[libvirt PATCH 1/1] apparmor: Allow umount(/dev)
Jim Fehlig
jfehlig at suse.com
Wed Jan 18 15:59:23 UTC 2023
On 1/18/23 03:45, Andrea Bolognani wrote:
> On Wed, Jan 18, 2023 at 11:00:33AM +0100, Michal Prívozník wrote:
>> On 1/18/23 10:43, Andrea Bolognani wrote:
>>> Commit 379c0ce4bfed introduced a call to umount(/dev) performed
>>> inside the namespace that we run QEMU in.
>>>
>>> As a result of this, on machines using AppArmor, VM startup now
>>> fails with
>>>
>>> internal error: Process exited prior to exec: libvirt:
>>> QEMU Driver error: failed to umount devfs on /dev: Permission denied
>>>
>>> The corresponding denial is
>>>
>>> AVC apparmor="DENIED" operation="umount" profile="libvirtd"
>>> name="/dev/" pid=70036 comm="rpc-libvirtd"
>>>
>>> Extend the AppArmor configuration for virtqemud and libvirtd so
>>> that this operation is allowed.
>>>
>>> Signed-off-by: Andrea Bolognani <abologna at redhat.com>
>>> ---
>>> src/security/apparmor/usr.sbin.libvirtd.in | 1 +
>>> src/security/apparmor/usr.sbin.virtqemud.in | 1 +
>>> 2 files changed, 2 insertions(+)
>>
>> Reviewed-by: Michal Privoznik <mprivozn at redhat.com>
>>
>> For more background on why umount is needed see my reply to Jim's
>> question from earlier:
>>
>> https://listman.redhat.com/archives/libvir-list/2023-January/237149.html
>
> Welp, missed that one O:-)
>
> Jim, it looks like you came up with exactly the same solution as
> me, despite concerns about the size of the resulting hammer. Any
> other ideas, or should we just go ahead and merge this as-is?
My apparmor skills are too weak to select a smaller tool, so I'd say merge
as-is. It wasn't clear to me if/why the umount of /dev was actually needed, but
Michal did an excellent job of describing why it is.
Regards,
Jim
More information about the libvir-list
mailing list