On Tue, 2017-12-19 at 14:13 +0100, Christian Ehrhardt wrote: > On live migration with --p2p like: > $ virsh migrate --live --p2p kvmguest-bionic-normal \ > qemu+ssh://10.6.221.80/system > > We hit an apparmor deny like: > apparmor="DENIED" operation="file_inherit" > profile="/usr/sbin/libvirtd" pid=23477 comm="ssh" family="unix" > sock_type="stream" protocol=0 requested_mask="send receive" > denied_mask="send" addr=none peer_addr=none peer="unconfined" > > The rule is not perfect, but can't be restricted further at the > moment > (new upstream kernel features needed). For now the lack of a profile > on the > peer as well as comm not being a conditional on rules do not allow to > filter > further. > > Signed-off-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx> > --- > examples/apparmor/usr.sbin.libvirtd | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/examples/apparmor/usr.sbin.libvirtd > b/examples/apparmor/usr.sbin.libvirtd > index 8d61d15..febe8a4 100644 > --- a/examples/apparmor/usr.sbin.libvirtd > +++ b/examples/apparmor/usr.sbin.libvirtd > @@ -53,6 +53,9 @@ > network packet dgram, > network packet raw, > > + # for --p2p migrations > + unix (send, receive) type=stream addr=none peer=(label=unconfined > addr=none), > + This rule is fine, but for completeness note that the upstream kernel doesn't support unix rules yet. apparmor_parsers that do will handle this rule fine though, so +1 to apply. -- Jamie Strandboge | http://www.canonical.com
Attachment:
signature.asc
Description: This is a digitally signed message part
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list
