Accepting request 247103 from home:cbosdonnat:branches:Virtualization

- bnc#893999: remove mount rules from libvirt-lxc apparmor
  abstraction file as those aren't handled by our kernel.
  apparmor-no-mount.patch

OBS-URL: https://build.opensuse.org/request/show/247103
OBS-URL: https://build.opensuse.org/package/show/Virtualization/libvirt?expand=0&rev=402

apparmor-no-mount.patch

@@ -0,0 +1,46 @@
+Index: libvirt-1.2.7/examples/apparmor/libvirt-lxc
+===================================================================
+--- libvirt-1.2.7.orig/examples/apparmor/libvirt-lxc
++++ libvirt-1.2.7/examples/apparmor/libvirt-lxc
+@@ -2,39 +2,15 @@
+ 
+   #include <abstractions/base>
+ 
+-  umount,
+-
+-  # ignore DENIED message on / remount
+-  deny mount options=(ro, remount) -> /,
+-
+-  # allow tmpfs mounts everywhere
+-  mount fstype=tmpfs,
+-
+-  # allow mqueue mounts everywhere
+-  mount fstype=mqueue,
+-
+-  # allow fuse mounts everywhere
+-  mount fstype=fuse.*,
+-
+-  # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted
+-  mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
++  # deny writes in /proc/sys/fs
+   deny @{PROC}/sys/fs/** wklx,
+ 
+-  # allow efivars to be mounted, writing to it will be blocked though
+-  mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
+-
+   # block some other dangerous paths
+   deny @{PROC}/sysrq-trigger rwklx,
+   deny @{PROC}/mem rwklx,
+   deny @{PROC}/kmem rwklx,
+ 
+-  # deny writes in /sys except for /sys/fs/cgroup, also allow
+-  # fusectl, securityfs and debugfs to be mounted there (read-only)
+-  mount fstype=fusectl -> /sys/fs/fuse/connections/,
+-  mount fstype=securityfs -> /sys/kernel/security/,
+-  mount fstype=debugfs -> /sys/kernel/debug/,
+-  mount fstype=proc -> /proc/,
+-  mount fstype=sysfs -> /sys/,
++  # deny writes in /sys
+   deny /sys/firmware/efi/efivars/** rwklx,
+   deny /sys/kernel/security/** rwklx,
+ 

libvirt.changes

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Mon Sep  1 14:48:26 UTC 2014 - cbosdonnat@suse.com
+
+- bnc#893999: remove mount rules from libvirt-lxc apparmor
+  abstraction file as those aren't handled by our kernel.
+  apparmor-no-mount.patch
+
 -------------------------------------------------------------------
 Fri Aug 29 16:12:28 UTC 2014 - mlatimer@suse.com
 

libvirt.spec

@@ -447,6 +447,7 @@ Patch207:       systemd-service-xen.patch
 Patch208:       disable-virCgroupGetPercpuStats-test.patch
 %if %{with_apparmor}
 Patch250:       install-apparmor-profiles.patch
+Patch251:       apparmor-no-mount.patch
 %endif
 %if %{with_netcontrol}
 Patch300:       libvirt-suse-netcontrol.patch
@@ -961,6 +962,7 @@ namespaces.
 %patch208 -p1
 %if %{with_apparmor}
 %patch250 -p1
+%patch251 -p1
 %endif
 %if %{with_netcontrol}
 %patch300 -p1