid=4f43c3bd-249c-428e-8a67-f55f95916b1d old-disk="?" new-disk="/var/lib/libvirt/images/test.img" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
----
time->Wed Feb 19 18:59:50 2014
type=VIRT_RESOURCE msg=audit(1392807590.744:8036): pid=5234 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=detach vm="rhel75" uuid=4f43c3bd-249c-428e-8a67-f55f95916b1d old-disk="/var/lib/libvirt/images/test.img" new-disk="?" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
----
time->Wed Feb 19 18:59:50 2014
type=VIRT_RESOURCE msg=audit(1392807590.745:8037): pid=5234 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=cgroup reason=deny vm="rhel75" uuid=4f43c3bd-249c-428e-8a67-f55f95916b1d cgroup="/sys/fs/cgroup/devices/machine.slice/machine-qemu\x2drhel75.scope/" class=path path="/var/lib/libvirt/images/test.img" rdev=? acl=rwm exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'


5.check the audit log with auvirt again, we can just see the "attach" event ,can't find the "detach" event, however, find a deny event after i did the detach operation 

# auvirt --all-events --start recent
res   rhel75                   	root       	Wed Feb 19 18:42 - 18:42  (00:00)  	disk        	attach    	/var/lib/libvirt/images/test.img
res   rhel75                   	root       	Wed Feb 19 18:42                   	cgroup      	deny      	path	rwm	/var/lib/libvirt/images/test.img


6.Didn't find any avc during i test the upper steps
Comment 6 zhenfeng wang 2014-03-31 03:56:11 EDT
Re-try the comment5's operation with the latest env, still hit the issue, so re-open this bug 

pkg info
libvirt-1.1.1-29.el7.x86_64
qemu-kvm-rhev-1.5.3-59.el7ev.x86_64
kernel-3.10.0-115.el7.x86_64
selinux-policy-3.12.1-148.el7.noarch
Comment 7 Miroslav Grepl 2014-03-31 04:10:08 EDT
1. Does it work in permissive mode?

# setenforce 0

2. If yes, please re-test it with

# semodule -DB
# ausearch -m avc,user_avc -ts recent
# grep invalid /var/log/messages
Comment 8 zhenfeng wang 2014-03-31 04:49:11 EDT
Hi Miroslav
it didn't work in permissive mode and i got the same result with testing in enforcing mode as comment5 description
Comment 9 Miroslav Grepl 2014-03-31 04:51:21 EDT
If it does not work in permissive mode then it is not SELinux issue.
Comment 10 Daniel Berrange 2014-03-31 05:51:44 EDT
Err the detach event is right there in the logs you quoted. see reason=detach here

time->Wed Feb 19 18:59:50 2014
type=VIRT_RESOURCE msg=audit(1392807590.744:8036): pid=5234 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=detach vm="rhel75" uuid=4f43c3bd-249c-428e-8a67-f55f95916b1d old-disk="/var/lib/libvirt/images/test.img" new-disk="?" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
Comment 11 Jiri Denemark 2014-03-31 09:34:39 EDT
Libvirt correctly logs the event, no idea why auvirt doesn't show it.
Comment 12 RHEL Product and Program Management 2014-04-08 01:48:25 EDT
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.

Note You need to log in before you can comment on or make changes to this bug.