[libvirt] [PATCH 03/12] apparmor, libvirt-qemu: Allow read access to sysfs system info

Christian Ehrhardt christian.ehrhardt at canonical.com
Tue Dec 19 15:03:36 UTC 2017


From: Jamie Strandboge <jamie at ubuntu.com>

Newer qemu wants to read
/sys/devices/system/node/
/sys/devices/system/cpu/
/sys/devices/system/node/node[0-9]*/meminfo

Signed-off-by: Stefan Bader <stefan.bader at canonical.com>
---
 examples/apparmor/libvirt-qemu | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu
index 651d841..b9e45bd 100644
--- a/examples/apparmor/libvirt-qemu
+++ b/examples/apparmor/libvirt-qemu
@@ -34,6 +34,10 @@
   owner @{PROC}/@{pid}/task/@{tid}/comm rw,
   @{PROC}/sys/kernel/cap_last_cap r,
 
+  /sys/devices/system/node/ r,
+  /sys/devices/system/node/node[0-9]*/meminfo r,
+  /sys/devices/system/cpu/ r,
+
   # For hostdev access. The actual devices will be added dynamically
   /sys/bus/usb/devices/ r,
   /sys/devices/**/usb[0-9]*/** r,
-- 
2.7.4




More information about the libvir-list mailing list