On Tue, 2017-12-19 at 16:03 +0100, Christian Ehrhardt wrote:
From: Serge Hallyn <serge.hallyn@ubuntu.com>
Allows owner access to hugepage mounts (both, the old and new systemd variant).
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1250216 Bug-Ubuntu: https://bugs.launchpad.net/bugs/1524737
Signed-off-by: Stefan Bader <stefan.bader@canonical.com> --- examples/apparmor/libvirt-qemu | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu index 912b4ac..bb30530 100644 --- a/examples/apparmor/libvirt-qemu +++ b/examples/apparmor/libvirt-qemu @@ -184,6 +184,10 @@ /sys/bus/ r, /sys/class/ r,
+ # for access to hugepages (LP: #1250216 and LP: #1524737) + owner "/run/hugepages/kvm/libvirt/qemu/**" rw, + owner "/dev/hugepages/libvirt/qemu/**" rw, +
These rules are not vm-specific. I'm not familiar with the hugepages feature in libvirt, but the rule suggests that libvirtd will create files in these directories per-vm, and then the vm uses what libvirtd created for it. I see virSecurityManagerSetHugepages() in security_manager.c, is it possible that these rules can be removed and vm-specific ones added dynamically with virt-aa-helper? -- Jamie Strandboge | http://www.canonical.com