On Mon, 03 Aug 2020, Christian Ehrhardt wrote:
> From: Jamie Strandboge <jamie@xxxxxxxxxx>
>
> Allow qemu to read @{PROC}/sys/vm/overcommit_memory.
> This is read on guest start-up and (as read-only) not a
> critical secret that has to stay hidden.
>
> Signed-off-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx>
> Signed-off-by: Stefan Bader <stefan.bader@xxxxxxxxxxxxx>
> Signed-off-by: Jamie Strandboge <jamie@xxxxxxxxxx>
> ---
> src/security/apparmor/libvirt-qemu | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu
> index 2d08d6f7ad..b132cf0226 100644
> --- a/src/security/apparmor/libvirt-qemu
> +++ b/src/security/apparmor/libvirt-qemu
> @@ -32,6 +32,7 @@
> # only modify its comm value or those in its thread group.
> owner @{PROC}/@{pid}/task/@{tid}/comm rw,
> @{PROC}/sys/kernel/cap_last_cap r,
> + @{PROC}/sys/vm/overcommit_memory r,
+1 to apply
--
Jamie Strandboge | http://www.canonical.com
