For quote generation and remote attestation, Intel TDX VM communicates with the QGSD (Quote Generation Service) on the host via unix socket. The unix socket can be specified via: <launchSecurity type='tdx'> ... <quoteGenerationService path='/var/run/tdx-qgs/qgs.socket'/> </launchSecurity> in case the path field is omitted, a default path is used. This commit generates the needed rule in the dynamic AA profile for the VM. Signed-off-by: Hector Cao <hector.cao@canonical.com> --- src/security/virt-aa-helper.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index e932e79dab..c3c333e761 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1395,8 +1395,21 @@ get_files(vahControl * ctl) case VIR_DOMAIN_LAUNCH_SECURITY_SEV_SNP: virBufferAddLit(&buf, " \"/dev/sev\" rw,\n"); break; - case VIR_DOMAIN_LAUNCH_SECURITY_PV: case VIR_DOMAIN_LAUNCH_SECURITY_TDX: + /* To communicate with the QGSD daemon running on the host, if we use the unix socket, + * allow the VM to access to the unix socket. + */ + if (ctl->def->sec->data.tdx.haveQGS) { + const char *qgsd_sock_file = QGS_UNIX_SOCKET_FILE; + if (ctl->def->sec->data.tdx.qgs_unix_path) { + qgsd_sock_file = ctl->def->sec->data.tdx.qgs_unix_path; + } + if (vah_add_file(&buf, qgsd_sock_file, "rw") != 0) { + return -1; + } + } + break; + case VIR_DOMAIN_LAUNCH_SECURITY_PV: case VIR_DOMAIN_LAUNCH_SECURITY_NONE: case VIR_DOMAIN_LAUNCH_SECURITY_LAST: break; -- 2.43.0