From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:59636)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <stefanha@gmail.com>) id 1S5y47-0002SB-88
	for qemu-devel@nongnu.org; Fri, 09 Mar 2012 06:32:56 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <stefanha@gmail.com>) id 1S5y41-0003dS-RL
	for qemu-devel@nongnu.org; Fri, 09 Mar 2012 06:32:54 -0500
Received: from mail-lpp01m010-f45.google.com ([209.85.215.45]:63314)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <stefanha@gmail.com>) id 1S5y41-0003dO-HF
	for qemu-devel@nongnu.org; Fri, 09 Mar 2012 06:32:49 -0500
Received: by lahe6 with SMTP id e6so1648729lah.4
	for <qemu-devel@nongnu.org>; Fri, 09 Mar 2012 03:32:47 -0800 (PST)
MIME-Version: 1.0
Date: Fri, 9 Mar 2012 11:32:47 +0000
Message-ID: <CAJSP0QUvcm_L4kf+6tDupQbEjAtLnOyEcTxddFqWVr4OY_k+NQ@mail.gmail.com>
From: Stefan Hajnoczi <stefanha@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Subject: [Qemu-devel] QEMU fstatfs(2) and libvirt SELinux policy
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: laine@laine.org
Cc: libvir-list@redhat.com, qemu-devel <qemu-devel@nongnu.org>, Khoa Huynh <khoa@us.ibm.com>, George Wilson <gcwilson@us.ibm.com>, Paolo Bonzini <pbonzini@redhat.com>

Hi,
I have a question about the libvirt SELinux policy that can be applied
to QEMU processes.  Yesterday Laine helped Khoa and me diagnose an
issue where QEMU was doing fstatfs(2) but SELinux prevented this
FILESYSTEM__GETATTR operation, resulting in a failed syscall with
-EACCES.  The SELinux hook is:

security/selinux/hooks.c:selinux_sb_statfs():
        return superblock_has_perm(cred, dentry->d_sb,
FILESYSTEM__GETATTR, &ad);

It turns out this problem also affects XFS discard support in QEMU
today.  QEMU calls platform_test_xfs_fd() in libxfs, which works like
this:

static __inline__ int platform_test_xfs_fd(int fd)
{
        struct statfs buf;
        if (fstatfs(fd, &buf) < 0)
                return 0;
        return (buf.f_type == 0x58465342);      /* XFSB */
}

In other words, XFS detection will fail when SELinux is enabled.

I'm not familiar with libvirt's use of SELinux.  Can someone explain
if we need to expand the policy in libvirt and how to do that?

Thanks,
Stefan