Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1194728 - selinux silently blocks hypervkvpd?
Summary: selinux silently blocks hypervkvpd?
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 21
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-02-20 16:03 UTC by Sitsofe Wheeler
Modified: 2015-02-20 19:00 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-02-20 19:00:44 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)
audit.log (20.82 KB, text/plain)
2015-02-20 18:12 UTC, Sitsofe Wheeler 		no flags Details
journalctl (90.37 KB, text/plain)
2015-02-20 18:12 UTC, Sitsofe Wheeler 		no flags Details
View All

Description Sitsofe Wheeler 2015-02-20 16:03:35 UTC 
Description of problem:
When trying to use hypervkvpd (to let a Hyper-V host see a Linux guest's IP address) I have found that no information is transferred unless selinux is disabled.

Version-Release number of selected component (if applicable):
Fedora 21
kernel-core-3.18.7-200.fc21.x86_64
selinux-policy-3.13.1-105.3.fc21.noarch

How reproducible:
Reproducible every time.

Steps to Reproduce:
1. Boot Fedora 21 cloud image.
2. Run
/usr/sbin/hypervkvpd
3. On the Windows host's powershell run something like
(get-vm "Fedora 21 Cloud").NetworkAdapters[0].IPAddresses

Actual results:
Nothing.

Expected results:
IPv4 and IPv6 address to be returned.

Additional info:
There is basically nothing in /var/log/audit/audit.log related to this issue:
type=SERVICE_START msg=audit(1424447753.534:41): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=' comm="hypervkvpd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
That doesn't look like a denial to me. Additionally being in permissive mode doesn't help at all. The only thing that seems to resolve the problem is editing /etc/selinux/config and setting
SELINUX=disabled
then rebooting (then the powershell commands work after hypervkvpd is run). I've done a relabel via
touch /.autorelabel
but that didn't help issues...
Comment 1 Lukas Vrabec 2015-02-20 16:26:33 UTC 
Hi, 

use:
# semodule -DB

then try to reprouce your issue and check for AVC again.
Comment 2 Sitsofe Wheeler 2015-02-20 18:12:14 UTC 
Created attachment 994027 [details]
audit.log

No change. Attaching logs.
Comment 3 Sitsofe Wheeler 2015-02-20 18:12:42 UTC 
Created attachment 994028 [details]
journalctl
Comment 4 Sitsofe Wheeler 2015-02-20 19:00:44 UTC 
OK I've retried this again several times since and it seems it's the hypervkvpd.service that is generically flakey (restarting it after the system has started resolves the problem) and it has nothing to do with selinux. Resolving NOTABUG.
Note You need to log in before you can comment on or make changes to this bug.