[PATCH] apparmor: qemu load old shared objects
Daniel P. Berrangé
berrange at redhat.com
Fri Mar 13 10:50:19 UTC 2020
On Fri, Mar 13, 2020 at 09:56:12AM +0100, Christian Ehrhardt wrote:
> On qemu upgrades the old .so files usually are replaced. But on the other
> hand since a qemu process represents a guest instance it is usually kept
> around.
>
> That makes late addition of dynamic features e.g. 'hot-attach of a ceph
> disk' fail by trying to load a new version of e.f. block-rbd.so into an
> old still running qemu binary.
>
> Qemu adds a fallback to also load modules from a versioned directory in the
> temporary /var/run path. That way qemu is providing a way for packaging
> to store modules of an upgraded qemu package as needed until the next reboot.
>
> This change is allowing the qemu process access to these paths.
>
> Background:
> This is a continuation of a discussion at KVM Forum 2019 eventually
> becoming [1] and recently this change is queued to get into qemu properly [2].
>
> [1]: https://lists.gnu.org/archive/html/qemu-devel/2019-11/msg00005.html
> [2]: https://lists.nongnu.org/archive/html/qemu-devel/2020-03/msg03313.html
>
> Signed-off-by: Christian Ehrhardt <christian.ehrhardt at canonical.com>
> ---
> src/security/apparmor/libvirt-qemu | 5 +++++
> 1 file changed, 5 insertions(+)
Reviewed-by: Daniel P. Berrangé <berrange at redhat.com>
>
> diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu
> index 80986aec61..22415c9dfd 100644
> --- a/src/security/apparmor/libvirt-qemu
> +++ b/src/security/apparmor/libvirt-qemu
> @@ -164,6 +164,11 @@
> /usr/{lib,lib64}/qemu/*.so mr,
> /usr/lib/@{multiarch}/qemu/*.so mr,
>
> + # let qemu load old shared objects after upgrades (LP: #1847361)
> + /{var/,}run/qemu/*/*.so mr,
> + # but explicitly deny with auditing writing to these files
> + audit deny /{var/,}run/qemu/*/*.so w,
> +
> # swtpm
> /{usr/,}bin/swtpm rmix,
> /usr/{lib,lib64}/libswtpm_libtpms.so mr,
> --
> 2.25.1
>
>
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
More information about the libvir-list
mailing list