Re: [PATCH 0/3] Apparmor: Add profiles for hypervisor daemons

Hello, [I'm not subscribed to the libvirt list, please CC me in replies] Am Mittwoch, 16. Juni 2021, 05:41:01 CEST schrieb Jim Fehlig: There are two ways to do this: - prefix the rules with "audit" (for example "audit capability sys_admin,"), reload and use the profile, and check your audit.log for AUDIT events mentioning it. (Note: the aa-* tools won't help you with AUDIT events.) - remove the rules in question and optionally set the profile to complain mode, then reload and use the profile. Afterwards, check the audit.log or use aa-logprof. Note: aa-logprof doesn't support adding unix, mount and pivot_root rules yet, so you'll have to add those manually. The dnsmasq profile already has # libvirt lease helper /usr/lib{,64}/libvirt/libvirt_leaseshelper Cx -> libvirt_leaseshelper, /usr/libexec/libvirt_leaseshelper Cx -> libvirt_leaseshelper, /usr/lib/libvirt_leaseshelper looks like yet another path. Did libvirt_leaseshelp move? (I still have it as /usr/lib64/libvirt/libvirt_leaseshelper on openSUSE Tumbleweed.) Technically, the dnsmasq profile will need two additions for the new path: - a Cx rule in the main profile - a m rule inside the libvirt_leaseshelper child profile This will be a change to the dnsmasq profile, but that's not a real problem. include <abstractions/openssl> I don't know what libnl is/does, but allowing read permissions to this file doesn't look too critical. BTW: The dnsmasq libvirt_leaseshelper child profile and abstractions/nameservice have /etc/libnl-3/classid r, Note the slightly different path, git blame says it's a Debian path added to the profile in 2016. (I don't remember any denial for /etc/libnl/classid on openSUSE, therefore I'm not sure if we should add that path to the upstream dnsmasq profile and/or abstractions/nameservice. Feedback welcome ;-) ) Also note that abstractions/nameservice allows a lot, so even if the path would match, please don't add it just because you need read permissions for a single file. Regards, Christian Boltz -- <cboltz> I wonder if I should add "sponsored by Aspirin" ;-) <jjohansen> you could have a nice little side business if Asprin was sponsoring all the bugs you find [from #apparmor]