From 3d7320403b8dd8b224a0c1eb832cfb2e89818ed3 Mon Sep 17 00:00:00 2001 From: Jamie Strandboge Date: Thu, 14 Jul 2011 12:06:20 -0500 Subject: [PATCH] update apparmor security driver for new udev paths In the Ubuntu development release we recently got a new udev that moves /var/run to /run, /var/lock to /run/lock and /dev/shm to /run/shm. This change in udev requires updating the apparmor security driver in libvirt[1]. Attached is a patch that: * adjusts src/security/virt-aa-helper.c to allow both LOCALSTATEDIR/run/libvirt/**/%s.pid and /run/libvirt/**/%s.pid. While the profile is not as precise, LOCALSTATEDIR/run/ is typically a symlink to /run/ anyway, so there is no additional access (remember that apparmor resolves symlinks, which is why this is still required even if /var/run points to /run). * adjusts example/apparmor/libvirt-qemu paths for /dev/shm [1]https://launchpad.net/bugs/810270 -- Jamie Strandboge | http://www.canonical.com --- examples/apparmor/libvirt-qemu | 6 +++--- src/security/virt-aa-helper.c | 2 ++ 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu index 32515366c7..10cdd36b5f 100644 --- a/examples/apparmor/libvirt-qemu +++ b/examples/apparmor/libvirt-qemu @@ -27,9 +27,9 @@ # but may constitute a security risk. If your environment does not require # the use of sound in your VMs, feel free to comment out or prepend 'deny' to # the rules for files in /dev. - /dev/shm/ r, - /dev/shm/pulse-shm* r, - /dev/shm/pulse-shm* rwk, + /{dev,run}/shm r, + /{dev,run}/shmpulse-shm* r, + /{dev,run}/shmpulse-shm* rwk, /dev/snd/* rw, capability ipc_lock, # 'kill' is not required for sound and is a security risk. Do not enable diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index fb54dc5e19..856d32f591 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1166,6 +1166,8 @@ main(int argc, char **argv) LOCALSTATEDIR, ctl->def->name); virBufferAsprintf(&buf, " \"%s/run/libvirt/**/%s.pid\" rwk,\n", LOCALSTATEDIR, ctl->def->name); + virBufferAsprintf(&buf, " \"/run/libvirt/**/%s.pid\" rwk,\n", + ctl->def->name); if (ctl->files) virBufferAdd(&buf, ctl->files, -1); }