mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2025-02-01 09:25:18 +00:00
405f479d0e
When splitting out the apparmor modular daemon profiles from the libvirtd profile, the net_admin and sys_admin capabilities were dropped from the virtxend profile. It was not known at the time that these capabilities were needed for PCI passthrough. Without the capabilities, the following messages are emitted from the audit subsystem audit: type=1400 audit(1702939277.946:63): apparmor="DENIED" \ operation="capable" class="cap" profile="virtxend" pid=3611 \ comm="rpc-virtxend" capability=21 capname="sys_admin" audit: type=1400 audit(1702940304.818:63): apparmor="DENIED" \ operation="capable" class="cap" profile="virtxend" pid=3731 \ comm="rpc-virtxend" capability=12 capname="net_admin" It appears sys_admin is needed to simply read from the PCI dev's sysfs config file. The net_admin capability is needed when setting the MAC address of an SR-IOV virtual function. Signed-off-by: Jim Fehlig <jfehlig@suse.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
62 lines
1.6 KiB
Plaintext
62 lines
1.6 KiB
Plaintext
#include <tunables/global>
|
|
|
|
profile virtxend @sbindir@/virtxend flags=(attach_disconnected) {
|
|
#include <abstractions/base>
|
|
#include <abstractions/dbus>
|
|
|
|
capability kill,
|
|
capability net_admin,
|
|
capability setgid,
|
|
capability setuid,
|
|
capability sys_admin,
|
|
capability sys_pacct,
|
|
capability ipc_lock,
|
|
|
|
network inet stream,
|
|
network inet dgram,
|
|
network inet6 stream,
|
|
network inet6 dgram,
|
|
network netlink raw,
|
|
network packet dgram,
|
|
network packet raw,
|
|
|
|
# for --p2p migrations
|
|
unix (send, receive) type=stream addr=none peer=(label=unconfined addr=none),
|
|
|
|
ptrace (read,trace) peer=unconfined,
|
|
|
|
signal (send) set=(kill, term, hup) peer=unconfined,
|
|
|
|
# Very lenient profile for virtxend
|
|
/ r,
|
|
/** rwmkl,
|
|
|
|
/bin/* PUx,
|
|
/sbin/* PUx,
|
|
/usr/bin/* PUx,
|
|
@sbindir@/virtlogd pix,
|
|
@sbindir@/* PUx,
|
|
/{usr/,}lib/udev/scsi_id PUx,
|
|
/usr/{lib,lib64}/xen-common/bin/xen-toolstack PUx,
|
|
/usr/{lib,lib64,libexec}/xen/bin/* Ux,
|
|
/usr/{lib,libexec}/xen-*/bin/libxl-save-helper PUx,
|
|
/usr/{lib,libexec}/xen-*/bin/pygrub PUx,
|
|
|
|
# force the use of virt-aa-helper
|
|
audit deny /{usr/,}sbin/apparmor_parser rwxl,
|
|
audit deny /etc/apparmor.d/libvirt/** wxl,
|
|
audit deny /sys/kernel/security/apparmor/features rwxl,
|
|
audit deny /sys/kernel/security/apparmor/matching rwxl,
|
|
audit deny /sys/kernel/security/apparmor/.* rwxl,
|
|
/sys/kernel/security/apparmor/profiles r,
|
|
@libexecdir@/* PUxr,
|
|
@libexecdir@/libvirt_parthelper ix,
|
|
@libexecdir@/libvirt_iohelper ix,
|
|
/etc/libvirt/hooks/** rmix,
|
|
/etc/xen/scripts/** rmix,
|
|
|
|
@BEGIN_APPARMOR_3@
|
|
include if exists <local/usr.sbin.virtxend>
|
|
@END_APPARMOR_3@
|
|
}
|