[libvirt] [PATCH/RFC] Add missing delta from Ubuntu to apparmor profiles

This had been on the Debian package list before but its time to take this onwards. So the goal would be to have one set to rule them all (when using apparmor) and drop the seperate set of definitions which exist at least in the Ubuntu packaging. Right now the patch would be at a state which adds all missing files and rules to the current examples in libvirt and installs them when using --with-apparmor-profiles. One problem seems to be that some of the definitions might cause parse failures on certain versions of apparmor. I checked this morning and this looks a bit hairy. So some apparmor 2.8 versions potentially have issues, but not all apparmor 2.8 are the same (gah). I could imagine (but John, we really could use some guidance here ;)) that at least some changes could be related to version 2.8.95~2430: + debian/patches/mediate-signals.patch, debian/patches/change-signal-syntax.patch: Parse signal rules with apparmor_parser. See the apparmor.d(5) man page for syntax details. + debian/patches/change-ptrace-syntax.patch, debian/patches/mediate-ptrace.patch: Parse ptrace rules with apparmor_parser. See the apparmor.d(5) man page for syntax details. But, regardless of the when, the apparmor rules maybe need a way to handle versioned features of the parser. One proposal was to comment out problematic rules and allow the packager to re-enable things. Maybe going one step further and have some pre-processing that handles version based sections (like #if (APPARMOR_VERSION >= xxx)). So that is where we stand. Ideas are very welcome. -Stefan --- From: Stefan Bader <stefan.bader(a)canonical.com&gt; Date: Thu, 18 Sep 2014 14:15:17 +0200 Subject: [PATCH] Add missing delta from Ubuntu to apparmor profiles This fixes up the upstream profiles and would allow to drop apparmor related delta from the Ubuntu package. Thanks to Serge Hallyn for the Makefile.am install hook that allows to rename the local file. Signed-off-by: Stefan Bader <stefan.bader(a)canonical.com&gt; --- examples/apparmor/Makefile.am | 10 ++++++++ examples/apparmor/libvirt-lxc | 15 +++++++++++- examples/apparmor/libvirt-qemu | 31 +++++++++++++++++++++++- examples/apparmor/local-usr.sbin.libvirtd | 2 ++ examples/apparmor/usr.lib.libvirt.virt-aa-helper | 25 ++++++++++++++++--- examples/apparmor/usr.sbin.libvirtd | 17 ++++++++++++- 6 files changed, 94 insertions(+), 6 deletions(-) create mode 100644 examples/apparmor/local-usr.sbin.libvirtd diff --git a/examples/apparmor/Makefile.am b/examples/apparmor/Makefile.am index 7a20e16..aa46cb9 100644 --- a/examples/apparmor/Makefile.am +++ b/examples/apparmor/Makefile.am @@ -20,6 +20,7 @@ EXTRA_DIST= \ libvirt-qemu \ libvirt-lxc \ usr.lib.libvirt.virt-aa-helper \ + local-usr.sbin.libvirtd \ usr.sbin.libvirtd if WITH_APPARMOR_PROFILES @@ -29,6 +30,15 @@ apparmor_DATA = \ usr.sbin.libvirtd \ $(NULL) +localdir = $(apparmordir)/local +local_DATA = \ + local-usr.sbin.libvirtd \ + $(NULL) + +install-data-hook: + mv $(DESTDIR)$(localdir)/local-usr.sbin.libvirtd \ + $(DESTDIR)$(localdir)/usr.sbin.libvirtd + abstractionsdir = $(apparmordir)/abstractions abstractions_DATA = \ libvirt-qemu \ diff --git a/examples/apparmor/libvirt-lxc b/examples/apparmor/libvirt-lxc index 4bfb503..4705e0a 100644 --- a/examples/apparmor/libvirt-lxc +++ b/examples/apparmor/libvirt-lxc @@ -1,12 +1,18 @@ -# Last Modified: Fri Feb 7 13:01:36 2014 +# Last Modified: Thu, 18 Sep 2014 13:56:49 +0200 #include <abstractions/base> umount, + dbus, + signal, + ptrace, # ignore DENIED message on / remount deny mount options=(ro, remount) -> /, + # support use of cgmanager proxy + mount options=(move) /sys/fs/cgroup/cgmanager/ -> /sys/fs/cgroup/cgmanager.lower/, + # allow tmpfs mounts everywhere mount fstype=tmpfs, @@ -33,8 +39,15 @@ mount fstype=fusectl -> /sys/fs/fuse/connections/, mount fstype=securityfs -> /sys/kernel/security/, mount fstype=debugfs -> /sys/kernel/debug/, + deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/, mount fstype=proc -> /proc/, mount fstype=sysfs -> /sys/, + + mount options=(rw nosuid nodev noexec remount) -> /sys/, + mount options=(rw remount) -> /sys/kernel/security/, + mount options=(rw remount) -> /sys/fs/pstore/, + mount options=(ro remount) -> /sys/fs/pstore/, + deny /sys/firmware/efi/efivars/** rwklx, deny /sys/kernel/security/** rwklx, diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu index c6de6dd..b69e64c 100644 --- a/examples/apparmor/libvirt-qemu +++ b/examples/apparmor/libvirt-qemu @@ -1,4 +1,4 @@ -# Last Modified: Wed Sep 3 21:52:03 2014 +# Last Modified: Thu, 18 Sep 2014 16:41:21 +0200 #include <abstractions/base> #include <abstractions/consoles> @@ -13,15 +13,22 @@ capability setgid, capability setuid, + # this is needed with libcap-ng support, however it breaks a lot of things + # atm, so just silence the denial until libcap-ng works right. LP: #522845 + deny capability setpcap, + network inet stream, network inet6 stream, /dev/net/tun rw, + /dev/tap* rw, /dev/kvm rw, /dev/ptmx rw, /dev/kqemu rw, @{PROC}/*/status r, @{PROC}/sys/kernel/cap_last_cap r, + owner @{PROC}/*/auxv r, + @{PROC}/sys/vm/overcommit_memory r, # For hostdev access. The actual devices will be added dynamically /sys/bus/usb/devices/ r, @@ -38,6 +45,9 @@ /dev/snd/* rw, capability ipc_lock, # spice + /usr/bin/qemu-system-i386-spice rmix, + /usr/bin/qemu-system-x86_64-spice rmix, + /{dev,run}/shm/ r, owner /{dev,run}/shm/spice.* rw, # 'kill' is not required for sound and is a security risk. Do not enable # unless you absolutely need it. @@ -73,6 +83,7 @@ # the various binaries /usr/bin/kvm rmix, /usr/bin/qemu rmix, + /usr/bin/qemu-system-aarch64 rmix, /usr/bin/qemu-system-arm rmix, /usr/bin/qemu-system-cris rmix, /usr/bin/qemu-system-i386 rmix, @@ -91,6 +102,7 @@ /usr/bin/qemu-system-sparc rmix, /usr/bin/qemu-system-sparc64 rmix, /usr/bin/qemu-system-x86_64 rmix, + /usr/bin/qemu-system-x86_64-spice rmix, /usr/bin/qemu-alpha rmix, /usr/bin/qemu-arm rmix, /usr/bin/qemu-armeb rmix, @@ -117,6 +129,16 @@ /bin/dash rmix, /bin/dd rmix, /bin/cat rmix, + /etc/pki/CA/ r, + /etc/pki/CA/* r, + /etc/pki/libvirt/ r, + /etc/pki/libvirt/** r, + + # for rbd + /etc/ceph/ceph.conf r, + + # for access to hugepages + owner "/run/hugepages/kvm/libvirt/qemu/**" rw, # for usb access /dev/bus/usb/ r, @@ -124,6 +146,13 @@ /sys/bus/ r, /sys/class/ r, + signal (receive) peer=/usr/sbin/libvirtd, + ptrace (tracedby) peer=/usr/sbin/libvirtd, + + # for ppc device-tree access + @{PROC}/device-tree/ r, + @{PROC}/device-tree/** r, + /usr/{lib,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper, # child profile for bridge helper process profile qemu_bridge_helper { diff --git a/examples/apparmor/local-usr.sbin.libvirtd b/examples/apparmor/local-usr.sbin.libvirtd new file mode 100644 index 0000000..6e19f20 --- /dev/null +++ b/examples/apparmor/local-usr.sbin.libvirtd @@ -0,0 +1,2 @@ +# Site-specific additions and overrides for usr.sbin.libvirtd. +# For more details, please see /etc/apparmor.d/local/README. diff --git a/examples/apparmor/usr.lib.libvirt.virt-aa-helper b/examples/apparmor/usr.lib.libvirt.virt-aa-helper index bceaaff..4df86b0 100644 --- a/examples/apparmor/usr.lib.libvirt.virt-aa-helper +++ b/examples/apparmor/usr.lib.libvirt.virt-aa-helper @@ -1,8 +1,9 @@ -# Last Modified: Mon Apr 5 15:10:27 2010 +# Last Modified: Thu, 18 Sep 2014 14:05:36 +0200 #include <tunables/global> /usr/lib/libvirt/virt-aa-helper { #include <abstractions/base> + #include <abstractions/user-tmp> # needed for searching directories capability dac_override, @@ -19,6 +20,12 @@ # for hostdev /sys/devices/ r, /sys/devices/** r, + /sys/bus/usb/devices/ r, + /sys/bus/usb/devices/** r, + deny /dev/sd* r, + deny /dev/dm-* r, + deny /dev/mapper/ r, + deny /dev/mapper/* r, /usr/lib/libvirt/virt-aa-helper mr, /sbin/apparmor_parser Ux, @@ -26,8 +33,11 @@ /etc/apparmor.d/libvirt/* r, /etc/apparmor.d/libvirt/libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw, - # for backingstore -- allow access to non-hidden files in @{HOME} as well - # as storage pools + # For backingstore, virt-aa-helper needs to peek inside the disk image, so + # allow access to non-hidden files in @{HOME} as well as storage pools, and + # removable media and filesystems, and certain file extentions. A + # virt-aa-helper failure when checking a disk for backinsgstore is non-fatal + # (but obviously the backingstore won't be added). audit deny @{HOME}/.* mrwkl, audit deny @{HOME}/.*/ rw, audit deny @{HOME}/.*/** mrwkl, @@ -35,8 +45,17 @@ audit deny @{HOME}/bin/** mrwkl, @{HOME}/ r, @{HOME}/** r, + @{HOME}/.Private/** mrwlk, + @{HOMEDIRS}/.ecryptfs/*/.Private/** mrwlk, + /var/lib/libvirt/images/ r, /var/lib/libvirt/images/** r, + /var/lib/nova/images/** r, + /var/lib/nova/instances/_base/** r, + /var/lib/nova/instances/snapshots/** r, + /var/lib/eucalyptus/instances/**/disk* r, + /var/lib/eucalyptus/instances/**/loader* r, + /var/lib/uvtool/libvirt/images/** r, /{media,mnt,opt,srv}/** r, /**.img r, diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd index 3011eff..814b4d81 100644 --- a/examples/apparmor/usr.sbin.libvirtd +++ b/examples/apparmor/usr.sbin.libvirtd @@ -1,10 +1,12 @@ -# Last Modified: Mon Apr 5 15:03:58 2010 +# Last Modified: Tue, 23 Sep 2014 09:28:07 +0200 #include <tunables/global> @{LIBVIRT}="libvirt" /usr/sbin/libvirtd { #include <abstractions/base> #include <abstractions/dbus> + # Site-specific additions and overrides. See local/README for details. + #include <local/usr.sbin.libvirtd> capability kill, capability net_admin, @@ -23,6 +25,7 @@ capability setpcap, capability mknod, capability fsetid, + capability ipc_lock, capability audit_write, # Needed for vfio @@ -33,6 +36,12 @@ network inet6 stream, network inet6 dgram, network packet dgram, + network netlink, + + dbus bus=system, + signal, + ptrace, + unix, # Very lenient profile for libvirtd since we want to first focus on confining # the guests. Guests will have a very restricted profile. @@ -45,6 +54,12 @@ /usr/sbin/* PUx, /lib/udev/scsi_id PUx, /usr/lib/xen-common/bin/xen-toolstack PUx, + /usr/lib/xen-*/bin/pygrub PUx, + /usr/lib/xen-*/bin/libxl-save-helper PUx, + + # Required by nwfilter_ebiptables_driver.c:ebiptablesWriteToTempFile() to + # write and run an ebtables script. + /var/lib/libvirt/virtd* ixr, # force the use of virt-aa-helper audit deny /sbin/apparmor_parser rwxl, -- 1.9.1