Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-7522

Security context of swtpm.log of vm with shared tpmstate was not restored after migration failed and shutdown

    • sst_virtualization
    • ssg_virtualization
    • 13
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • If docs needed, set a value
    • None

      Description of problem:
      For vm with shared tpmstate(/var/lib/libvirt/swtpm), security context of swtpm.log was not restored after migration failed and vm shutdown
      Later start vm will meet error:
      'error: Requested operation is not valid: Setting different SELinux label on /var/log/swtpm/libvirt/qemu/vm2-swtpm.log which is already in use'

      Version-Release number of selected component (if applicable):
      libvirt-9.0.0-4.el9.x86_64
      qemu-kvm-7.2.0-8.el9.x86_64
      swtpm-0.8.0-1.el9.x86_64
      libtpms-0.9.1-2.20211126git1ff6fe1f43.el9.x86_64

      How reproducible:
      100%

      Steps to Reproduce:
      1. mount /var/lib/libvirt/swtpm on a shared storage(on both hosts), e.g. NFS:

      1. df -hT
        10..:/test/swtpm nfs4 70G 14G 57G 20% /var/lib/libvirt/swtpm
      2. ls /var/lib/libvirt/swtpm/
        (nothing)

      2. Define vm with vtpm from an xml

      1. cat vm2.xml
        ...
        <cpu mode='host-model' check='partial'>
        <feature policy='disable' name='vmx'/>
        </cpu>
        ...
        <tpm model='tpm-crb'>
        <backend type='emulator' version='2.0'/>
        </tpm>
        ...
      2. virsh define vm2.xml
        Domain 'vm2' defined from vm2.xml
      3. ls /var/lib/libvirt/swtpm/
        44db1abb-17eb-4b8e-ac9e-c18549741b65

      3. Start vm and check seclabel:

      1. virsh start vm2
        Domain 'vm2' started
      2. ll -hZ /var/log/swtpm/libvirt/qemu/vm2-swtpm.log
        rw-rr-. 1 tss tss system_u:object_r:svirt_image_t:s0:c62,c987 19K Feb 12 09:36 /var/log/swtpm/libvirt/qemu/vm2-swtpm.log

      4. migrate to a host with different cpu features, to cause failure:

      1. virsh migrate vm2 --live qemu+ssh://hostB/system --verbose
        root@hostB's password:
        error: operation failed: guest CPU doesn't match specification: missing features: ds,dtes64,avx512ifma,sha-ni,avx512vbmi,avx512vbmi2,gfni,vaes,vpclmulqdq,avx512bitalg,avx512-vpopcntdq,la57,rdpid,fsrm,wbnoinvd
      1. ll -hZ /var/log/swtpm/libvirt/qemu/vm2-swtpm.log
        rw-rr-. 1 tss tss system_u:object_r:svirt_image_t:s0:c62,c987 19K Feb 12 09:36 /var/log/swtpm/libvirt/qemu/vm2-swtpm.log

      5. Shutdown vm and check seclabel again:

      1. virsh shutdown vm2
        Domain 'vm2' is being shutdown
      2. virsh list --all
        Id Name State
        -------------------------------
      • avocado-vtpm shut off
      • vm2 shut off
      1. ll -hZ /var/log/swtpm/libvirt/qemu/vm2-swtpm.log
        rw-rr-. 1 tss tss system_u:object_r:svirt_image_t:s0:c62,c987 20K Feb 12 09:37 /var/log/swtpm/libvirt/qemu/vm2-swtpm.log

      6. Try to start vm again:

      1. virsh start vm2
        error: Failed to start domain 'vm2'
        error: Requested operation is not valid: Setting different SELinux label on /var/log/swtpm/libvirt/qemu/vm2-swtpm.log which is already in use
      1. ll -hZ /var/log/swtpm/libvirt/qemu/vm2-swtpm.log
        rw-rr-. 1 tss tss system_u:object_r:virt_log_t:s0 23K Feb 12 09:38 /var/log/swtpm/libvirt/qemu/vm2-swtpm.log

      Actual results:
      In step5, swtpm.log seclable wasn't restored. Then later start will encounter error.

      Expected results:
      selinux context of swtpm.log should be restored to system_u:object_r:virt_log_t:s0, like step6 shows.

      Additional info:
      1. Not reproduced for local tpmstate(/var/lib/libvirt/swtpm not mounted).
      2. The vm must be freshly defined on shared tpmstate, otherwise only starting a vm defined on local tpmstate before can not reproduce this issue.
      3. Not all kinds of migration failure can reproduce, e.g. migrate with local disk failure can not.

            mprivozn@redhat.com Michal Privoznik
            yanqzhan1@redhat.com Yanqiu Zhang
            Liping Cheng
            Michal Privoznik Michal Privoznik
            Yanqiu Zhang Yanqiu Zhang
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: