On 12/19/2017 02:13 PM, Christian Ehrhardt wrote: > On live migration with --p2p like: > $ virsh migrate --live --p2p kvmguest-bionic-normal \ > qemu+ssh://10.6.221.80/system > > We hit an apparmor deny like: > apparmor="DENIED" operation="file_inherit" > profile="/usr/sbin/libvirtd" pid=23477 comm="ssh" family="unix" > sock_type="stream" protocol=0 requested_mask="send receive" > denied_mask="send" addr=none peer_addr=none peer="unconfined" > > The rule is not perfect, but can't be restricted further at the moment > (new upstream kernel features needed). For now the lack of a profile on the > peer as well as comm not being a conditional on rules do not allow to filter > further. > > Signed-off-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx> > --- > examples/apparmor/usr.sbin.libvirtd | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd > index 8d61d15..febe8a4 100644 > --- a/examples/apparmor/usr.sbin.libvirtd > +++ b/examples/apparmor/usr.sbin.libvirtd > @@ -53,6 +53,9 @@ > network packet dgram, > network packet raw, > > + # for --p2p migrations > + unix (send, receive) type=stream addr=none peer=(label=unconfined addr=none), > + > ptrace (trace) peer=unconfined, > ptrace (trace) peer=/usr/sbin/libvirtd, > ptrace (trace) peer=/usr/sbin/dnsmasq, > ACKed and pushed. Michal -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list
