External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-11-10 07:20:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: Add capabilities for PCI passthrough to virtxend profile

Browse Source 
When splitting out the apparmor modular daemon profiles from the
libvirtd profile, the net_admin and sys_admin capabilities were
dropped from the virtxend profile. It was not known at the time
that these capabilities were needed for PCI passthrough. Without
the capabilities, the following messages are emitted from the audit
subsystem

audit: type=1400 audit(1702939277.946:63): apparmor="DENIED" \
operation="capable" class="cap" profile="virtxend" pid=3611 \
comm="rpc-virtxend" capability=21  capname="sys_admin"
audit: type=1400 audit(1702940304.818:63): apparmor="DENIED" \
operation="capable" class="cap" profile="virtxend" pid=3731 \
comm="rpc-virtxend" capability=12  capname="net_admin"

It appears sys_admin is needed to simply read from the PCI dev's
sysfs config file. The net_admin capability is needed when setting
the MAC address of an SR-IOV virtual function.

Signed-off-by: Jim Fehlig <jfehlig@suse.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
This commit is contained in:
Jim Fehlig 2023-12-18 16:48:13 -07:00
parent 19ce02c773
commit 405f479d0e
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/security/apparmor/usr.sbin.virtxend.in
View File

@ -5,8 +5,10 @@ profile virtxend @sbindir@/virtxend flags=(attach_disconnected) {
#include <abstractions/dbus> #include <abstractions/dbus>
capability kill, capability kill,
capability net_admin,
capability setgid, capability setgid,
capability setuid, capability setuid,
capability sys_admin,
capability sys_pacct, capability sys_pacct,
capability ipc_lock, capability ipc_lock,