[libvirt] [PATCH 2/2] apparmor: convert libvirtd profile to a named profile
Jamie Strandboge
jamie at canonical.com
Tue Jan 22 20:01:01 UTC 2019
On Mon, 14 Jan 2019, Jim Fehlig wrote:
> Signed-off-by: Jim Fehlig <jfehlig at suse.com>
> ---
>
> Optional patch that may need a bit of coorindation with upstream apparmor
> since the dnsmasq profile currently has 'peer=/usr/sbin/libvirtd'.
>
> src/security/apparmor/usr.sbin.libvirtd | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/src/security/apparmor/usr.sbin.libvirtd b/src/security/apparmor/usr.sbin.libvirtd
> index 0db52c524c..29f9936ad9 100644
> --- a/src/security/apparmor/usr.sbin.libvirtd
> +++ b/src/security/apparmor/usr.sbin.libvirtd
> @@ -2,7 +2,7 @@
> #include <tunables/global>
> @{LIBVIRT}="libvirt"
>
> -/usr/sbin/libvirtd flags=(attach_disconnected) {
> +profile libvirtd /usr/sbin/libvirtd flags=(attach_disconnected) {
> #include <abstractions/base>
> #include <abstractions/dbus>
>
> @@ -51,7 +51,7 @@
> unix (send, receive) type=stream addr=none peer=(label=unconfined addr=none),
>
> ptrace (read,trace) peer=unconfined,
> - ptrace (read,trace) peer=/usr/sbin/libvirtd,
> + ptrace (read,trace) peer=@{profile_name},
> ptrace (read,trace) peer=dnsmasq,
> ptrace (read,trace) peer=/usr/sbin/dnsmasq,
> ptrace (read,trace) peer=libvirt-*,
> @@ -123,6 +123,7 @@
> # For communication/control from libvirtd
> unix (send, receive) type=stream addr=none peer=(label=/usr/sbin/libvirtd),
> signal (receive) set=("term") peer=/usr/sbin/libvirtd,
> + signal (receive) set=("term") peer=libvirtd,
>
> /dev/net/tun rw,
> /etc/qemu/** r,
This also LGTM. It'd be nice if there was a mechanism to specify the parent
profile like we can the current profile, but we can't now and this is fine.
--
Jamie Strandboge | http://www.canonical.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20190122/380d7a08/attachment-0001.sig>
More information about the libvir-list
mailing list