On Fri, Mar 09, 2012 at 11:32:47AM +0000, Stefan Hajnoczi wrote:
Hi, I have a question about the libvirt SELinux policy that can be applied to QEMU processes. Yesterday Laine helped Khoa and me diagnose an issue where QEMU was doing fstatfs(2) but SELinux prevented this FILESYSTEM__GETATTR operation, resulting in a failed syscall with -EACCES. The SELinux hook is:
security/selinux/hooks.c:selinux_sb_statfs(): return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
It turns out this problem also affects XFS discard support in QEMU today. QEMU calls platform_test_xfs_fd() in libxfs, which works like this:
static __inline__ int platform_test_xfs_fd(int fd) { struct statfs buf; if (fstatfs(fd, &buf) < 0) return 0; return (buf.f_type == 0x58465342); /* XFSB */ }
In other words, XFS detection will fail when SELinux is enabled.
I'm not familiar with libvirt's use of SELinux. Can someone explain if we need to expand the policy in libvirt and how to do that?
Just file a BZ against 'selinux-policy' in Fedora and provide the AVC record from /var/log/audit/audit.log and a note explaining why we should allow this. Dan Walsh will quickly update the policy to comply Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|