Shared memory devices need qemu to be able to access certain paths either for the shared memory directly (mostly ivshmem-plain) or for a socket (mostly ivshmem-doorbell). Add logic to virt-aa-helper to render those apparmor rules based on the domain configuration. https://bugzilla.redhat.com/show_bug.cgi?id=1761645 Reviewed-by: Cole Robinson <crobinso@xxxxxxxxxx> Signed-off-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx> --- src/security/virt-aa-helper.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 5ac9a9eeb8..c6c4bb9bd0 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -929,6 +929,7 @@ get_files(vahControl * ctl) int rc = -1; size_t i; char *uuid; + char *mem_path = NULL; char uuidstr[VIR_UUID_STRING_BUFLEN]; bool needsVfio = false, needsvhost = false, needsgl = false; @@ -1192,6 +1193,35 @@ get_files(vahControl * ctl) } } + for (i = 0; i < ctl->def->nshmems; i++) { + virDomainShmemDef *shmem = ctl->def->shmems[i]; + /* server path can be on any type and overwrites defaults */ + if (shmem->server.enabled && + shmem->server.chr.data.nix.path) { + if (vah_add_file(&buf, shmem->server.chr.data.nix.path, + "rw") != 0) + goto cleanup; + } else { + switch (shmem->model) { + case VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_PLAIN: + /* until exposed, recreate qemuBuildShmemBackendMemProps */ + mem_path = g_strdup_printf("/dev/shm/%s", shmem->name); + break; + case VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_DOORBELL: + case VIR_DOMAIN_SHMEM_MODEL_IVSHMEM: + /* until exposed, recreate qemuDomainPrepareShmemChardev */ + mem_path = g_strdup_printf("/var/lib/libvirt/shmem-%s-sock", + shmem->name); + break; + } + if (mem_path != NULL) { + if (vah_add_file(&buf, mem_path, "rw") != 0) + goto cleanup; + } + } + } + + if (ctl->def->tpm) { char *shortName = NULL; const char *tpmpath = NULL; @@ -1286,6 +1316,7 @@ get_files(vahControl * ctl) ctl->files = virBufferContentAndReset(&buf); cleanup: + VIR_FREE(mem_path); VIR_FREE(uuid); return rc; } -- 2.24.0 -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list
