Re: [PATCH v2 5/5] apparmor: allow to preserve /dev mountpoints into qemu namespaces

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, 2018-08-14 at 08:18 +0200, Christian Ehrhardt wrote:
> Libvirt now tries to preserve all mounts under /dev in qemu
> namespaces.
> The old rules only listed a set of known paths but those are no more
> enough.
> 
> I found some due to containers like /dev/.lxc/* and such but also
> /dev/console
> and /dev/net/tun.
> 
> Libvirt is correct to do so, but we can no more predict the names
> properly, so
> we modify the rule to allow a wildcard based pattern matching what
> libvirt does.
> 
> Signed-off-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx>
> ---
>  examples/apparmor/usr.sbin.libvirtd | 16 +++++-----------
>  1 file changed, 5 insertions(+), 11 deletions(-)
> 
> diff --git a/examples/apparmor/usr.sbin.libvirtd
> b/examples/apparmor/usr.sbin.libvirtd
> index 3ff43c32a2..8625862ced 100644
> --- a/examples/apparmor/usr.sbin.libvirtd
> +++ b/examples/apparmor/usr.sbin.libvirtd
> @@ -33,17 +33,11 @@
>    mount options=(rw,rslave)  -> /,
>    mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/,
>  
> -  mount options=(rw, move) /dev/           ->
> /{var/,}run/libvirt/qemu/*.dev/,
> -  mount options=(rw, move) /dev/hugepages/ ->
> /{var/,}run/libvirt/qemu/*.hugepages/,
> -  mount options=(rw, move) /dev/mqueue/    ->
> /{var/,}run/libvirt/qemu/*.mqueue/,
> -  mount options=(rw, move) /dev/pts/       ->
> /{var/,}run/libvirt/qemu/*.pts/,
> -  mount options=(rw, move) /dev/shm/       ->
> /{var/,}run/libvirt/qemu/*.shm/,
> -
> -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/       ->
> /dev/,
> -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.hugepages/ ->
> /dev/hugepages/,
> -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.mqueue/    ->
> /dev/mqueue/,
> -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.pts/       ->
> /dev/pts/,
> -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.shm/       ->
> /dev/shm/,
> +  # libvirt provides any mounts under /dev to qemu namespaces
> +  mount options=(rw, move) /dev/ -> /{var/,}run/libvirt/qemu/*.dev/,
> +  mount options=(rw, move) /dev/** ->
> /{var/,}run/libvirt/qemu/*{/,},
> +  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> /dev/,
> +  mount options=(rw, move) /{var/,}run/libvirt/qemu/*{/,} ->
> /dev/**,

+1 for the rules. Please change '{var/,}' to '{,var/}' and '{/,}' to
'{,/}' since, while equivalent, the latter is a more widely use rule
style (I recognize that the previous rules used '{var/,}').

-- 
Jamie Strandboge             | http://www.canonical.com

Attachment: signature.asc
Description: This is a digitally signed message part

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list

[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]

  Powered by Linux