Hello,
I'm using HP homeserver where host system run CentOS 6.3 with KVM
virtualization with SELinux enabled, guests too run the same OS (but
without SELinux, but this does not matter).
Host system installed on mirrors based on sda and sdb physical disks.
sd{c..f} disks attached to KVM guest (whole disks, not partitions;
needed to use zfs (zfsonlinux) benefit features). Problem is that
disks (files in /dev) which attached to KVM guest has SELinux context
which inaccessible from context of smartd process.
[root@xxxxxxxxxx ~]# ls -laZ /dev/sd{a..f}
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 /dev/sda
brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 /dev/sdb
brw-rw----. qemu qemu system_u:object_r:svirt_image_t:s0:c281,c675 /dev/sdc
brw-rw----. qemu qemu system_u:object_r:svirt_image_t:s0:c281,c675 /dev/sdd
brw-rw----. qemu qemu system_u:object_r:svirt_image_t:s0:c281,c675 /dev/sde
brw-rw----. qemu qemu system_u:object_r:svirt_image_t:s0:c281,c675 /dev/sdf
[root@xxxxxxxxxx ~]# ps axwZ | grep smart[d]
system_u:system_r:fsdaemon_t:s0 1762 ? S 0:00
/usr/sbin/smartd -q never
When I restarts smartd next messages appears in audit.log:
[root@xxxxxxxxxx ~]# tail -F /var/log/audit/audit.log | grep type=AVC
type=AVC msg=audit(1357993548.964:8529): avc: denied { getattr } for
pid=21321 comm="smartd" path="/dev/sdc" dev=devtmpfs ino=6327
scontext=unconfined_u:system_r:fsdaemon_t:s0
tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file
type=AVC msg=audit(1357993548.965:8530): avc: denied { getattr } for
pid=21321 comm="smartd" path="/dev/sdd" dev=devtmpfs ino=6321
scontext=unconfined_u:system_r:fsdaemon_t:s0
tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file
type=AVC msg=audit(1357993548.966:8531): avc: denied { getattr } for
pid=21321 comm="smartd" path="/dev/sde" dev=devtmpfs ino=6324
scontext=unconfined_u:system_r:fsdaemon_t:s0
tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file
type=AVC msg=audit(1357993548.966:8532): avc: denied { getattr } for
pid=21321 comm="smartd" path="/dev/sdf" dev=devtmpfs ino=6330
scontext=unconfined_u:system_r:fsdaemon_t:s0
tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file
type=AVC msg=audit(1357993549.198:8533): avc: denied { read } for
pid=21321 comm="smartd" name="sdc" dev=devtmpfs ino=6327
scontext=unconfined_u:system_r:fsdaemon_t:s0
tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file
type=AVC msg=audit(1357993549.198:8534): avc: denied { read } for
pid=21321 comm="smartd" name="sdd" dev=devtmpfs ino=6321
scontext=unconfined_u:system_r:fsdaemon_t:s0
tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file
type=AVC msg=audit(1357993549.198:8535): avc: denied { read } for
pid=21321 comm="smartd" name="sde" dev=devtmpfs ino=6324
scontext=unconfined_u:system_r:fsdaemon_t:s0
tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file
type=AVC msg=audit(1357993549.198:8536): avc: denied { read } for
pid=21321 comm="smartd" name="sdf" dev=devtmpfs ino=6330
scontext=unconfined_u:system_r:fsdaemon_t:s0
tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file
I tried to create SELinux policy using audit2allow:
[root@xxxxxxxxxx ~]# cat /var/log/audit/audit.log | grep smartd |
audit2allow -M smartd_svirt_image
[root@xxxxxxxxxx ~]# semodule -i smartd_svirt_image.pp
but it not helped to solve problem.
How I can create permissive rule for selinux in my case?
Thank you.
--
GPG Key ID: 6EC5EB27
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
