From e0d8f36f435dc345b78bfa49dac7355a54cb4d36 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Tue, 12 Dec 2023 13:27:20 +0100 Subject: [PATCH] Update qatlib policy The commit addresses the following AVC denials: type=PROCTITLE msg=audit(12.12.2023 09:16:26.851:299) : proctitle=/usr/sbin/qatmgr --policy=0 type=SYSCALL msg=audit(12.12.2023 09:16:26.851:299) : arch=x86_64 syscall=ioctl success=yes exit=0 a0=0x5 a1=0x3b69 a2=0x3 a3=0x70000000004 items=0 ppid=1 pid=63688 auid=unset uid=root gid=qat euid=root suid=root fsuid=root egid=qat sgid=qat fsgid=qat tty=(none) ses=unset comm=qatmgr exe=/usr/sbin/qatmgr subj=system_u:system_r:qatlib_t:s0 key=(null) type=AVC msg=audit(12.12.2023 09:16:26.851:299) : avc: denied { ioctl } for pid=63688 comm=qatmgr path=/dev/vfio/465 dev="devtmpfs" ino=2030 ioctlcmd=0x3b69 scontext=system_u:system_r:qatlib_t:s0 tcontext=system_u:object_r:vfio_device_t:s0 tclass=chr_file permissive=1 type=PROCTITLE msg=audit(12.12.2023 09:16:31.459:301) : proctitle=/usr/sbin/qatmgr --policy=0 type=PATH msg=audit(12.12.2023 09:16:31.459:301) : item=1 name=(null) inode=3808 dev=00:18 mode=socket,660 ouid=root ogid=qat rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(12.12.2023 09:16:31.459:301) : item=0 name=(null) inode=3633 dev=00:18 mode=dir,755 ouid=root ogid=qat rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=SYSCALL msg=audit(12.12.2023 09:16:31.459:301) : arch=x86_64 syscall=bind success=yes exit=0 a0=0x3 a1=0x7ffdd4804e30 a2=0x6e a3=0x9 items=2 ppid=1 pid=63688 auid=unset uid=root gid=qat euid=root suid=root fsuid=root egid=qat sgid=qat fsgid=qat tty=(none) ses=unset comm=qatmgr exe=/usr/sbin/qatmgr subj=system_u:system_r:qatlib_t:s0 key=(null) type=AVC msg=audit(12.12.2023 09:16:31.459:301) : avc: denied { create } for pid=63688 comm=qatmgr name=qatmgr.sock scontext=system_u:system_r:qatlib_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=1 type=PROCTITLE msg=audit(12/12/23 18:36:06.978:95) : proctitle=lspci type=SYSCALL msg=audit(12/12/23 18:36:06.978:95) : arch=x86_64 syscall=pread success=yes exit=64 a0=0x3 a1=0x556bd3454480 a2=0x40 a3=0x0 items=0 ppid=4835 pid=4836 auid=unset uid=root gid=qat euid=root suid=root fsuid=root egid=qat sgid=qat fsgid=qat tty=(none) ses=unset comm=lspci exe=/usr/sbin/lspci subj=system_u:system_r:qatlib_t:s0 key=(null) type=AVC msg=audit(12/12/23 18:36:06.978:95) : avc: denied { sys_admin } for pid=4836 comm=lspci capability=sys_admin scontext=system_u:system_r:qatlib_t:s0 tcontext=system_u:system_r:qatlib_t:s0 tclass=capability permissive=0 type=PROCTITLE msg=audit(12/12/23 18:36:06.999:563) : proctitle=lspci type=SYSCALL msg=audit(12/12/23 18:36:06.999:563) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x7f57b0e408bc a2=O_RDONLY a3=0x0 items=0 ppid=4835 pid=4836 auid=unset uid=root gid=qat euid=root suid=root fsuid=root egid=qat sgid=qat fsgid=qat tty=(none) ses=unset comm=lspci exe=/usr/sbin/lspci subj=system_u:system_r:qatlib_t:s0 key=(null) type=AVC msg=audit(12/12/23 18:36:06.999:563) : avc: denied { search } for pid=4836 comm=lspci name=hwdata dev="dm-0" ino=650 scontext=system_u:system_r:qatlib_t:s0 tcontext=system_u:object_r:hwdata_t:s0 tclass=dir permissive=0 type=PROCTITLE msg=audit(12/13/2023 21:34:36.206:180) : proctitle=modprobe vfio-pci type=SYSCALL msg=audit(12/13/2023 21:34:36.206:180) : arch=x86_64 syscall=init_module success=no exit=EPERM(Operation not permitted) a0=0x562e3f4413e0 a1=0x22478 a2=0x562e3dacb962 a3=0x5 items=0 ppid=6527 pid=6531 auid=unset uid=root gid=qat euid=root suid=root fsuid=root egid=qat sgid=qat fsgid=qat tty=(none) ses=unset comm=modprobe exe=/usr/bin/kmod subj=system_u:system_r:qatlib_t:s0 key=(null) type=AVC msg=audit(12/13/2023 21:34:36.206:180) : avc: denied { sys_module } for pid=6531 comm=modprobe capability=sys_module scontext=system_u:system_r:qatlib_t:s0 tcontext=system_u:system_r:qatlib_t:s0 tclass=capability permissive=0 Resolves: RHEL-17947 --- policy/modules/contrib/qatlib.te | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/policy/modules/contrib/qatlib.te b/policy/modules/contrib/qatlib.te index 0e0cf2242d..72c13816c8 100644 --- a/policy/modules/contrib/qatlib.te +++ b/policy/modules/contrib/qatlib.te @@ -22,6 +22,7 @@ files_pid_file(qatlib_var_run_t) # # qatlib local policy # +allow qatlib_t self:capability { sys_admin sys_module }; allow qatlib_t self:fifo_file rw_fifo_file_perms; allow qatlib_t self:system module_load; allow qatlib_t self:unix_stream_socket create_stream_socket_perms; @@ -33,7 +34,8 @@ list_dirs_pattern(qatlib_t, qatlib_conf_t, qatlib_conf_t) manage_dirs_pattern(qatlib_t, qatlib_var_run_t, qatlib_var_run_t) manage_files_pattern(qatlib_t, qatlib_var_run_t, qatlib_var_run_t) -files_pid_filetrans(qatlib_t, qatlib_var_run_t, { dir file } ) +manage_sock_files_pattern(qatlib_t, qatlib_var_run_t, qatlib_var_run_t) +files_pid_filetrans(qatlib_t, qatlib_var_run_t, { dir file sock_file } ) kernel_read_proc_files(qatlib_t) kernel_request_load_module(qatlib_t) @@ -43,6 +45,7 @@ corecmd_exec_bin(qatlib_t) dev_create_sysfs_files(qatlib_t) dev_rw_sysfs(qatlib_t) +dev_rw_vfio_dev(qatlib_t) dev_setattr_generic_dirs(qatlib_t) domain_use_interactive_fds(qatlib_t) @@ -54,6 +57,7 @@ optional_policy(` ') optional_policy(` + miscfiles_read_hwdata(qatlib_t) miscfiles_read_localization(qatlib_t) ')