[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] QEMU fstatfs(2) and libvirt SELinux policy
From: |
Daniel P. Berrange |
Subject: |
Re: [Qemu-devel] QEMU fstatfs(2) and libvirt SELinux policy |
Date: |
Fri, 9 Mar 2012 16:08:01 +0000 |
User-agent: |
Mutt/1.5.21 (2010-09-15) |
On Fri, Mar 09, 2012 at 11:32:47AM +0000, Stefan Hajnoczi wrote:
> Hi,
> I have a question about the libvirt SELinux policy that can be applied
> to QEMU processes. Yesterday Laine helped Khoa and me diagnose an
> issue where QEMU was doing fstatfs(2) but SELinux prevented this
> FILESYSTEM__GETATTR operation, resulting in a failed syscall with
> -EACCES. The SELinux hook is:
>
> security/selinux/hooks.c:selinux_sb_statfs():
> return superblock_has_perm(cred, dentry->d_sb,
> FILESYSTEM__GETATTR, &ad);
>
> It turns out this problem also affects XFS discard support in QEMU
> today. QEMU calls platform_test_xfs_fd() in libxfs, which works like
> this:
>
> static __inline__ int platform_test_xfs_fd(int fd)
> {
> struct statfs buf;
> if (fstatfs(fd, &buf) < 0)
> return 0;
> return (buf.f_type == 0x58465342); /* XFSB */
> }
>
> In other words, XFS detection will fail when SELinux is enabled.
>
> I'm not familiar with libvirt's use of SELinux. Can someone explain
> if we need to expand the policy in libvirt and how to do that?
Just file a BZ against 'selinux-policy' in Fedora and provide the AVC
record from /var/log/audit/audit.log and a note explaining why we
should allow this. Dan Walsh will quickly update the policy to comply
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
Re: [Qemu-devel] QEMU fstatfs(2) and libvirt SELinux policy, George Wilson, 2012/03/09
Re: [Qemu-devel] QEMU fstatfs(2) and libvirt SELinux policy,
Daniel P. Berrange <=