External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-31 17:05:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: fix UUID specification

Browse Source 
There is a common misconception when writing AppArmor policy that
[0-9]* applies * to the [0-9] class, but that's not the case. For this
example, [0-9]* matches a single digit followed by any number of
characters except for /

Create a UUID variable that uses the following format 8-4-4-4-12.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Jim Fehlig <jfehlig@suse.com>
This commit is contained in:
Georgia Garcia 2025-01-07 12:23:38 -03:00 committed by Jim Fehlig
parent a751d30220
commit 18ea5e19c6
3 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in
View File

@ -1,5 +1,8 @@
#include <tunables/global> #include <tunables/global>
@{hextet}=[0-9a-f][0-9a-f][0-9a-f][0-9a-f]
@{UUID}=@{hextet}@{hextet}-@{hextet}-@{hextet}-@{hextet}-@{hextet}@{hextet}@{hextet}
profile virt-aa-helper @libexecdir@/virt-aa-helper { profile virt-aa-helper @libexecdir@/virt-aa-helper {
#include <abstractions/base> #include <abstractions/base>
#include <abstractions/openssl> #include <abstractions/openssl>
@ -44,7 +47,7 @@ profile virt-aa-helper @libexecdir@/virt-aa-helper {
/{usr/,}{s,}bin/apparmor_parser Ux, /{usr/,}{s,}bin/apparmor_parser Ux,
@sysconfdir@/apparmor.d/libvirt/* r, @sysconfdir@/apparmor.d/libvirt/* r,
@sysconfdir@/apparmor.d/libvirt/libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw, @sysconfdir@/apparmor.d/libvirt/libvirt-@{UUID}* rw,
# for backingstore -- allow access to non-hidden files in @{HOME} as well # for backingstore -- allow access to non-hidden files in @{HOME} as well
# as storage pools # as storage pools

7
src/security/apparmor/usr.sbin.libvirtd.in
View File

@ -1,4 +1,7 @@
#include <tunables/global> #include <tunables/global>
@{hextet}=[0-9a-f][0-9a-f][0-9a-f][0-9a-f]
@{UUID}=@{hextet}@{hextet}-@{hextet}-@{hextet}-@{hextet}-@{hextet}@{hextet}@{hextet}
@{LIBVIRT}="libvirt" @{LIBVIRT}="libvirt"
profile libvirtd @sbindir@/libvirtd flags=(attach_disconnected) { profile libvirtd @sbindir@/libvirtd flags=(attach_disconnected) {
@ -72,7 +75,7 @@ profile libvirtd @sbindir@/libvirtd flags=(attach_disconnected) {
signal (send) set=("term") peer=libvirtd//qemu_bridge_helper, signal (send) set=("term") peer=libvirtd//qemu_bridge_helper,
# allow connect with openGraphicsFD, direction reversed in newer versions # allow connect with openGraphicsFD, direction reversed in newer versions
unix (send, receive) type=stream addr=none peer=(label=libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*), unix (send, receive) type=stream addr=none peer=(label=libvirt-@{UUID}),
# unconfined also required if guests run without security module # unconfined also required if guests run without security module
unix (send, receive) type=stream addr=none peer=(label=unconfined), unix (send, receive) type=stream addr=none peer=(label=unconfined),
@ -115,7 +118,7 @@ profile libvirtd @sbindir@/libvirtd flags=(attach_disconnected) {
/etc/xen/scripts/** rmix, /etc/xen/scripts/** rmix,
# allow changing to our UUID-based named profiles # allow changing to our UUID-based named profiles
change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*, change_profile -> @{LIBVIRT}-@{UUID},
/usr/{lib,lib64,lib/qemu,libexec,libexec/qemu}/qemu-bridge-helper Cx -> qemu_bridge_helper, /usr/{lib,lib64,lib/qemu,libexec,libexec/qemu}/qemu-bridge-helper Cx -> qemu_bridge_helper,
# child profile for bridge helper process # child profile for bridge helper process

6
src/security/apparmor/usr.sbin.virtqemud.in
View File

@ -1,5 +1,7 @@
#include <tunables/global> #include <tunables/global>
@{LIBVIRT}="libvirt" @{LIBVIRT}="libvirt"
@{hextet}=[0-9a-f][0-9a-f][0-9a-f][0-9a-f]
@{UUID}=@{hextet}@{hextet}-@{hextet}-@{hextet}-@{hextet}-@{hextet}@{hextet}@{hextet}
profile virtqemud @sbindir@/virtqemud flags=(attach_disconnected) { profile virtqemud @sbindir@/virtqemud flags=(attach_disconnected) {
#include <abstractions/base> #include <abstractions/base>
@ -71,7 +73,7 @@ profile virtqemud @sbindir@/virtqemud flags=(attach_disconnected) {
signal (send) set=(term) peer=libvirtd//qemu_bridge_helper, signal (send) set=(term) peer=libvirtd//qemu_bridge_helper,
# allow connect with openGraphicsFD, direction reversed in newer versions # allow connect with openGraphicsFD, direction reversed in newer versions
unix (send, receive) type=stream addr=none peer=(label=libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*), unix (send, receive) type=stream addr=none peer=(label=libvirt-@{UUID}),
# unconfined also required if guests run without security module # unconfined also required if guests run without security module
unix (send, receive) type=stream addr=none peer=(label=unconfined), unix (send, receive) type=stream addr=none peer=(label=unconfined),
@ -109,7 +111,7 @@ profile virtqemud @sbindir@/virtqemud flags=(attach_disconnected) {
/etc/libvirt/hooks/** rmix, /etc/libvirt/hooks/** rmix,
# allow changing to our UUID-based named profiles # allow changing to our UUID-based named profiles
change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*, change_profile -> @{LIBVIRT}-@{UUID},
/usr/{lib,lib64,lib/qemu,libexec,libexec/qemu}/qemu-bridge-helper Cx -> qemu_bridge_helper, /usr/{lib,lib64,lib/qemu,libexec,libexec/qemu}/qemu-bridge-helper Cx -> qemu_bridge_helper,
# child profile for bridge helper process # child profile for bridge helper process