<div dir="ltr"><br><br><div class="gmail_quote"><div dir="ltr">On Mon, Aug 13, 2018 at 7:11 PM Jamie Strandboge <<a href="mailto:jamie@canonical.com">jamie@canonical.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Mon, 2018-08-13 at 16:39 +0200, Christian Ehrhardt wrote:<br>
> Libvirt now tries to preserve all mounts under /dev in qemu<br>
> namespaces.<br>
> The old rules only listed a set of known paths but those are no more<br>
> enough.<br>
> <br>
> I found some due to containers like /dev/.lxc/* and such but also<br>
> /dev/console<br>
> and /dev/net/tun.<br>
> <br>
> Libvirt is correct to do so, but we can no more predict the names<br>
> properly, so<br>
> we modify the rule to allow a wildcard based pattern matching what<br>
> libvirt does.<br>
> <br>
> Signed-off-by: Christian Ehrhardt <<a href="mailto:christian.ehrhardt@canonical.com" target="_blank">christian.ehrhardt@canonical.com</a>><br>
> ---<br>
> examples/apparmor/usr.sbin.libvirtd | 16 +++++-----------<br>
> 1 file changed, 5 insertions(+), 11 deletions(-)<br>
> <br>
> diff --git a/examples/apparmor/usr.sbin.libvirtd<br>
> b/examples/apparmor/usr.sbin.libvirtd<br>
> index 3ff43c32a2..b2e38fe0ad 100644<br>
> --- a/examples/apparmor/usr.sbin.libvirtd<br>
> +++ b/examples/apparmor/usr.sbin.libvirtd<br>
> @@ -33,17 +33,11 @@<br>
> mount options=(rw,rslave) -> /,<br>
> mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/,<br>
> <br>
> - mount options=(rw, move) /dev/ -><br>
> /{var/,}run/libvirt/qemu/*.dev/,<br>
> - mount options=(rw, move) /dev/hugepages/ -><br>
> /{var/,}run/libvirt/qemu/*.hugepages/,<br>
> - mount options=(rw, move) /dev/mqueue/ -><br>
> /{var/,}run/libvirt/qemu/*.mqueue/,<br>
> - mount options=(rw, move) /dev/pts/ -><br>
> /{var/,}run/libvirt/qemu/*.pts/,<br>
> - mount options=(rw, move) /dev/shm/ -><br>
> /{var/,}run/libvirt/qemu/*.shm/,<br>
> -<br>
> - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -><br>
> /dev/,<br>
> - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.hugepages/ -><br>
> /dev/hugepages/,<br>
> - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.mqueue/ -><br>
> /dev/mqueue/,<br>
> - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.pts/ -><br>
> /dev/pts/,<br>
> - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.shm/ -><br>
> /dev/shm/,<br>
> + # libvirt provides any mounts under /dev to qemu namespaces<br>
> + mount options=(rw, move) /dev/ -> /{var/,}run/libvirt/qemu/*.dev/,<br>
> + mount options=(rw, move) /dev/**{/,} -><br>
> /{var/,}run/libvirt/qemu/*{/,},<br>
<br>
What are you trying to convey with this rule? As written, the '{/,}' is<br>
redundant since '**' will match that.<br></blockquote><div><br></div><div>I had issues on the other end, with different paths being accessed with/without trailing slash</div><div> /{var/,}run/libvirt/qemu/*{/,},<br></div><div>So I added the trailing "with or without slash" part.</div><div>You are right, on the other end due to the unpredictable path I already had ** which will cover the trailing slash.</div><div>I can do a V2 without the trailing part on the side that has the "**" already</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
> + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> /dev/,<br>
> + mount options=(rw, move) /{var/,}run/libvirt/qemu/*{/,} -><br>
> /dev/**{/,},<br>
<br>
ditto<br>
<br>
-- <br>
Jamie Strandboge | <a href="http://www.canonical.com" rel="noreferrer" target="_blank">http://www.canonical.com</a></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><span style="color:rgb(136,136,136);font-size:12.8px">Christian Ehrhardt</span><div style="color:rgb(136,136,136);font-size:12.8px">Software Engineer, Ubuntu Server</div><div style="color:rgb(136,136,136);font-size:12.8px">Canonical Ltd</div></div></div></div></div></div>