Re: [libvirt] [PATCH] apparmor: support finer-grained ptrace checks

On Fri, 2017-09-22 at 14:52 +0200, Guido Günther wrote: > > + ptrace, > > ^^^^^^^ > > This single line is enough to make things work for me on 4.13. AFAIK > dbus mediation is not upstream yet and I think unix socket and signal > support is neither. Should we drop these for now (the syntax and > behaviour might change while things are being upsreamed)? Note that if you are upstreaming profile changes for ptrace, you may as well add them for signal and dbus because an apparmor parser that can understand 'ptrace' can understand the other two. The parser is designed to deal with kernels that don't have the full set of apparmor capabilities. The policy syntax for all of these rules should not change as part of upstreaming dbus and unix. 'unix' is probably ok to add because support for it was added to the parser in devel releases of AppArmor within 6 months of ptrace and signal. 'dbus', 'ptrace', 'signal' and 'unix' were officially introduced in 2.9[1]. By adding 'ptrace' you are saying AppArmor 2.9 is required, therefore, the other 3 are parseable.

diff --git a/examples/apparmor/libvirt-lxc b/examples/apparmor/libvirt-lxc index 4bfb503aa..0db137de0 100644 --- a/examples/apparmor/libvirt-lxc +++ b/examples/apparmor/libvirt-lxc @@ -3,6 +3,9 @@ #include <abstractions/base> umount, + dbus, + signal, + ptrace, # ignore DENIED message on / remount deny mount options=(ro, remount) -> /,

+ signal (receive) peer=/usr/sbin/libvirtd, + ptrace (tracedby) peer=/usr/sbin/libvirtd,