Bugzilla – Bug 1186270
AUDIT-0: libvirt: new polkit permissions for node device delete
Last modified: 2024-03-13 09:21:01 UTC
libvirt 7.3.0 gets a new polkit permission for the node device object via commit bb311cede79, which causes the following lint failure libvirt-daemon.x86_64: E: polkit-untracked-privilege (Badness: 10) org.libvirt.api.node-device.delete (no:no:no) Hopefully non-controversial to whitelist with the 'no:no:no' perms. Error can be seen here https://build.opensuse.org/build/Virtualization/openSUSE_Factory/x86_64/libvirt/_log First noticed by dimstar in this request https://build.opensuse.org/request/show/894106
What libvirt is doing there with its privilege escalation framework is really strange. Overly complex, sadly. I will have a quick look and whitelist it if nothing out of the ordinary is to be found.
It is ridiculously hard to find where polkit actions are checked in libvirt. Every time, even though I already documented a couple of hints. Anyway the upstream commit that introduced this is bb311cede79 [1]. The actual check infrastructure for "NodeDevice" is reused and is found in virAccessManagerCheckNodeDevice(). To make things even more confusing is that the action is called "node-device.delete" while in the code it is called "NodeDeviceUndefine()". So much for documenting the change. Long story short: Should be fine security wise, I will whitelist it. [1]: https://libvirt.org/git/?p=libvirt.git;a=commit;h=bb311cede795213f02938f68aaa5504548eccafd
(In reply to Matthias Gerstner from comment #2) > It is ridiculously hard to find where polkit actions are checked in libvirt. Agreed. Luckily you don't have to touch other overly-engineered libvirt code :-). Sometimes I think RH folks have too much free time on their hands... > Anyway the > upstream commit that introduced this is bb311cede79 Nod. I mentioned that commit in #0.
(In reply to jfehlig@suse.com from comment #3) > > Anyway the > > upstream commit that introduced this is bb311cede79 > > Nod. I mentioned that commit in #0. Indeed. Should read my bugs more carefully ;-). The whitelisting is already in our devel project but I want to wait a bit before submitting to Factory to avoid interrupting an ongoing Staging project for whitelistings we already submitted a couple of days ago.
This is an autogenerated message for OBS integration: This bug (1186270) was mentioned in https://build.opensuse.org/request/show/895291 Factory / polkit-default-privs
The whitelisting is on its way. Closing this bug as FIXED.