From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:38661)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <berrange@redhat.com>) id 1S62Ma-0003bS-MI
	for qemu-devel@nongnu.org; Fri, 09 Mar 2012 11:08:22 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <berrange@redhat.com>) id 1S62MY-0003E4-Fb
	for qemu-devel@nongnu.org; Fri, 09 Mar 2012 11:08:16 -0500
Received: from mx1.redhat.com ([209.132.183.28]:44541)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <berrange@redhat.com>) id 1S62MY-0003Ds-7W
	for qemu-devel@nongnu.org; Fri, 09 Mar 2012 11:08:14 -0500
Date: Fri, 9 Mar 2012 16:08:01 +0000
From: "Daniel P. Berrange" <berrange@redhat.com>
Message-ID: <20120309160800.GF2480@redhat.com>
References: <CAJSP0QUvcm_L4kf+6tDupQbEjAtLnOyEcTxddFqWVr4OY_k+NQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <CAJSP0QUvcm_L4kf+6tDupQbEjAtLnOyEcTxddFqWVr4OY_k+NQ@mail.gmail.com>
Subject: Re: [Qemu-devel] QEMU fstatfs(2) and libvirt SELinux policy
Reply-To: "Daniel P. Berrange" <berrange@redhat.com>
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Hajnoczi <stefanha@gmail.com>
Cc: libvir-list@redhat.com, qemu-devel <qemu-devel@nongnu.org>, Khoa Huynh <khoa@us.ibm.com>, George Wilson <gcwilson@us.ibm.com>, Paolo Bonzini <pbonzini@redhat.com>, laine@laine.org

On Fri, Mar 09, 2012 at 11:32:47AM +0000, Stefan Hajnoczi wrote:
> Hi,
> I have a question about the libvirt SELinux policy that can be applied
> to QEMU processes.  Yesterday Laine helped Khoa and me diagnose an
> issue where QEMU was doing fstatfs(2) but SELinux prevented this
> FILESYSTEM__GETATTR operation, resulting in a failed syscall with
> -EACCES.  The SELinux hook is:
> 
> security/selinux/hooks.c:selinux_sb_statfs():
>         return superblock_has_perm(cred, dentry->d_sb,
> FILESYSTEM__GETATTR, &ad);
> 
> It turns out this problem also affects XFS discard support in QEMU
> today.  QEMU calls platform_test_xfs_fd() in libxfs, which works like
> this:
> 
> static __inline__ int platform_test_xfs_fd(int fd)
> {
>         struct statfs buf;
>         if (fstatfs(fd, &buf) < 0)
>                 return 0;
>         return (buf.f_type == 0x58465342);      /* XFSB */
> }
> 
> In other words, XFS detection will fail when SELinux is enabled.
> 
> I'm not familiar with libvirt's use of SELinux.  Can someone explain
> if we need to expand the policy in libvirt and how to do that?

Just file a BZ against 'selinux-policy' in Fedora and provide the AVC
record from /var/log/audit/audit.log and a note explaining why we
should allow this. Dan Walsh will quickly update the policy to comply


Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|