External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-10-21 13:39:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: read only access to overcommit_memory

Browse Source 
Allow qemu to read @{PROC}/sys/vm/overcommit_memory.
This is read on guest start-up and (as read-only) not a
critical secret that has to stay hidden.

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Jamie Strandboge <jamie@ubuntu.com>
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
This commit is contained in:
Jamie Strandboge 2020-08-03 13:41:33 +02:00 committed by Christian Ehrhardt
parent 8b6ee1afdb
commit e16967fd6e
No known key found for this signature in database
GPG Key ID: BA3E29338280B242
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/security/apparmor/libvirt-qemu
View File

@ -32,6 +32,7 @@
# only modify its comm value or those in its thread group. # only modify its comm value or those in its thread group.
owner @{PROC}/@{pid}/task/@{tid}/comm rw, owner @{PROC}/@{pid}/task/@{tid}/comm rw,
@{PROC}/sys/kernel/cap_last_cap r, @{PROC}/sys/kernel/cap_last_cap r,
@{PROC}/sys/vm/overcommit_memory r,
# For hostdev access. The actual devices will be added dynamically # For hostdev access. The actual devices will be added dynamically
/sys/bus/usb/devices/ r, /sys/bus/usb/devices/ r,