968304 – Can't find the "detach" event for the auvirt command

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 968304 - Can't find the "detach" event for the auvirt command

Summary: Can't find the "detach" event for the auvirt command

Keywords:
Status:	CLOSED WONTFIX
Alias:	None
Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	selinux-policy
Sub Component:
Version:	6.8
Hardware:	x86_64
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	rc
Target Release:	---
Assignee:	Miroslav Grepl
QA Contact:	BaseOS QE Security Team
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2013-05-29 12:28 UTC by zhenfeng wang
Modified:	2017-07-30 15:53 UTC (History)
CC List:	10 users (show)
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Clone Of:	968303
Environment:
Last Closed:	2016-01-18 10:16:04 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)
the audit.log (12.58 KB, text/plain) 2013-07-17 08:13 UTC, zhenfeng wang	no flags	Details
View All

Description zhenfeng wang 2013-05-29 12:28:51 UTC

+++ This bug was initially created as a clone of Bug #968303 +++

Description of problem:
Can't find the "detach" event for the auvirt  command

Version-Release number of selected component (if applicable):
libvirt-1.0.5-2.el7.x86_64
kernel-3.9.0-0.55.el7.x86_64
qemu-kvm-1.4.0-4.el7.x86_64
libselinux-2.1.13-15.el7.x86_64
libselinux-utils-2.1.13-15.el7.x86_64
selinux-policy-targeted-3.12.1-46.el7.noarch
libselinux-python-2.1.13-15.el7.x86_64
selinux-policy-3.12.1-46.el7.noarch
audit-libs-2.3-2.el7.x86_64
audit-2.3-2.el7.x86_64
How reproducible:
100%

Steps
1. prepare a running guest
virsh list
 Id    Name                           State
----------------------------------------------------
 2     rhel7qcow2                     running

2.create a img
# qemu-img create -f qcow2 /var/lib/libvirt/images/test3.img 1G
Formatting '/var/lib/libvirt/images/test3.img', fmt=qcow2 size=1073741824 encryption=off cluster_size=65536 lazy_refcounts=off
3.attach the disk, then detach it
# virsh attach-disk rhel7qcow2 /var/lib/libvirt/images/test3.img vdb
Disk attached successfully

# virsh detach-disk rhel7qcow2 vdb
Disk detached successfully

4.check the audit log with ausearch, both the "attach" event and "detach"event can be found with ausearch command
# ausearch -m VIRT_RESOURCE --start recent |grep disk
type=VIRT_RESOURCE msg=audit(1369807593.539:511): pid=1720 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=attach vm="rhel7qcow2" uuid=5dc40c41-9ea2-4a44-9019-59dc56a1ef15 old-disk="?" new-disk="/var/lib/libvirt/images/test3.img" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'

type=VIRT_RESOURCE msg=audit(1369807640.676:512): pid=1720 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=detach vm="rhel7qcow2" uuid=5dc40c41-9ea2-4a44-9019-59dc56a1ef15 old-disk="/var/lib/libvirt/images/test3.img" new-disk="?" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'

5.check the audit log with auvirt again, we can just see the "attach" event ,can't find the "detach" event
# auvirt --all-events --start recent |grep disk
res   rhel7qcow2                       root               Wed May 29 14:06 - 14:07  (00:00)          disk                attach            /var/lib/libvirt/images/test3.img

6.this didn't work for "net" either.

7.the rhel6 has the same issue also.

Actual results:
Can't find the "detach" event with auvirt command

Expected results:
should find the "detach" event successfully ,which just like the "attach" event

Comment 2 Miroslav Grepl 2013-05-30 12:18:20 UTC

Does it work in permissive mode?

Comment 3 zhenfeng wang 2013-06-03 06:48:38 UTC

Hi Miroslav
it works well in the permissive mode
# getenforce
Permissive

#virsh start rhelguest1
Domain rhelguest1 started

#virsh attach rhelguest1 /var/lib/libvirt/images/test.img vdb
Disk attached successfully

#virsh detach rhelguest1 vdb
Disk detached successfully

check it in the audit.log

# ausearch -m VIRT_RESOURCE |grep attach
type=VIRT_RESOURCE msg=audit(1370241841.101:61930): user pid=5913 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=attach vm="rhelguest1" uuid=fcf773e6-6eba-4e72-8299-de0a38c89136 old-disk="?" new-disk="/var/lib/libvirt/images/test.img" exe=2F7573722F7362696E2F6C69627669727464202864656C6574656429 hostname=? addr=? terminal=? res=success'

# ausearch -m VIRT_RESOURCE |grep detach
type=VIRT_RESOURCE msg=audit(1370241865.492:61931): user pid=5913 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=detach vm="rhelguest1" uuid=fcf773e6-6eba-4e72-8299-de0a38c89136 old-disk="/var/lib/libvirt/images/test.img" new-disk="?" exe=2F7573722F7362696E2F6C69627669727464202864656C6574656429 hostname=? addr=? terminal=? res=success'

Comment 4 zhenfeng wang 2013-06-04 01:49:54 UTC

Hi Miroslav
Sorry to apply the wrong info in Comment 3, The ausearch can correctly query the info,However the auvirt can't still find the "detach" event, i should check the auvirt command

# auvirt --all-events --start recent |grep disk
res   rhel7qcow2                       root               Wed May 29 14:06 - 14:07  (00:00)          disk                attach            /var/lib/libvirt/images/test3.img

Comment 5 Miroslav Grepl 2013-06-04 15:06:51 UTC

Could you run

# semodule -DB

re-test it and

# ausearch -m avc,user_avc |audit2allow

Comment 6 zhenfeng wang 2013-06-05 10:47:45 UTC

# semodule -DB
# virsh attach-disk rhelguest1 /var/lib/libvirt/images/aaa.img vdb
Disk attached successfully
# virsh detach-disk rhelguest1 vdb
Disk detached successfully

# ausearch -m avc,user_avc |audit2allow


#============= semanage_t ==============
allow semanage_t load_policy_t:process { siginh noatsecure rlimitinh };
allow semanage_t setfiles_t:process { siginh noatsecure rlimitinh };

#============= sshd_t ==============
allow sshd_t chkpwd_t:process { siginh noatsecure rlimitinh };

Comment 7 Miroslav Grepl 2013-06-12 11:41:25 UTC

Any chance to clear the audit.log and send me audit.log after re-test?

Comment 8 zhenfeng wang 2013-07-17 08:12:56 UTC

Hi Miroslav
Sorry to see it so late,here it isthe audit.log after i re-test

# semodule -DB
# virsh attach-disk rhelguest1 /var/lib/libvirt/images/aaa.img vdb
Disk attached successfully

# virsh detach-disk rhelguest1 vdb
Disk detached successfully

# ausearch -m avc,user_avc |audit2allow


#============= semanage_t ==============
allow semanage_t setfiles_t:process { siginh noatsecure rlimitinh };

#============= sysstat_t ==============
allow sysstat_t admin_home_t:dir { getattr search };

Comment 9 zhenfeng wang 2013-07-17 08:13:36 UTC

Created attachment 774663 [details]
the audit.log

Comment 10 Daniel Walsh 2013-07-26 17:35:08 UTC

Do the kernel guys have any clue.  No obvious AVC.

Comment 13 Miroslav Grepl 2015-02-25 12:36:14 UTC

How does it look?

Comment 14 zhenfeng wang 2015-03-04 11:25:51 UTC

hi Miroslav
I still couldn't find the "detach" event for the auvirt command 

pkginfo

 

1.# semodule -DB
2.# virsh attach-disk kdc /var/lib/libvirt/images/test3.img vdb
Disk attached successfully

3.# virsh detach-disk kdc vdb
Disk detached successfully

4.# auvirt --all-events --start recent |grep disk
res   kdc                      	root       	Wed Mar  4 19:21                   	disk        	start     	/mnt/zhwang/img/rhel65.img
res   kdc                      	root       	Wed Mar  4 19:21 - 19:21  (00:00)  	disk        	attach    	/var/lib/libvirt/images/test3.img

5.# ausearch -m avc,user_avc |audit2allow


#============= chrome_sandbox_t ==============
allow chrome_sandbox_t self:capability sys_nice;

#!!!! This avc is allowed in the current policy
allow chrome_sandbox_t unconfined_execmem_t:unix_stream_socket shutdown;

#============= logrotate_t ==============
allow logrotate_t mnt_t:dir read;

#============= prelink_cron_system_t ==============
allow prelink_cron_system_t mnt_t:dir read;

#============= svirt_t ==============

#!!!! This avc is allowed in the current policy
allow svirt_t nfs_t:file open;
allow svirt_t user_tmp_t:file open;

#============= unconfined_java_t ==============

#!!!! This avc is allowed in the current policy
allow unconfined_java_t svirt_t:process transition;

#============= xdm_t ==============

#!!!! This avc can be allowed using the boolean 'allow_polyinstantiation'
allow xdm_t admin_home_t:dir read;

Comment 15 Miroslav Grepl 2015-03-04 13:19:14 UTC

I don't see how these could be related.

Could you provide me a test machine?

Comment 21 zhenfeng wang 2015-11-04 11:17:33 UTC

Hi Miroslav
didn't found any avc info this time and the detach event still couldn't show in the auvirt command 

pkginfo 
audit-2.3.7-5.el6.x86_64
qemu-kvm-rhev-0.12.1.2-2.479.el6_7.2.x86_64
kernel-2.6.32-573.el6.x86_64
selinux-policy-3.7.19-281.el6.noarch
libvirt-0.10.2-55.el6.x86_64

steps
#  semodule -DB
# virsh start rhel68
# virsh attach-disk rhel68 /var/lib/libvirt/images/test.img vdb
Disk attached successfully

# virsh detach-disk rhel68 vdb
Disk detached successfully

# auvirt --all-events --start recent |grep disk
res   rhel68                   	root       	Wed Nov  4 06:13                   	disk        	start     	/var/lib/libvirt/images/rhel67.img
res   rhel68                   	root       	Wed Nov  4 06:14 - 06:14  (00:00)  	disk        	attach    	/var/lib/libvirt/images/test.img
# ausearch -m avc,user_avc |audit2allow
<no matches>

Comment 22 Miroslav Grepl 2015-11-09 14:42:18 UTC

(In reply to zhenfeng wang from comment #21)
> Hi Miroslav
> didn't found any avc info this time and the detach event still couldn't show
> in the auvirt command 
> 
> pkginfo 
> audit-2.3.7-5.el6.x86_64
> qemu-kvm-rhev-0.12.1.2-2.479.el6_7.2.x86_64
> kernel-2.6.32-573.el6.x86_64
> selinux-policy-3.7.19-281.el6.noarch
> libvirt-0.10.2-55.el6.x86_64
> 
> steps
> #  semodule -DB
> # virsh start rhel68
> # virsh attach-disk rhel68 /var/lib/libvirt/images/test.img vdb
> Disk attached successfully
> 
> # virsh detach-disk rhel68 vdb
> Disk detached successfully
> 
> # auvirt --all-events --start recent |grep disk
> res   rhel68                   	root       	Wed Nov  4 06:13                
> disk        	start     	/var/lib/libvirt/images/rhel67.img
> res   rhel68                   	root       	Wed Nov  4 06:14 - 06:14 
> (00:00)  	disk        	attach    	/var/lib/libvirt/images/test.img
> # ausearch -m avc,user_avc |audit2allow
> <no matches>

Ok and this is also in permissive? I mean no AVCs. There needs to be some another AVCs.

Comment 23 zhenfeng wang 2015-11-10 05:35:40 UTC

yes, this is also in permissive

Comment 24 Miroslav Grepl 2015-11-11 16:13:44 UTC

(In reply to zhenfeng wang from comment #23)
> yes, this is also in permissive

Ok, can we get an access again to work on it? Thank you.

Comment 30 RHEL Program Management 2016-01-18 10:16:04 UTC

Development Management has reviewed and declined this request.
You may appeal this decision by reopening this request.

Comment 31 zhenfeng wang 2016-01-19 02:27:08 UTC

Hi Miroslav
This bug clone from bug 968303 from RHEL7 and the bug 968303 has been moved to 'audit' component in RHEL7, so can we also move this bug to 'audit' component in RHEL6 to continue to track it?

Note You need to log in before you can comment on or make changes to this bug.