2014-09-02 17:52:40 +02:00
|
|
|
Index: libvirt-1.2.8/examples/apparmor/Makefile.am
|
2011-08-08 23:26:58 +02:00
|
|
|
===================================================================
|
2014-09-02 17:52:40 +02:00
|
|
|
--- libvirt-1.2.8.orig/examples/apparmor/Makefile.am
|
|
|
|
|
+++ libvirt-1.2.8/examples/apparmor/Makefile.am
|
2014-07-16 15:45:18 +02:00
|
|
|
@@ -19,10 +19,22 @@ EXTRA_DIST= \
|
|
|
|
|
TEMPLATE.lxc \
|
2014-04-02 14:48:46 +02:00
|
|
|
libvirt-qemu \
|
|
|
|
|
libvirt-lxc \
|
2011-08-19 23:40:32 +02:00
|
|
|
- usr.lib.libvirt.virt-aa-helper \
|
|
|
|
|
- usr.sbin.libvirtd
|
|
|
|
|
+ usr.lib.libvirt.virt-aa-helper.in \
|
|
|
|
|
+ usr.sbin.libvirtd.in
|
2014-01-17 20:45:49 +01:00
|
|
|
|
|
|
|
|
if WITH_APPARMOR_PROFILES
|
2011-08-19 23:40:32 +02:00
|
|
|
+usr.lib.libvirt.virt-aa-helper: usr.lib.libvirt.virt-aa-helper.in
|
|
|
|
|
+ sed \
|
|
|
|
|
+ -e 's![@]libdir[@]!$(libdir)!g' \
|
|
|
|
|
+ < $< > $@-t
|
|
|
|
|
+ mv $@-t $@
|
|
|
|
|
+
|
|
|
|
|
+usr.sbin.libvirtd: usr.sbin.libvirtd.in
|
|
|
|
|
+ sed \
|
|
|
|
|
+ -e 's![@]libdir[@]!$(libdir)!g' \
|
|
|
|
|
+ < $< > $@-t
|
|
|
|
|
+ mv $@-t $@
|
|
|
|
|
+
|
2014-01-17 20:45:49 +01:00
|
|
|
apparmordir = $(sysconfdir)/apparmor.d/
|
|
|
|
|
apparmor_DATA = \
|
|
|
|
|
usr.lib.libvirt.virt-aa-helper \
|
2014-09-02 17:52:40 +02:00
|
|
|
Index: libvirt-1.2.8/examples/apparmor/usr.lib.libvirt.virt-aa-helper.in
|
2011-08-19 23:40:32 +02:00
|
|
|
===================================================================
|
|
|
|
|
--- /dev/null
|
2014-09-02 17:52:40 +02:00
|
|
|
+++ libvirt-1.2.8/examples/apparmor/usr.lib.libvirt.virt-aa-helper.in
|
2014-03-03 05:22:57 +01:00
|
|
|
@@ -0,0 +1,48 @@
|
|
|
|
|
+# Last Modified: Mon Apr 5 15:10:27 2010
|
2011-08-19 23:40:32 +02:00
|
|
|
+#include <tunables/global>
|
|
|
|
|
+
|
|
|
|
|
+@libdir@/libvirt/virt-aa-helper {
|
|
|
|
|
+ #include <abstractions/base>
|
|
|
|
|
+
|
|
|
|
|
+ # needed for searching directories
|
|
|
|
|
+ capability dac_override,
|
|
|
|
|
+ capability dac_read_search,
|
|
|
|
|
+
|
|
|
|
|
+ # needed for when disk is on a network filesystem
|
|
|
|
|
+ network inet,
|
|
|
|
|
+
|
|
|
|
|
+ deny @{PROC}/[0-9]*/mounts r,
|
2014-03-03 05:22:57 +01:00
|
|
|
+ @{PROC}/[0-9]*/net/psched r,
|
|
|
|
|
+ owner @{PROC}/[0-9]*/status r,
|
2011-08-19 23:40:32 +02:00
|
|
|
+ @{PROC}/filesystems r,
|
|
|
|
|
+
|
|
|
|
|
+ # for hostdev
|
|
|
|
|
+ /sys/devices/ r,
|
|
|
|
|
+ /sys/devices/** r,
|
|
|
|
|
+
|
|
|
|
|
+ @libdir@/libvirt/virt-aa-helper mr,
|
|
|
|
|
+ /sbin/apparmor_parser Ux,
|
|
|
|
|
+
|
|
|
|
|
+ /etc/apparmor.d/libvirt/* r,
|
|
|
|
|
+ /etc/apparmor.d/libvirt/libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw,
|
|
|
|
|
+
|
|
|
|
|
+ # for backingstore -- allow access to non-hidden files in @{HOME} as well
|
|
|
|
|
+ # as storage pools
|
|
|
|
|
+ audit deny @{HOME}/.* mrwkl,
|
|
|
|
|
+ audit deny @{HOME}/.*/ rw,
|
|
|
|
|
+ audit deny @{HOME}/.*/** mrwkl,
|
|
|
|
|
+ audit deny @{HOME}/bin/ rw,
|
|
|
|
|
+ audit deny @{HOME}/bin/** mrwkl,
|
|
|
|
|
+ @{HOME}/ r,
|
|
|
|
|
+ @{HOME}/** r,
|
|
|
|
|
+ /var/lib/libvirt/images/ r,
|
|
|
|
|
+ /var/lib/libvirt/images/** r,
|
2014-03-03 05:22:57 +01:00
|
|
|
+ /{media,mnt,opt,srv}/** r,
|
|
|
|
|
+
|
|
|
|
|
+ /**.img r,
|
|
|
|
|
+ /**.qcow{,2} r,
|
|
|
|
|
+ /**.qed r,
|
|
|
|
|
+ /**.vmdk r,
|
|
|
|
|
+ /**.[iI][sS][oO] r,
|
|
|
|
|
+ /**/disk{,.*} r,
|
|
|
|
|
+}
|
2014-09-02 17:52:40 +02:00
|
|
|
Index: libvirt-1.2.8/examples/apparmor/usr.sbin.libvirtd.in
|
2014-03-03 05:22:57 +01:00
|
|
|
===================================================================
|
|
|
|
|
--- /dev/null
|
2014-09-02 17:52:40 +02:00
|
|
|
+++ libvirt-1.2.8/examples/apparmor/usr.sbin.libvirtd.in
|
2014-08-29 19:00:28 +02:00
|
|
|
@@ -0,0 +1,68 @@
|
2014-03-03 05:22:57 +01:00
|
|
|
+# Last Modified: Mon Apr 5 15:03:58 2010
|
|
|
|
|
+#include <tunables/global>
|
|
|
|
|
+@{LIBVIRT}="libvirt"
|
|
|
|
|
+
|
|
|
|
|
+/usr/sbin/libvirtd {
|
|
|
|
|
+ #include <abstractions/base>
|
|
|
|
|
+ #include <abstractions/dbus>
|
|
|
|
|
+
|
|
|
|
|
+ capability kill,
|
|
|
|
|
+ capability net_admin,
|
|
|
|
|
+ capability net_raw,
|
|
|
|
|
+ capability setgid,
|
|
|
|
|
+ capability sys_admin,
|
|
|
|
|
+ capability sys_module,
|
|
|
|
|
+ capability sys_ptrace,
|
|
|
|
|
+ capability sys_nice,
|
|
|
|
|
+ capability sys_chroot,
|
|
|
|
|
+ capability setuid,
|
|
|
|
|
+ capability dac_override,
|
|
|
|
|
+ capability dac_read_search,
|
|
|
|
|
+ capability fowner,
|
|
|
|
|
+ capability chown,
|
|
|
|
|
+ capability setpcap,
|
|
|
|
|
+ capability mknod,
|
|
|
|
|
+ capability fsetid,
|
|
|
|
|
+ capability audit_write,
|
2014-04-02 14:48:46 +02:00
|
|
|
+
|
|
|
|
|
+ # Needed for vfio
|
|
|
|
|
+ capability sys_resource,
|
2014-03-03 05:22:57 +01:00
|
|
|
+
|
|
|
|
|
+ network inet stream,
|
|
|
|
|
+ network inet dgram,
|
|
|
|
|
+ network inet6 stream,
|
|
|
|
|
+ network inet6 dgram,
|
|
|
|
|
+ network packet dgram,
|
2014-08-29 19:00:28 +02:00
|
|
|
+ network packet raw,
|
2014-03-03 05:22:57 +01:00
|
|
|
+
|
|
|
|
|
+ # Very lenient profile for libvirtd since we want to first focus on confining
|
|
|
|
|
+ # the guests. Guests will have a very restricted profile.
|
|
|
|
|
+ / r,
|
|
|
|
|
+ /** rwmkl,
|
|
|
|
|
+
|
|
|
|
|
+ /bin/* PUx,
|
|
|
|
|
+ /sbin/* PUx,
|
|
|
|
|
+ /usr/bin/* PUx,
|
|
|
|
|
+ /usr/sbin/* PUx,
|
|
|
|
|
+ /lib/udev/scsi_id PUx,
|
|
|
|
|
+ /usr/lib/xen/bin/* Ux,
|
|
|
|
|
+ /usr/lib64/xen/bin/* Ux,
|
|
|
|
|
+ /usr/lib/polkit-1/polkit-agent-helper Px,
|
|
|
|
|
+
|
|
|
|
|
+ # force the use of virt-aa-helper
|
|
|
|
|
+ audit deny /sbin/apparmor_parser rwxl,
|
|
|
|
|
+ audit deny /etc/apparmor.d/libvirt/** wxl,
|
|
|
|
|
+ audit deny /sys/kernel/security/apparmor/features rwxl,
|
|
|
|
|
+ audit deny /sys/kernel/security/apparmor/matching rwxl,
|
|
|
|
|
+ audit deny /sys/kernel/security/apparmor/.* rwxl,
|
|
|
|
|
+ /sys/kernel/security/apparmor/profiles r,
|
|
|
|
|
+ @libdir@/libvirt/* PUxr,
|
|
|
|
|
+ /etc/libvirt/hooks/** rmix,
|
|
|
|
|
+ /etc/xen/scripts/** rmix,
|
|
|
|
|
+ @libdir@/libvirt/libvirt_parthelper Ux,
|
|
|
|
|
+ @libdir@/libvirt/libvirt_iohelper Ux,
|
|
|
|
|
+
|
|
|
|
|
+ # allow changing to our UUID-based named profiles
|
|
|
|
|
+ change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
|
|
|
|
|
+
|
2011-08-19 23:40:32 +02:00
|
|
|
+}
|
2014-09-02 17:52:40 +02:00
|
|
|
Index: libvirt-1.2.8/examples/apparmor/usr.lib.libvirt.virt-aa-helper
|
2011-08-19 23:40:32 +02:00
|
|
|
===================================================================
|
2014-09-02 17:52:40 +02:00
|
|
|
--- libvirt-1.2.8.orig/examples/apparmor/usr.lib.libvirt.virt-aa-helper
|
2011-08-19 23:40:32 +02:00
|
|
|
+++ /dev/null
|
2014-03-03 05:22:57 +01:00
|
|
|
@@ -1,48 +0,0 @@
|
2011-08-19 23:40:32 +02:00
|
|
|
-# Last Modified: Mon Apr 5 15:10:27 2010
|
|
|
|
|
-#include <tunables/global>
|
|
|
|
|
-
|
|
|
|
|
-/usr/lib/libvirt/virt-aa-helper {
|
|
|
|
|
- #include <abstractions/base>
|
|
|
|
|
-
|
|
|
|
|
- # needed for searching directories
|
|
|
|
|
- capability dac_override,
|
|
|
|
|
- capability dac_read_search,
|
|
|
|
|
-
|
|
|
|
|
- # needed for when disk is on a network filesystem
|
|
|
|
|
- network inet,
|
|
|
|
|
-
|
|
|
|
|
- deny @{PROC}/[0-9]*/mounts r,
|
2014-03-03 05:22:57 +01:00
|
|
|
- @{PROC}/[0-9]*/net/psched r,
|
|
|
|
|
- owner @{PROC}/[0-9]*/status r,
|
2011-08-19 23:40:32 +02:00
|
|
|
- @{PROC}/filesystems r,
|
|
|
|
|
-
|
|
|
|
|
- # for hostdev
|
|
|
|
|
- /sys/devices/ r,
|
|
|
|
|
- /sys/devices/** r,
|
|
|
|
|
-
|
|
|
|
|
- /usr/lib/libvirt/virt-aa-helper mr,
|
|
|
|
|
- /sbin/apparmor_parser Ux,
|
|
|
|
|
-
|
|
|
|
|
- /etc/apparmor.d/libvirt/* r,
|
|
|
|
|
- /etc/apparmor.d/libvirt/libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw,
|
|
|
|
|
-
|
|
|
|
|
- # for backingstore -- allow access to non-hidden files in @{HOME} as well
|
|
|
|
|
- # as storage pools
|
|
|
|
|
- audit deny @{HOME}/.* mrwkl,
|
|
|
|
|
- audit deny @{HOME}/.*/ rw,
|
|
|
|
|
- audit deny @{HOME}/.*/** mrwkl,
|
|
|
|
|
- audit deny @{HOME}/bin/ rw,
|
|
|
|
|
- audit deny @{HOME}/bin/** mrwkl,
|
|
|
|
|
- @{HOME}/ r,
|
|
|
|
|
- @{HOME}/** r,
|
|
|
|
|
- /var/lib/libvirt/images/ r,
|
|
|
|
|
- /var/lib/libvirt/images/** r,
|
2014-03-03 05:22:57 +01:00
|
|
|
- /{media,mnt,opt,srv}/** r,
|
|
|
|
|
-
|
|
|
|
|
- /**.img r,
|
|
|
|
|
- /**.qcow{,2} r,
|
|
|
|
|
- /**.qed r,
|
|
|
|
|
- /**.vmdk r,
|
|
|
|
|
- /**.[iI][sS][oO] r,
|
|
|
|
|
- /**/disk{,.*} r,
|
2011-08-19 23:40:32 +02:00
|
|
|
-}
|
2014-09-02 17:52:40 +02:00
|
|
|
Index: libvirt-1.2.8/examples/apparmor/usr.sbin.libvirtd
|
2011-08-19 23:40:32 +02:00
|
|
|
===================================================================
|
2014-09-02 17:52:40 +02:00
|
|
|
--- libvirt-1.2.8.orig/examples/apparmor/usr.sbin.libvirtd
|
2011-08-19 23:40:32 +02:00
|
|
|
+++ /dev/null
|
2014-04-02 14:48:46 +02:00
|
|
|
@@ -1,63 +0,0 @@
|
2011-08-19 23:40:32 +02:00
|
|
|
-# Last Modified: Mon Apr 5 15:03:58 2010
|
|
|
|
|
-#include <tunables/global>
|
|
|
|
|
-@{LIBVIRT}="libvirt"
|
|
|
|
|
-
|
|
|
|
|
-/usr/sbin/libvirtd {
|
|
|
|
|
- #include <abstractions/base>
|
2014-03-03 05:22:57 +01:00
|
|
|
- #include <abstractions/dbus>
|
2011-08-19 23:40:32 +02:00
|
|
|
-
|
|
|
|
|
- capability kill,
|
|
|
|
|
- capability net_admin,
|
|
|
|
|
- capability net_raw,
|
|
|
|
|
- capability setgid,
|
|
|
|
|
- capability sys_admin,
|
|
|
|
|
- capability sys_module,
|
|
|
|
|
- capability sys_ptrace,
|
|
|
|
|
- capability sys_nice,
|
|
|
|
|
- capability sys_chroot,
|
|
|
|
|
- capability setuid,
|
|
|
|
|
- capability dac_override,
|
|
|
|
|
- capability dac_read_search,
|
|
|
|
|
- capability fowner,
|
|
|
|
|
- capability chown,
|
|
|
|
|
- capability setpcap,
|
|
|
|
|
- capability mknod,
|
|
|
|
|
- capability fsetid,
|
2014-03-03 05:22:57 +01:00
|
|
|
- capability audit_write,
|
2011-08-19 23:40:32 +02:00
|
|
|
-
|
2014-04-02 14:48:46 +02:00
|
|
|
- # Needed for vfio
|
|
|
|
|
- capability sys_resource,
|
|
|
|
|
-
|
2011-08-19 23:40:32 +02:00
|
|
|
- network inet stream,
|
|
|
|
|
- network inet dgram,
|
|
|
|
|
- network inet6 stream,
|
|
|
|
|
- network inet6 dgram,
|
2014-03-03 05:22:57 +01:00
|
|
|
- network packet dgram,
|
2011-08-19 23:40:32 +02:00
|
|
|
-
|
|
|
|
|
- # Very lenient profile for libvirtd since we want to first focus on confining
|
|
|
|
|
- # the guests. Guests will have a very restricted profile.
|
2014-03-03 05:22:57 +01:00
|
|
|
- / r,
|
2011-08-19 23:40:32 +02:00
|
|
|
- /** rwmkl,
|
|
|
|
|
-
|
2014-03-03 05:22:57 +01:00
|
|
|
- /bin/* PUx,
|
|
|
|
|
- /sbin/* PUx,
|
|
|
|
|
- /usr/bin/* PUx,
|
|
|
|
|
- /usr/sbin/* PUx,
|
|
|
|
|
- /lib/udev/scsi_id PUx,
|
|
|
|
|
- /usr/lib/xen-common/bin/xen-toolstack PUx,
|
2011-08-19 23:40:32 +02:00
|
|
|
-
|
|
|
|
|
- # force the use of virt-aa-helper
|
|
|
|
|
- audit deny /sbin/apparmor_parser rwxl,
|
|
|
|
|
- audit deny /etc/apparmor.d/libvirt/** wxl,
|
|
|
|
|
- audit deny /sys/kernel/security/apparmor/features rwxl,
|
|
|
|
|
- audit deny /sys/kernel/security/apparmor/matching rwxl,
|
|
|
|
|
- audit deny /sys/kernel/security/apparmor/.* rwxl,
|
|
|
|
|
- /sys/kernel/security/apparmor/profiles r,
|
|
|
|
|
- /usr/lib/libvirt/* PUxr,
|
2014-03-03 05:22:57 +01:00
|
|
|
- /etc/libvirt/hooks/** rmix,
|
|
|
|
|
- /etc/xen/scripts/** rmix,
|
2011-08-19 23:40:32 +02:00
|
|
|
-
|
|
|
|
|
- # allow changing to our UUID-based named profiles
|
|
|
|
|
- change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
|
|
|
|
|
-
|
|
|
|
|
-}
|
