On Mon, Aug 13, 2018 at 7:11 PM Jamie Strandboge <jamie@xxxxxxxxxxxxx> wrote:
On Mon, 2018-08-13 at 16:39 +0200, Christian Ehrhardt wrote:
> Libvirt now tries to preserve all mounts under /dev in qemu
> namespaces.
> The old rules only listed a set of known paths but those are no more
> enough.
>
> I found some due to containers like /dev/.lxc/* and such but also
> /dev/console
> and /dev/net/tun.
>
> Libvirt is correct to do so, but we can no more predict the names
> properly, so
> we modify the rule to allow a wildcard based pattern matching what
> libvirt does.
>
> Signed-off-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx>
> ---
> examples/apparmor/usr.sbin.libvirtd | 16 +++++-----------
> 1 file changed, 5 insertions(+), 11 deletions(-)
>
> diff --git a/examples/apparmor/usr.sbin.libvirtd
> b/examples/apparmor/usr.sbin.libvirtd
> index 3ff43c32a2..b2e38fe0ad 100644
> --- a/examples/apparmor/usr.sbin.libvirtd
> +++ b/examples/apparmor/usr.sbin.libvirtd
> @@ -33,17 +33,11 @@
> mount options=(rw,rslave) -> /,
> mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/,
>
> - mount options=(rw, move) /dev/ ->
> /{var/,}run/libvirt/qemu/*.dev/,
> - mount options=(rw, move) /dev/hugepages/ ->
> /{var/,}run/libvirt/qemu/*.hugepages/,
> - mount options=(rw, move) /dev/mqueue/ ->
> /{var/,}run/libvirt/qemu/*.mqueue/,
> - mount options=(rw, move) /dev/pts/ ->
> /{var/,}run/libvirt/qemu/*.pts/,
> - mount options=(rw, move) /dev/shm/ ->
> /{var/,}run/libvirt/qemu/*.shm/,
> -
> - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ ->
> /dev/,
> - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.hugepages/ ->
> /dev/hugepages/,
> - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.mqueue/ ->
> /dev/mqueue/,
> - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.pts/ ->
> /dev/pts/,
> - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.shm/ ->
> /dev/shm/,
> + # libvirt provides any mounts under /dev to qemu namespaces
> + mount options=(rw, move) /dev/ -> /{var/,}run/libvirt/qemu/*.dev/,
> + mount options=(rw, move) /dev/**{/,} ->
> /{var/,}run/libvirt/qemu/*{/,},
What are you trying to convey with this rule? As written, the '{/,}' is
redundant since '**' will match that.
I had issues on the other end, with different paths being accessed with/without trailing slash
/{var/,}run/libvirt/qemu/*{/,},
So I added the trailing "with or without slash" part.
You are right, on the other end due to the unpredictable path I already had ** which will cover the trailing slash.
I can do a V2 without the trailing part on the side that has the "**" already
> + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> /dev/,
> + mount options=(rw, move) /{var/,}run/libvirt/qemu/*{/,} ->
> /dev/**{/,},
ditto
--
Jamie Strandboge | http://www.canonical.com
Christian Ehrhardt
Software Engineer, Ubuntu Server
Canonical Ltd
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list
