mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-09-09 09:14:57 +00:00
apparmor: allow unix stream for p2p migrations
On live migration with --p2p like: $ virsh migrate --live --p2p kvmguest-bionic-normal \ qemu+ssh://10.6.221.80/system We hit an apparmor deny like: apparmor="DENIED" operation="file_inherit" profile="/usr/sbin/libvirtd" pid=23477 comm="ssh" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send" addr=none peer_addr=none peer="unconfined" The rule is not perfect, but can't be restricted further at the moment (new upstream kernel features needed). For now the lack of a profile on the peer as well as comm not being a conditional on rules do not allow to filter further. Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
This commit is contained in:
parent
4ce06ba6f4
commit
8f882cf36e
@ -53,6 +53,9 @@
|
|||||||
network packet dgram,
|
network packet dgram,
|
||||||
network packet raw,
|
network packet raw,
|
||||||
|
|
||||||
|
# for --p2p migrations
|
||||||
|
unix (send, receive) type=stream addr=none peer=(label=unconfined addr=none),
|
||||||
|
|
||||||
ptrace (trace) peer=unconfined,
|
ptrace (trace) peer=unconfined,
|
||||||
ptrace (trace) peer=/usr/sbin/libvirtd,
|
ptrace (trace) peer=/usr/sbin/libvirtd,
|
||||||
ptrace (trace) peer=/usr/sbin/dnsmasq,
|
ptrace (trace) peer=/usr/sbin/dnsmasq,
|
||||||
|
Loading…
Reference in New Issue
Block a user