On Sun, 2017-11-05 at 15:29 +0000, intrigeri+libvirt@xxxxxxxx wrote: > From: intrigeri <intrigeri+libvirt@xxxxxxxx> > > This set of rules was proposed by Christian Boltz <apparmor@xxxxxxxxx > > > on https://bugzilla.opensuse.org/show_bug.cgi?id=1065123. > --- > examples/apparmor/usr.sbin.libvirtd | 15 ++++++++++++++- > 1 file changed, 14 insertions(+), 1 deletion(-) > > diff --git a/examples/apparmor/usr.sbin.libvirtd > b/examples/apparmor/usr.sbin.libvirtd > index d2831aa491..8d61d154e1 100644 > --- a/examples/apparmor/usr.sbin.libvirtd > +++ b/examples/apparmor/usr.sbin.libvirtd > @@ -30,7 +30,20 @@ > # Needed for vfio > capability sys_resource, > > - mount, > + mount options=(rw,rslave) -> /, > + mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/, > + > + mount options=(rw, move) /dev/ -> > /{var/,}run/libvirt/qemu/*.dev/, > + mount options=(rw, move) /dev/hugepages/ -> > /{var/,}run/libvirt/qemu/*.hugepages/, > + mount options=(rw, move) /dev/mqueue/ -> > /{var/,}run/libvirt/qemu/*.mqueue/, > + mount options=(rw, move) /dev/pts/ -> > /{var/,}run/libvirt/qemu/*.pts/, > + mount options=(rw, move) /dev/shm/ -> > /{var/,}run/libvirt/qemu/*.shm/, > + > + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> > /dev/, > + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.hugepages/ -> > /dev/hugepages/, > + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.mqueue/ -> > /dev/mqueue/, > + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.pts/ -> > /dev/pts/, > + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.shm/ -> > /dev/shm/, > These all look fine. I suspect the rules may need to be fine-tuned for different distributions, but that's ok, this is example policy and we can iterate/adjust as needed. -- Jamie Strandboge | http://www.canonical.com
Attachment:
signature.asc
Description: This is a digitally signed message part
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list
