-
Notifications
You must be signed in to change notification settings - Fork 59
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
AVC Denial on qemu-ga Fedora CoreOS 33.20210201.10.0 #733
Comments
coreos/coreos-assembler#1920 is related to this. |
Thanks for the report. However we don't ship a |
OKD bugs should go to https://github.com/openshift/okd first, as it uses a customized payload. |
Wouldn't it be better to align RHCOS and FCOS and get qemu-ga included within FCOS as it has been done in RHCOS? |
Both OKD payload and RHCOS include qemu agent. FCOS doesn't need it pre-installed, as most clouds won't use it (and users can install it manually if required) |
Even for RHCOS I think long-term we should make it an extension instead of baking it into the host. |
While we prefer to keep FCOS and RHCOS reasonably aligned, they have somewhat different goals and use cases. FCOS and RHCOS both have a general policy of omitting guest agents, but sometimes one OS makes an exception to that policy while the other does not. (I'd disagree with @vrutkovs' reasoning, though. In cases where FCOS does ship guest agents, it ships them to all platforms, and we generally discourage users from installing packages not shipped with the image.) |
Ah, okay, I don't mind FCOS shipping this agent (I mistakenly assumed its useful for OKD purposes only). In any case to get more info about this bug we need a bug for Fedora's selinux-policy package, similar to https://bugzilla.redhat.com/show_bug.cgi?id=1908527 |
To be clear, I'm not arguing in favor of shipping the agent. Previous discussion is in #74. |
Have you already opened it or should I? |
Please go ahead |
Any update? I still see this happening on FCOS 34 and https://bugzilla.redhat.com/show_bug.cgi?id=1927639 didn't move in months |
This looks like an harmless warning that could be a dontaudit rule and fixed in the agent. Upstream code should be there: https://gitlab.com/qemu-project/qemu/-/tree/master/qga |
@a2902793 yes, on the worker node. |
https://bugzilla.redhat.com/show_bug.cgi?id=1927639#c6 > This is the fix for OS that ship the agent. |
Closing this old issue out. |
Describe the bug
Running Fedora CoreOS 33.20210201.10.0 within a VM hosted on oVirt.
Journal shows every 10 seconds:
Reproduction steps
Steps to reproduce the behavior:
Expected behavior
After installation no denials should happen: either the policy needs a fix or the qemu-ga shouldn't access the resource.
Actual behavior
Journal bein spammed by AVC denials
System details
Ignition config
This comes from an existing OKD 4.5 upgrade up to 4.7, not sure the original ignition is still relevant
Additional information
Add any other information about the problem here.
The text was updated successfully, but these errors were encountered: