Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-69433

AVC denials happen when revert a snapshot with virtlockd running

XMLWordPrintable

    • selinux-policy-38.1.49-1.el9
    • No
    • Critical
    • 1
    • rhel-sst-security-selinux
    • ssg_security
    • 17
    • 2
    • QE ack
    • False
    • Hide

      None

      Show
      None
    • No
    • SELINUX 241127 - 241218
    • Release Note Not Required
    • All
    • None

      What were you trying to do that didn't work?

      As subject

      What is the impact of this issue to you?

      AVC denial msgs

      Please provide the package NVR for which the bug is seen:

      selinux-policy-38.1.48-1.el9.noarch

      libvirt-10.9.0-1.el9.x86_64

      qemu-kvm-9.1.0-5.el9.x86_64

      How reproducible is this bug?:

      100%

      Steps to reproduce

      1. Prepare virtlockd
        For /etc/libvirt/qemu.conf, set it as 
      lock_manager = "lockd"

      For /etc/libvirt/qemu-lockd.conf, set it as

      auto_disk_leases = 1
require_lease_for_disks = 1
file_lockspace_dir = "/var/lib/libvirt/lockd/files"

      Then restart virtqemud and virtlockd

      1. Start a domain
      2. Create the snapshot and revert the snapshot
      > virsh snapshot-create-as RHEL s1 --memspec /var/lib/libvirt/images/RHEL_mem.s1
        Domain snapshot s1 created
> virsh snapshot-revert RHEL s1                                                 
Domain snapshot s1 reverted

      One AVC denial happens when reverting the snapshot:

      type=AVC msg=audit(1732785595.568:8090): avc:  denied  { kill } for  pid=323799 comm="virtlockd" capability=5  scontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tclass=capability permissive=0

      Set SELinux to permissive then revert the snapshot. Get 2 AVC denials

      type=AVC msg=audit(1732785728.355:8124): avc:  denied  { signal } for  pid=323799 comm="virtlockd" scontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:svirt_t:s0:c698,c836 tclass=process permissive=1
type=AVC msg=audit(1732785728.355:8124): avc:  denied  { kill } for  pid=323799 comm="virtlockd" capability=5  scontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:virtlogd_t:s0-s0:c0.c1023 tclass=capability permissive=1

      Expected results

      No AVC denials

      Actual results

       

              rhn-support-zpytela Zdenek Pytela
              rhn-support-hhan Han Han
              Zdenek Pytela Zdenek Pytela
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated: