Christian Ehrhardt a15bab0c68 apparmor: fix vfio usage without initial hostdev ... The base vfio has not much functionality but to provide a custom container by opening this path. See https://www.kernel.org/doc/Documentation/vfio.txt for more. Systems with static hostdevs will get /dev/vfio/vfio by virt-aa-hotplug right from the beginning. But if the guest initially had no hostdev at all it will run into the following deny before the security module labelling callbacks will make the actual vfio device (like /dev/vfio/93) known. Example of such a deny: [ 2652.756712] audit: type=1400 audit(1491303691.719:25): apparmor="DENIED" operation="open" profile="libvirt-17a61b87-5132-497c-b928-421ac2ee0c8a" name="/dev/vfio/vfio" pid=8486 comm="qemu-system-x86" requested_mask="wr" denied_mask="wr" fsuid=64055 ouid=0 Bug-Ubuntu: https://bugs.launchpad.net/bugs/1678322 Bug-Ubuntu: https://bugs.launchpad.net/bugs/1775777 Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com> Signed-off-by: Stefan Bader <stefan.bader@canonical.com> Acked-by: Jamie Strandboge <jamie@canonical.com> Reviewed-by: Erik Skultety <eskultet@redhat.com>		2018-06-12 16:09:25 +02:00
..
libvirt-lxc	Rework lxc apparmor profile	2014-07-15 12:57:05 -06:00
libvirt-qemu	apparmor: fix vfio usage without initial hostdev	2018-06-12 16:09:25 +02:00
TEMPLATE.lxc	apparmor: add attach_disconnected	2017-09-18 19:06:52 +02:00
TEMPLATE.qemu	apparmor: add attach_disconnected	2017-09-18 19:06:52 +02:00
usr.lib.libvirt.virt-aa-helper	AppArmor: allow virt-aa-helper read access to Nova's qcow backing files.	2018-06-12 10:43:37 +02:00
usr.sbin.libvirtd	apparmor: add rules to use qemu_bridge_helper	2018-04-12 11:09:29 +02:00