Re: [PATCH 5/8] apparmor: qemu access to @{PROC}/*/auxv for hw_cap

On Mon, 03 Aug 2020, Christian Ehrhardt wrote: > From: Stefan Bader <stefan.bader(a)canonical.com&gt; > > On some architectures (ppc, s390x, sparc, arm) qemu will read auxv > to detect hardware capabilities via qemu_getauxval. > > Allow that access read-only for the entry owned by the current > qemu process. > > Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com&gt; > Signed-off-by: Stefan Bader <stefan.bader(a)canonical.com&gt; > --- > src/security/apparmor/libvirt-qemu | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu > index b132cf0226..25eff20b82 100644 > --- a/src/security/apparmor/libvirt-qemu > +++ b/src/security/apparmor/libvirt-qemu > @@ -33,6 +33,7 @@ > owner @{PROC}/@{pid}/task/@{tid}/comm rw, > @{PROC}/sys/kernel/cap_last_cap r, > @{PROC}/sys/vm/overcommit_memory r, > + owner @{PROC}/*/auxv r, +1 to apply. A code comment that is simply the first sentence of Stefan's commit message might be a nice touch, but that is not a blocker.

-- Jamie Strandboge | http://www.canonical.com