-
Bug
-
Resolution: Unresolved
-
Normal
-
rhel-9.5
-
No
-
None
-
rhel-sst-security-selinux
-
ssg_security
-
1
-
QE ack
-
False
-
-
None
-
None
-
-
None
-
Automated
-
None
What were you trying to do that didn't work?
In https://issues.redhat.com/browse/RHEL-7384 test we need to start guest with https/ssh network disk by spawning an nbdkit daemon. But it will get Permission denied for nbdkit. The related blocked bug https://issues.redhat.com/browse/RHEL-5174 has created a selinux policy for nbdkit but still can't resolve it. So maybe we need to have a permission that libvirt can access.
Please provide the package NVR for which bug is seen:
libvirt-10.5.0-4.el9.x86_64
qemu-kvm-9.0.0-7.el9.x86_64
selinux-policy-38.1.43-1.el9.noarch
How reproducible:
100%
Steps to reproduce
1. Enable nbdkit to access remote disk source.
# vim /etc/libvirt/qemu.conf
storage_use_nbdkit = 1
# systemctl restart virtqemud
2. Prepare a guest with ssh disk xml.
# virsh dumpxml rhel --inactive --xpath //disk ...... <disk type="network" device="disk"> <driver name="qemu" type="raw"/> <source protocol="ssh" name="/var/lib/libvirt/images/test.img"> <host name="10.73.210.25" port="22"/> <knownHosts path="/tmp/known_hosts"/> <identity username="root" keyfile="/tmp/id_rsa"/> </source> <target dev="vdb" bus="virtio"/> <address type="pci" domain="0x0000" bus="0x05" slot="0x00" function="0x0"/> </disk>
3. Start the guest in enforcing mode.
# getenforce
Enforcing
# virsh start rhel
error: Failed to start domain 'rhel'
error: operation failed: Failed to connect to nbdkit for 'ssh://10.73.210.25:22/var/lib/libvirt/images/test.img': libvirt: error : cannot execute binary /usr/sbin/nbdkit: Permission denied
Expected results
The guest can start successfully.
Actual results
The guest starts failed.
Additional info:
time->Sun Aug 25 23:29:11 2024 type=PROCTITLE msg=audit(1724642951.374:2582): proctitle=2F7573722F7362696E2F7669727471656D7564002D2D74696D656F757400313230 type=SYSCALL msg=audit(1724642951.374:2582): arch=c000003e syscall=59 success=no exit=-13 a0=7fa78c03b9e0 a1=7fa78c035a40 a2=7ffcef711ba8 a3=0 items=0 ppid=24367 pid=24368 auid=4294967295 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=4294967295 comm="rpc-virtqemud" exe="/usr/sbin/virtqemud" subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1724642951.374:2582): avc: denied { entrypoint } for pid=24368 comm="rpc-virtqemud" path="/usr/sbin/nbdkit" dev="dm-0" ino=67109649 scontext=system_u:system_r:virtd_t:s0:c855,c1022 tcontext=system_u:object_r:nbdkit_exec_t:s0 tclass=file permissive=0
- blocks
-
-
- Integration
-
- is cloned by
-
-
- Planning
-