libvirt/examples/apparmor/TEMPLATE.qemu

#
# This profile is for the domain whose UUID matches this file.
#

#include <tunables/global>

profile LIBVIRT_TEMPLATE flags=(attach_disconnected) {
  #include <abstractions/libvirt-qemu>
}
Documentation and examples for SVirt Apparmor driver * docs/drvqemu.html.in: include documentation for AppArmor sVirt confinement * examples/apparmor/TEMPLATE examples/apparmor/libvirt-qemu examples/apparmor/usr.lib.libvirt.virt-aa-helper examples/apparmor/usr.sbin.libvirtd: example templates and configuration files for SVirt Apparmor when using KVM/QEmu 2009-10-08 14:42:05 +00:00			`#`
			`# This profile is for the domain whose UUID matches this file.`
			`#`

			`#include <tunables/global>`

apparmor: add attach_disconnected Otherwise we fail to reconnect to /dev/net/tun opened by libvirtd like [ 8144.507756] audit: type=1400 audit(1505488162.386:38069121): apparmor="DENIED" operation="file_perm" info="Failed name lookup - disconnected path" error=-13 profile="libvirt-5dfcc8a7-b79a-4fa9-a41f-f6271651934c" name="dev/net/tun" pid=9607 comm="qemu-system-x86" requested_mask="r" denied_mask="r" fsuid=117 ouid=0 Reviewed-By: Jamie Strandboge <jamie@canonical.com> Acked-By: Michal Privoznik <mprivozn@redhat.com> 2017-09-15 15:13:16 +00:00			`profile LIBVIRT_TEMPLATE flags=(attach_disconnected) {`
Rework lxc apparmor profile Rework the apparmor lxc profile abstraction to mimic ubuntu's container-default. This profile allows quite a lot, but strives to restrict access to dangerous resources. Removing the explicit authorizations to bash, systemd and cron files, forces them to keep the lxc profile for all applications inside the container. PUx permissions where leading to running systemd (and others tasks) unconfined. Put the generic files, network and capabilities restrictions directly in the TEMPLATE.lxc: this way, users can restrict them on a per container basis. 2014-07-15 09:02:50 +00:00			`#include <abstractions/libvirt-qemu>`
Documentation and examples for SVirt Apparmor driver * docs/drvqemu.html.in: include documentation for AppArmor sVirt confinement * examples/apparmor/TEMPLATE examples/apparmor/libvirt-qemu examples/apparmor/usr.lib.libvirt.virt-aa-helper examples/apparmor/usr.sbin.libvirtd: example templates and configuration files for SVirt Apparmor when using KVM/QEmu 2009-10-08 14:42:05 +00:00			`}`