forked from pool/libvirt
56 lines
2.3 KiB
Diff
56 lines
2.3 KiB
Diff
|
From b0d070a9b2d655c1bda5980c8176454fe7ee00b1 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Andrea Bolognani <abologna@redhat.com>
|
||
|
|
Date: Wed, 18 Jan 2023 10:28:04 +0100
|
||
|
|
Subject: [PATCH] apparmor: Allow umount(/dev)
|
||
|
|
|
||
|
|
Commit 379c0ce4bfed introduced a call to umount(/dev) performed
|
||
|
|
inside the namespace that we run QEMU in.
|
||
|
|
|
||
|
|
As a result of this, on machines using AppArmor, VM startup now
|
||
|
|
fails with
|
||
|
|
|
||
|
|
internal error: Process exited prior to exec: libvirt:
|
||
|
|
QEMU Driver error: failed to umount devfs on /dev: Permission denied
|
||
|
|
|
||
|
|
The corresponding denial is
|
||
|
|
|
||
|
|
AVC apparmor="DENIED" operation="umount" profile="libvirtd"
|
||
|
|
name="/dev/" pid=70036 comm="rpc-libvirtd"
|
||
|
|
|
||
|
|
Extend the AppArmor configuration for virtqemud and libvirtd so
|
||
|
|
that this operation is allowed.
|
||
|
|
|
||
|
|
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
|
||
|
|
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
|
||
|
|
Reviewed-by: Jim Fehlig <jfehlig@suse.com>
|
||
|
|
(cherry picked from commit ef4829510549ec68cf80774e98b200a3e7bbe51f)
|
||
|
|
---
|
||
|
|
src/security/apparmor/usr.sbin.libvirtd.in | 1 +
|
||
|
|
src/security/apparmor/usr.sbin.virtqemud.in | 1 +
|
||
|
|
2 files changed, 2 insertions(+)
|
||
|
|
|
||
|
|
Index: libvirt-9.0.0/src/security/apparmor/usr.sbin.libvirtd.in
|
||
|
|
===================================================================
|
||
|
|
--- libvirt-9.0.0.orig/src/security/apparmor/usr.sbin.libvirtd.in
|
||
|
|
+++ libvirt-9.0.0/src/security/apparmor/usr.sbin.libvirtd.in
|
||
|
|
@@ -35,6 +35,7 @@ profile libvirtd @sbindir@/libvirtd flag
|
||
|
|
mount options=(rw,rslave) -> /,
|
||
|
|
mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/,
|
||
|
|
umount /{var/,}run/libvirt/qemu/*.dev/,
|
||
|
|
+ umount /dev/,
|
||
|
|
|
||
|
|
# libvirt provides any mounts under /dev to qemu namespaces
|
||
|
|
mount options=(rw, move) /dev/ -> /{,var/}run/libvirt/qemu/*.dev/,
|
||
|
|
Index: libvirt-9.0.0/src/security/apparmor/usr.sbin.virtqemud.in
|
||
|
|
===================================================================
|
||
|
|
--- libvirt-9.0.0.orig/src/security/apparmor/usr.sbin.virtqemud.in
|
||
|
|
+++ libvirt-9.0.0/src/security/apparmor/usr.sbin.virtqemud.in
|
||
|
|
@@ -35,6 +35,7 @@ profile virtqemud @sbindir@/virtqemud fl
|
||
|
|
mount options=(rw,rslave) -> /,
|
||
|
|
mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/,
|
||
|
|
umount /{var/,}run/libvirt/qemu/*.dev/,
|
||
|
|
+ umount /dev/,
|
||
|
|
|
||
|
|
# libvirt provides any mounts under /dev to qemu namespaces
|
||
|
|
mount options=(rw, move) /dev/ -> /{,var/}run/libvirt/qemu/*.dev/,
|