forked from pool/libvirt
fcf349cddb
Release candidate 2 of libvirt 3.10.0 for Factory and SLE15 beta4.
- Update to libvirt 3.10.0 RC2
- Many incremental improvements and bug fixes, see
http://libvirt.org/news.html
- Dropped patches:
8056721c-qemu-null-storage-source.patch,
74a13be4-xdr-flags.patch,
apparmor-rules-for-new-mediation-features.patch,
apparmor-fine-grained-mount-rules.patch
- bsc#1070478, FATE#324479
- spec: remove use of 'systemctl enable'
bsc#1038401
- spec: enable firewalld support for SLE15, Leap15, and Tumbleweed
FATE#320794
OBS-URL: https://build.opensuse.org/request/show/547315
OBS-URL: https://build.opensuse.org/package/show/Virtualization/libvirt?expand=0&rev=644
27 lines
1.3 KiB
Diff
27 lines
1.3 KiB
Diff
apparmor: allow libvirtd to send signals to unconfined processes
|
|
|
|
When confinement of QEMU/KVM domains is not enforced (security_default_confined = 0),
|
|
qemu processes run unconfined. Add a rule to the libvirtd apparmor profile allowing
|
|
sending signals to unconfined processes. Without the rule, libvirtd
|
|
is unable to signal QEMU/KVM domains. E.g. 'virsh destroy dom' results in the
|
|
following denial in audit.log
|
|
|
|
type=AVC msg=audit(1510951646.581:939): apparmor="DENIED" operation="signal"
|
|
profile="/usr/sbin/libvirtd" pid=18891 comm="libvirtd" requested_mask="send"
|
|
denied_mask="send" signal=term peer="unconfined"
|
|
|
|
Index: libvirt-3.10.0/examples/apparmor/usr.sbin.libvirtd
|
|
===================================================================
|
|
--- libvirt-3.10.0.orig/examples/apparmor/usr.sbin.libvirtd
|
|
+++ libvirt-3.10.0/examples/apparmor/usr.sbin.libvirtd
|
|
@@ -60,6 +60,9 @@
|
|
|
|
signal (send) peer=/usr/sbin/dnsmasq,
|
|
signal (read, send) peer=libvirt-*,
|
|
+ # When confinement is not enforced (security_default_confined = 0), qemu
|
|
+ # processes run unconfined, hence 'peer=unconfined'
|
|
+ signal send set=(hup,kill,term) peer=unconfined,
|
|
|
|
# Very lenient profile for libvirtd since we want to first focus on confining
|
|
# the guests. Guests will have a very restricted profile.
|