AVC Denial on qemu-ga Fedora CoreOS 33.20210201.10.0

[sandrobonazzola]

Describe the bug
Running Fedora CoreOS 33.20210201.10.0 within a VM hosted on oVirt.
Journal shows every 10 seconds:

AVC avc:  denied  { search } for  pid=696 comm="qemu-ga" name="containers" dev="sda4" ino=119537792 scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:container_var_lib_t:s0 tclass=dir permissive=0

Reproduction steps
Steps to reproduce the behavior:

1. Deploy OKD 4.6 or OKD 4.7 on top of oVirt (Bare metal UPI used in this specific case)
2. Look at workers journal
3. See AVC denials

Expected behavior
After installation no denials should happen: either the policy needs a fix or the qemu-ga shouldn't access the resource.

Actual behavior
Journal bein spammed by AVC denials

System details

• Bare Metal UPI on top of KVM VMs managed by oVirt
• Fedora CoreOS version: 33.20210201.10.0

Ignition config
This comes from an existing OKD 4.5 upgrade up to 4.7, not sure the original ignition is still relevant

Additional information
Add any other information about the problem here.

[cgwalters]

coreos/coreos-assembler#1920 is related to this.

[lucab]

Thanks for the report. However we don't ship a qemu-ga binary in FCOS images, so that is probably coming from an overlaid package or a container. This should be probably reported against OKD or somewhere in Fedora.
@vrutkovs @LorbusChris where are such kind of SELinux troubles in OKD reported?

[vrutkovs]

OKD bugs should go to https://github.com/openshift/okd first, as it uses a customized payload.

[sandrobonazzola]

Wouldn't it be better to align RHCOS and FCOS and get qemu-ga included within FCOS as it has been done in RHCOS?
It will provide more valuable feedback from community and will reduce the differences between OKD and OCP.

[vrutkovs]

Both OKD payload and RHCOS include qemu agent. FCOS doesn't need it pre-installed, as most clouds won't use it (and users can install it manually if required)

[jlebon]

Wouldn't it be better to align RHCOS and FCOS and get qemu-ga included within FCOS as it has been done in RHCOS?

Even for RHCOS I think long-term we should make it an extension instead of baking it into the host.

[bgilbert]

Wouldn't it be better to align RHCOS and FCOS and get qemu-ga included within FCOS as it has been done in RHCOS?

While we prefer to keep FCOS and RHCOS reasonably aligned, they have somewhat different goals and use cases. FCOS and RHCOS both have a general policy of omitting guest agents, but sometimes one OS makes an exception to that policy while the other does not.

(I'd disagree with @vrutkovs' reasoning, though. In cases where FCOS does ship guest agents, it ships them to all platforms, and we generally discourage users from installing packages not shipped with the image.)

[vrutkovs]

Ah, okay, I don't mind FCOS shipping this agent (I mistakenly assumed its useful for OKD purposes only).

In any case to get more info about this bug we need a bug for Fedora's selinux-policy package, similar to https://bugzilla.redhat.com/show_bug.cgi?id=1908527

[bgilbert]

To be clear, I'm not arguing in favor of shipping the agent. Previous discussion is in #74.

[sandrobonazzola]

Ah, okay, I don't mind FCOS shipping this agent (I mistakenly assumed its useful for OKD purposes only).

In any case to get more info about this bug we need a bug for Fedora's selinux-policy package, similar to https://bugzilla.redhat.com/show_bug.cgi?id=1908527

Have you already opened it or should I?

[vrutkovs]

Please go ahead

[sandrobonazzola]

Opened at https://bugzilla.redhat.com/show_bug.cgi?id=1927639

[sandrobonazzola]

Any update? I still see this happening on FCOS 34 and https://bugzilla.redhat.com/show_bug.cgi?id=1927639 didn't move in months

[travier]

This looks like an harmless warning that could be a dontaudit rule and fixed in the agent. Upstream code should be there: https://gitlab.com/qemu-project/qemu/-/tree/master/qga

[sandrobonazzola]

@a2902793 yes, on the worker node.

[travier]

https://bugzilla.redhat.com/show_bug.cgi?id=1927639#c6 > This is the fix for OS that ship the agent.

[dustymabe]

Closing this old issue out.