Bug 968304 - Can't find the "detach" event for the auvirt command
Can't find the "detach" event for the auvirt command
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
6.8
x86_64 Linux
medium Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
BaseOS QE Security Team
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-05-29 08:28 EDT by zhenfeng wang
Modified: 2017-07-30 11:53 EDT (History)
10 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 968303
Environment:
Last Closed: 2016-01-18 05:16:04 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
the audit.log (12.58 KB, text/plain)
2013-07-17 04:13 EDT, zhenfeng wang
no flags Details

  None (edit)
Description zhenfeng wang 2013-05-29 08:28:51 EDT
+++ This bug was initially created as a clone of Bug #968303 +++

Description of problem:
Can't find the "detach" event for the auvirt  command

Version-Release number of selected component (if applicable):
libvirt-1.0.5-2.el7.x86_64
kernel-3.9.0-0.55.el7.x86_64
qemu-kvm-1.4.0-4.el7.x86_64
libselinux-2.1.13-15.el7.x86_64
libselinux-utils-2.1.13-15.el7.x86_64
selinux-policy-targeted-3.12.1-46.el7.noarch
libselinux-python-2.1.13-15.el7.x86_64
selinux-policy-3.12.1-46.el7.noarch
audit-libs-2.3-2.el7.x86_64
audit-2.3-2.el7.x86_64
How reproducible:
100%

Steps
1. prepare a running guest
virsh list
 Id    Name                           State
----------------------------------------------------
 2     rhel7qcow2                     running

2.create a img
# qemu-img create -f qcow2 /var/lib/libvirt/images/test3.img 1G
Formatting '/var/lib/libvirt/images/test3.img', fmt=qcow2 size=1073741824 encryption=off cluster_size=65536 lazy_refcounts=off
3.attach the disk, then detach it
# virsh attach-disk rhel7qcow2 /var/lib/libvirt/images/test3.img vdb
Disk attached successfully

# virsh detach-disk rhel7qcow2 vdb
Disk detached successfully

4.check the audit log with ausearch, both the "attach" event and "detach"event can be found with ausearch command
# ausearch -m VIRT_RESOURCE --start recent |grep disk
type=VIRT_RESOURCE msg=audit(1369807593.539:511): pid=1720 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=attach vm="rhel7qcow2" uuid=5dc40c41-9ea2-4a44-9019-59dc56a1ef15 old-disk="?" new-disk="/var/lib/libvirt/images/test3.img" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'

type=VIRT_RESOURCE msg=audit(1369807640.676:512): pid=1720 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=detach vm="rhel7qcow2" uuid=5dc40c41-9ea2-4a44-9019-59dc56a1ef15 old-disk="/var/lib/libvirt/images/test3.img" new-disk="?" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'

5.check the audit log with auvirt again, we can just see the "attach" event ,can't find the "detach" event
# auvirt --all-events --start recent |grep disk
res   rhel7qcow2                       root               Wed May 29 14:06 - 14:07  (00:00)          disk                attach            /var/lib/libvirt/images/test3.img

6.this didn't work for "net" either.

7.the rhel6 has the same issue also.

Actual results:
Can't find the "detach" event with auvirt command

Expected results:
should find the "detach" event successfully ,which just like the "attach" event
Comment 2 Miroslav Grepl 2013-05-30 08:18:20 EDT
Does it work in permissive mode?
Comment 3 zhenfeng wang 2013-06-03 02:48:38 EDT
Hi Miroslav
it works well in the permissive mode
# getenforce
Permissive

#virsh start rhelguest1
Domain rhelguest1 started

#virsh attach rhelguest1 /var/lib/libvirt/images/test.img vdb
Disk attached successfully

#virsh detach rhelguest1 vdb
Disk detached successfully

check it in the audit.log

# ausearch -m VIRT_RESOURCE |grep attach
type=VIRT_RESOURCE msg=audit(1370241841.101:61930): user pid=5913 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=attach vm="rhelguest1" uuid=fcf773e6-6eba-4e72-8299-de0a38c89136 old-disk="?" new-disk="/var/lib/libvirt/images/test.img" exe=2F7573722F7362696E2F6C69627669727464202864656C6574656429 hostname=? addr=? terminal=? res=success'

# ausearch -m VIRT_RESOURCE |grep detach
type=VIRT_RESOURCE msg=audit(1370241865.492:61931): user pid=5913 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=detach vm="rhelguest1" uuid=fcf773e6-6eba-4e72-8299-de0a38c89136 old-disk="/var/lib/libvirt/images/test.img" new-disk="?" exe=2F7573722F7362696E2F6C69627669727464202864656C6574656429 hostname=? addr=? terminal=? res=success'
Comment 4 zhenfeng wang 2013-06-03 21:49:54 EDT
Hi Miroslav
Sorry to apply the wrong info in Comment 3, The ausearch can correctly query the info,However the auvirt can't still find the "detach" event, i should check the auvirt command

# auvirt --all-events --start recent |grep disk
res   rhel7qcow2                       root               Wed May 29 14:06 - 14:07  (00:00)          disk                attach            /var/lib/libvirt/images/test3.img
Comment 5 Miroslav Grepl 2013-06-04 11:06:51 EDT
Could you run

# semodule -DB

re-test it and

# ausearch -m avc,user_avc |audit2allow
Comment 6 zhenfeng wang 2013-06-05 06:47:45 EDT
# semodule -DB
# virsh attach-disk rhelguest1 /var/lib/libvirt/images/aaa.img vdb
Disk attached successfully
# virsh detach-disk rhelguest1 vdb
Disk detached successfully

# ausearch -m avc,user_avc |audit2allow


#============= semanage_t ==============
allow semanage_t load_policy_t:process { siginh noatsecure rlimitinh };
allow semanage_t setfiles_t:process { siginh noatsecure rlimitinh };

#============= sshd_t ==============
allow sshd_t chkpwd_t:process { siginh noatsecure rlimitinh };
Comment 7 Miroslav Grepl 2013-06-12 07:41:25 EDT
Any chance to clear the audit.log and send me audit.log after re-test?
Comment 8 zhenfeng wang 2013-07-17 04:12:56 EDT
Hi Miroslav
Sorry to see it so late,here it isthe audit.log after i re-test

# semodule -DB
# virsh attach-disk rhelguest1 /var/lib/libvirt/images/aaa.img vdb
Disk attached successfully

# virsh detach-disk rhelguest1 vdb
Disk detached successfully

# ausearch -m avc,user_avc |audit2allow


#============= semanage_t ==============
allow semanage_t setfiles_t:process { siginh noatsecure rlimitinh };

#============= sysstat_t ==============
allow sysstat_t admin_home_t:dir { getattr search };
Comment 9 zhenfeng wang 2013-07-17 04:13:36 EDT
Created attachment 774663 [details]
the audit.log
Comment 10 Daniel Walsh 2013-07-26 13:35:08 EDT
Do the kernel guys have any clue.  No obvious AVC.
Comment 13 Miroslav Grepl 2015-02-25 07:36:14 EST
How does it look?
Comment 14 zhenfeng wang 2015-03-04 06:25:51 EST
hi Miroslav
I still couldn't find the "detach" event for the auvirt command 

pkginfo

 

1.# semodule -DB
2.# virsh attach-disk kdc /var/lib/libvirt/images/test3.img vdb
Disk attached successfully

3.# virsh detach-disk kdc vdb
Disk detached successfully

4.# auvirt --all-events --start recent |grep disk
res   kdc                      	root       	Wed Mar  4 19:21                   	disk        	start     	/mnt/zhwang/img/rhel65.img
res   kdc                      	root       	Wed Mar  4 19:21 - 19:21  (00:00)  	disk        	attach    	/var/lib/libvirt/images/test3.img

5.# ausearch -m avc,user_avc |audit2allow


#============= chrome_sandbox_t ==============
allow chrome_sandbox_t self:capability sys_nice;

#!!!! This avc is allowed in the current policy
allow chrome_sandbox_t unconfined_execmem_t:unix_stream_socket shutdown;

#============= logrotate_t ==============
allow logrotate_t mnt_t:dir read;

#============= prelink_cron_system_t ==============
allow prelink_cron_system_t mnt_t:dir read;

#============= svirt_t ==============

#!!!! This avc is allowed in the current policy
allow svirt_t nfs_t:file open;
allow svirt_t user_tmp_t:file open;

#============= unconfined_java_t ==============

#!!!! This avc is allowed in the current policy
allow unconfined_java_t svirt_t:process transition;

#============= xdm_t ==============

#!!!! This avc can be allowed using the boolean 'allow_polyinstantiation'
allow xdm_t admin_home_t:dir read;
Comment 15 Miroslav Grepl 2015-03-04 08:19:14 EST
I don't see how these could be related.

Could you provide me a test machine?
Comment 21 zhenfeng wang 2015-11-04 06:17:33 EST
Hi Miroslav
didn't found any avc info this time and the detach event still couldn't show in the auvirt command 

pkginfo 
audit-2.3.7-5.el6.x86_64
qemu-kvm-rhev-0.12.1.2-2.479.el6_7.2.x86_64
kernel-2.6.32-573.el6.x86_64
selinux-policy-3.7.19-281.el6.noarch
libvirt-0.10.2-55.el6.x86_64

steps
#  semodule -DB
# virsh start rhel68
# virsh attach-disk rhel68 /var/lib/libvirt/images/test.img vdb
Disk attached successfully

# virsh detach-disk rhel68 vdb
Disk detached successfully

# auvirt --all-events --start recent |grep disk
res   rhel68                   	root       	Wed Nov  4 06:13                   	disk        	start     	/var/lib/libvirt/images/rhel67.img
res   rhel68                   	root       	Wed Nov  4 06:14 - 06:14  (00:00)  	disk        	attach    	/var/lib/libvirt/images/test.img
# ausearch -m avc,user_avc |audit2allow
<no matches>
Comment 22 Miroslav Grepl 2015-11-09 09:42:18 EST
(In reply to zhenfeng wang from comment #21)
> Hi Miroslav
> didn't found any avc info this time and the detach event still couldn't show
> in the auvirt command 
> 
> pkginfo 
> audit-2.3.7-5.el6.x86_64
> qemu-kvm-rhev-0.12.1.2-2.479.el6_7.2.x86_64
> kernel-2.6.32-573.el6.x86_64
> selinux-policy-3.7.19-281.el6.noarch
> libvirt-0.10.2-55.el6.x86_64
> 
> steps
> #  semodule -DB
> # virsh start rhel68
> # virsh attach-disk rhel68 /var/lib/libvirt/images/test.img vdb
> Disk attached successfully
> 
> # virsh detach-disk rhel68 vdb
> Disk detached successfully
> 
> # auvirt --all-events --start recent |grep disk
> res   rhel68                   	root       	Wed Nov  4 06:13                
> disk        	start     	/var/lib/libvirt/images/rhel67.img
> res   rhel68                   	root       	Wed Nov  4 06:14 - 06:14 
> (00:00)  	disk        	attach    	/var/lib/libvirt/images/test.img
> # ausearch -m avc,user_avc |audit2allow
> <no matches>

Ok and this is also in permissive? I mean no AVCs. There needs to be some another AVCs.
Comment 23 zhenfeng wang 2015-11-10 00:35:40 EST
yes, this is also in permissive
Comment 24 Miroslav Grepl 2015-11-11 11:13:44 EST
(In reply to zhenfeng wang from comment #23)
> yes, this is also in permissive

Ok, can we get an access again to work on it? Thank you.
Comment 30 RHEL Product and Program Management 2016-01-18 05:16:04 EST
Development Management has reviewed and declined this request.
You may appeal this decision by reopening this request.
Comment 31 zhenfeng wang 2016-01-18 21:27:08 EST
Hi Miroslav
This bug clone from bug 968303 from RHEL7 and the bug 968303 has been moved to 'audit' component in RHEL7, so can we also move this bug to 'audit' component in RHEL6 to continue to track it?

Note You need to log in before you can comment on or make changes to this bug.