Re: [libvirt] [PATCH 06/12] apparmor, libvirt-qemu: Allow access to hugepage mounts
On Tue, 2017-12-19 at 16:03 +0100, Christian Ehrhardt wrote:
From: Serge Hallyn <serge.hallyn(a)ubuntu.com>
Allows owner access to hugepage mounts (both, the old and
new systemd variant).
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1250216
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1524737
Signed-off-by: Stefan Bader <stefan.bader(a)canonical.com>
---
examples/apparmor/libvirt-qemu | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/examples/apparmor/libvirt-qemu
b/examples/apparmor/libvirt-qemu
index 912b4ac..bb30530 100644
--- a/examples/apparmor/libvirt-qemu
+++ b/examples/apparmor/libvirt-qemu
@@ -184,6 +184,10 @@
/sys/bus/ r,
/sys/class/ r,
+ # for access to hugepages (LP: #1250216 and LP: #1524737)
+ owner "/run/hugepages/kvm/libvirt/qemu/**" rw,
+ owner "/dev/hugepages/libvirt/qemu/**" rw,
+
These rules are not vm-specific. I'm not familiar with the hugepages
feature in libvirt, but the rule suggests that libvirtd will create
files in these directories per-vm, and then the vm uses what libvirtd
created for it. I see virSecurityManagerSetHugepages() in
security_manager.c, is it possible that these rules can be removed and
vm-specific ones added dynamically with virt-aa-helper?
--
Jamie Strandboge | http://www.canonical.com
Attachments:
- signature.asc (application/pgp-signature — 801 bytes)