Subject: Re: libvirt: Please enable selinux security driver

From: Mateusz Matuszkowiak <[email-masked]>
Date: Wed, 15 Jan 2014 01:01:56 +0100

Hello,

Trying to confirm that selinux driver is working on jessie but so far
without luck:

2014-01-14 23:10:23.945+0000: 13996: info : libvirt version: 1.2.0
2014-01-14 23:10:23.945+0000: 13996: error : virSecurityDriverLookup:78 :
unsupported configuration: Security driver selinux not enabled
2014-01-14 23:10:23.945+0000: 13996: error : lxcSecurityInit:1461 : Failed
to initialize security drivers
2014-01-14 23:10:23.945+0000: 13996: error : virStateInitialize:854 :
Initialization of LXC state driver failed: unsupported configuration:
Security driver selinux not enabled
2014-01-14 23:10:23.946+0000: 13996: error : daemonRunStateInit:909 :
Driver state initialization failed

This is, to be exact, the latest '1.2.0-2' libvirt-bin package, and OFC
selinux is enabled:

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             default
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28

Even though compilling it manually from sources it ends up on missing
selinux driver. I know that this case has been also pushed by Ivan Gooten
to the libvirt mailing list, if interested:
https://www.redhat.com/archives/libvirt-users/2014-January/msg00025.html

WKR,
Mateusz

---

From: Mateusz Matuszkowiak <[email-masked]>
Date: Sun, 26 Jan 2014 22:07:24 +0100

Hello again,

I did some digging lately and I see that libvirtd won't start due to
missing "/etc/selinux/default/contexts/lxc_contexts" file, which is
provided by refpolicy in latest Fedora with a content as follows:

---------
process = "system_u:system_r:svirt_lxc_net_t:s0"
content = "system_u:object_r:virt_var_lib_t:s0"
file = "system_u:object_r:svirt_sandbox_file_t:s0"
sandbox_kvm_process = "system_u:system_r:svirt_qemu_net_t:s0"
sandbox_lxc_process = "system_u:system_r:svirt_lxc_net_t:s0"
---------

The current refpolicy in Debian does not provide "svirt_sandbox_file_t"
context, prob due to missing libvirt-sandbox package.

// Fed's virt.te //
$ wc -l virt.te
1616 virt.te

// Debian's virt.te //
$ wc -l virt.te
1211 virt.te

The semodule virt would need to get updated - mayby SElinux master here? ;-)

With kind regards,
Mateusz

---

From: Guido Günther <[email-masked]>
Date: Tue, 28 Jan 2014 08:22:13 +0100

clone 688179 -1
rettitle -1 LXC selinux support not working
reopen -1
thanks

Hi,

> provided by refpolicy in latest Fedora with a content as follows:

Thanks for looking into this. I've opened a new bug since there's far
too much crammed into this report already. Please use the new bug to
track this issue. Laurent, do you have any selinux policy updates
planned for this or are you focusing on qemu atm?
Cheers,
 -- Guido

---

From: Laurent Bigonville <[email-masked]>
Date: Tue, 28 Jan 2014 11:15:53 +0100

Hi,

Libvirt selinux security driver is now enabled in debian unstable.
Qemu/KVM VM can be started properly now, but a bug[1] has been reported
that LXC containers are failing to start due to the missing
"lxc_contexts" appconfig file.

Looking at the fedora policy, it's indeed shipping that file with the
following content:

---------

I only see minimal differences between the virt module in the refpolicy
and the one in the fedora one, and I'm maybe missing something, but it
seems that some types are missing in both the refpolicy and the fedora
policy. I find no signs of "svirt_qemu_net_t" or "sandbox_file_t" for
example.

So an idea how we could make libvirt happy with LXC containers?

Cheers,

Laurent Bigonville

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736909

PS: could you please keep the 736909-forwarded CC while replying.

---

From: Daniel J Walsh <[email-masked]>
Date: Wed, 29 Jan 2014 08:13:43 -0500

On 01/28/2014 05:15 AM, Laurent Bigonville wrote:
> Hi,
> 
> Libvirt selinux security driver is now enabled in debian unstable. Qemu/KVM
> VM can be started properly now, but a bug[1] has been reported that LXC
> containers are failing to start due to the missing "lxc_contexts" appconfig
> file.
> 
> --------- process = "system_u:system_r:svirt_lxc_net_t:s0" content =
> "system_u:object_r:virt_var_lib_t:s0" file =
> "system_u:object_r:svirt_sandbox_file_t:s0" sandbox_kvm_process =
> "system_u:system_r:svirt_qemu_net_t:s0" sandbox_lxc_process =
> "system_u:system_r:svirt_lxc_net_t:s0" ---------
> 
> I only see minimal differences between the virt module in the refpolicy and
> the one in the fedora one, and I'm maybe missing something, but it seems
> that some types are missing in both the refpolicy and the fedora policy. I
> find no signs of "svirt_qemu_net_t" or "sandbox_file_t" for example.
> 

There in there,   I have attached the latest qemu policy.  We use
svirt_sandbox_file_t not sandbox_file_t (This is used for the type of sandbox
- -X containers).

---

From: Miroslav Grepl <[email-masked]>
Date: Wed, 29 Jan 2014 22:12:56 +0100

> policy. I find no signs of "svirt_qemu_net_t" or "sandbox_file_t" for
I see all types are presented in virt.te,

https://git.fedorahosted.org/cgit/selinux-policy.git/tree/virt.te?h=master_contrib

> _______________________________________________
> refpolicy mailing list
> [email-masked]
> http://oss.tresys.com/mailman/listinfo/refpolicy

---

From: Laurent Bigonville <[email-masked]>
Date: Wed, 29 Jan 2014 23:09:43 +0100

Le Wed, 29 Jan 2014 22:12:56 +0100,
Miroslav Grepl <[email-masked]> a écrit :

Hi,

Thanks for your reply.

> > Qemu/KVM VM can be started properly now, but a bug[1] has been
> > reported that LXC containers are failing to start due to the missing
> > Looking at the fedora policy, it's indeed shipping that file with
> > the following content:
> >
> > ---------
> > I only see minimal differences between the virt module in the
> > refpolicy and the one in the fedora one, and I'm maybe missing
> > something, but it seems that some types are missing in both the
> > refpolicy and the fedora policy. I find no signs of
> > "svirt_qemu_net_t" or "sandbox_file_t" for example.

Yes indeed, for some reasons I didn't found this /o\ The fact that
the .gitmodule of the selinux-policy repository is still pointing to
the refpolicy one is really confusing.

Anyway these types are not currently present in the upstream refpolicy,
so I guess I should try propose a patch to merge back the changes from
the fedora virt.pp module. Or do you have any plans to do this?

The delta between the two is unfortunately larger that I would have
expected.

Kind regards,

Laurent Bigonville

---

From: Evgeni Golov <[email-masked]>
Date: Sun, 4 Dec 2016 14:02:59 +0100

Ohai,

> The delta between the two is unfortunately larger that I would have

Upstream now ships an lxc_contexts file [1], but I have no idea how to test it in libvirt properly?

Regards
Evgeni

[1] https://github.com/TresysTechnology/refpolicy/commit/ca6fefc3c899a39a95402a82e2beda6cb5a98aa9