<div dir="ltr">Hi Serge,<div><br></div><div>This is exactly what I had done locally when I solved the permission issues for my project, however removal of S_IFSOCK restriction is not enough to make vhost-user work correctly. You need also the changes to <span style="font-size:12.8000001907349px">get_files() I wrote in the first e-mail about.</span></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px">I'll send a patch for review (in separate thread) that adds these changes.</span></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px">Regards,</span></div><div><span style="font-size:12.8000001907349px">Michal</span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 18 June 2015 at 17:11, Serge Hallyn <span dir="ltr"><<a href="mailto:serge.hallyn@ubuntu.com" target="_blank">serge.hallyn@ubuntu.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">Quoting Jamie Strandboge (<a href="mailto:jamie@canonical.com">jamie@canonical.com</a>):<br>
> On 06/16/2015 08:40 AM, Michał Dubiel wrote:<br>
> > Hi all,<br>
> ><br>
> > May I kindly ask someone for some advice on this topic?<br>
> ><br>
> > Regards,<br>
> > Michal<br>
> ><br>
> > On 21 May 2015 at 20:23, Michał Dubiel <<a href="mailto:md@semihalf.com">md@semihalf.com</a><br>
> > <mailto:<a href="mailto:md@semihalf.com">md@semihalf.com</a>>> wrote:<br>
> ><br>
> > Hi guys,<br>
> ><br>
> > I have got a question. I need to add apparmor support for vhost-user socket<br>
> > files used to communicate with the vhost-user server app. Those ones defined<br>
> > with something like:<br>
> > <interface type='vhostuser'><br>
> > <mac address='02:ed:f3:5d:de:f3'/><br>
> > <source type='unix' path='/var/run/vrouter/uvh_vif_tapa8396c51-2a'<br>
> > mode='client'/><br>
> > <model type='virtio'/><br>
> > <address type='pci' domain='0x0000' bus='0x00' slot='0x03'<br>
> > function='0x0'/><br>
> > </interface><br>
> ><br>
> > I added something like this into get_files() function in virt-aa-helper.c:<br>
> > for (i = 0; i < ctl->def->nnets; i++) {<br>
> > if (ctl->def->nets[i] &&<br>
> > ctl->def->nets[i]->type == VIR_DOMAIN_NET_TYPE_VHOSTUSER &&<br>
> > ctl->def->nets[i]->data.vhostuser) {<br>
> > virDomainChrSourceDefPtr vhu = ctl->def->nets[i]->data.vhostuser;<br>
> ><br>
> > if (vah_add_file_chardev(&buf, vhu->data.nix.path, "rw",<br>
> > vhu->type) != 0)<br>
> > goto cleanup;<br>
> > }<br>
> > }<br>
> ><br>
> > However, there is a restriction for the socket file types in valid_path()<br>
> > function:<br>
> > switch (sb.st_mode & S_IFMT) {<br>
> > case S_IFSOCK:<br>
> > return 1;<br>
> > break;<br>
> > default:<br>
> > break;<br>
> > }<br>
> > That prevents this from working.<br>
> ><br>
> > May I ask why the socket file types are restricted? Vhost-user uses sockets<br>
> > so if I want to use apparmor virt-aa-helper has to be able to add the line<br>
> > for the socket file into /etc/apparmor.d/libvirt/libvirt-UUID.files.<br>
> ><br>
><br>
> They are restricted only because at the time virt-aa-helper.c was written there<br>
> wasn't a valid use for them. There were more checks in this part of the code but<br>
> over the years as more valid types were added to libvirt, they've been removed<br>
> and now we are left with just this one. Since there is now a valid usecase for<br>
> S_IFSOCK, it seems this can simply be removed.<br>
<br>
</div></div>So something like<br>
<br>
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c<br>
index 35423b5..bb5e449 100644<br>
--- a/src/security/virt-aa-helper.c<br>
+++ b/src/security/virt-aa-helper.c<br>
@@ -592,18 +592,8 @@ valid_path(const char *path, const bool readonly)<br>
<br>
if (!virFileExists(path)) {<br>
vah_warning(_("path does not exist, skipping file type checks"));<br>
- } else {<br>
- if (stat(path, &sb) == -1)<br>
- return -1;<br>
-<br>
- switch (sb.st_mode & S_IFMT) {<br>
- case S_IFSOCK:<br>
- return 1;<br>
- break;<br>
- default:<br>
- break;<br>
- }<br>
- }<br>
+ } else if (stat(path, &sb) == -1)<br>
+ return -1;<br>
<br>
opaths = sizeof(override)/sizeof(*(override));<br>
<br>
should be ok?<br>
<div class="HOEnZb"><div class="h5"><br>
--<br>
libvir-list mailing list<br>
<a href="mailto:libvir-list@redhat.com">libvir-list@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/libvir-list" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/libvir-list</a></div></div></blockquote></div><br></div>