[Libguestfs] Writing policy for guestfsd in libguestfs live

[Richard W.M. Jones]

Dan(s), I hope you can give us some advice on this.

Background: guestfsd is a guest agent.  Normally it runs inside a
special appliance; that's *not* the case that I'm worried about.
There's also another mode where you can run guestfsd inside a regular
Fedora or RHEL guest, and it handles instructions from the host to
perform filesystem operations.

The mode is called 'libguestfs live'[1][2] and architecturally it
looks like this:

           +-------------------------+
           | Fedora/RHEL guest       |
           |                         |
           |   guestfsd (agent)      |  qemu/KVM
           +------^------------------+
                  |
     Host         | (virtio serial channel)
                  v
               libguestfs (library)
               some program using libguestfs,
               eg. guestfish, a virt tool

If you want to try it, install 'libguestfs-live-service' in a Fedora
guest, edit the guest XML as per instructions in [2], and on the host
do:

  guestfish --live -d FedoraGuest

and try sending (non-destructive) commands to the guest agent.

Currently guestfsd is a monolithic daemon, so if you choose to run it
in your guest, then it can do pretty much anything in the libguestfs
API, which is a shorthand way of saying it can do pretty much
anything, eg. reading and writing any guest file, executing any
program, creating and deleting guest partitions, creating and deleting
guest LVs ...

The expected scenario is that the guest is controlled by the same
authority as the host, but possibly in future we'll have to find a way
to limit what guestfsd can do (via a configuration file).

The questions are:

(a) Can we meaningfully write an SELinux policy to confine guestfsd?
For example if guestfsd were to be included as a separate package in
RHEL, which it might be for RHEL 6.4.

(b) Can we change the design of guestfsd (within reason) to make it
simpler to write SELinux policy for guestfsd, and if so how?

(c) Is there any sort of privilege separation design that would make
sense here (cf. Privilege-separated OpenSSH).

Rich.

[1] http://libguestfs.org/guestfs.3.html#attaching_to_running_daemons
[2] https://rwmj.wordpress.com/2011/07/06/libguestfs-live/

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
libguestfs lets you edit virtual machines.  Supports shell scripting,
bindings from many languages.  http://libguestfs.org