Re: [libvirt] [PATCH 4/4] apparmor: allow to preserve /dev mountpoints into qemu namespaces

On Mon, 2018-08-13 at 16:39 +0200, Christian Ehrhardt wrote: > Libvirt now tries to preserve all mounts under /dev in qemu > namespaces. > The old rules only listed a set of known paths but those are no more > enough. > > I found some due to containers like /dev/.lxc/* and such but also > /dev/console > and /dev/net/tun. > > Libvirt is correct to do so, but we can no more predict the names > properly, so > we modify the rule to allow a wildcard based pattern matching what > libvirt does. > > Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com&gt; > --- > examples/apparmor/usr.sbin.libvirtd | 16 +++++----------- > 1 file changed, 5 insertions(+), 11 deletions(-) > > diff --git a/examples/apparmor/usr.sbin.libvirtd > b/examples/apparmor/usr.sbin.libvirtd > index 3ff43c32a2..b2e38fe0ad 100644 > --- a/examples/apparmor/usr.sbin.libvirtd > +++ b/examples/apparmor/usr.sbin.libvirtd > @@ -33,17 +33,11 @@ > mount options=(rw,rslave) -> /, > mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/, > > - mount options=(rw, move) /dev/ -> > /{var/,}run/libvirt/qemu/*.dev/, > - mount options=(rw, move) /dev/hugepages/ -> > /{var/,}run/libvirt/qemu/*.hugepages/, > - mount options=(rw, move) /dev/mqueue/ -> > /{var/,}run/libvirt/qemu/*.mqueue/, > - mount options=(rw, move) /dev/pts/ -> > /{var/,}run/libvirt/qemu/*.pts/, > - mount options=(rw, move) /dev/shm/ -> > /{var/,}run/libvirt/qemu/*.shm/, > - > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> > /dev/, > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.hugepages/ -> > /dev/hugepages/, > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.mqueue/ -> > /dev/mqueue/, > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.pts/ -> > /dev/pts/, > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.shm/ -> > /dev/shm/, > + # libvirt provides any mounts under /dev to qemu namespaces > + mount options=(rw, move) /dev/ -> /{var/,}run/libvirt/qemu/*.dev/, > + mount options=(rw, move) /dev/**{/,} -> > /{var/,}run/libvirt/qemu/*{/,}, What are you trying to convey with this rule? As written, the '{/,}' is redundant since '**' will match that.

> + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> /dev/, > + mount options=(rw, move) /{var/,}run/libvirt/qemu/*{/,} -> > /dev/**{/,}, ditto -- Jamie Strandboge | http://www.canonical.com