On Wed, Feb 26, 2025 at 01:27:19PM +0100, Michal Privoznik wrote:
On some systems /run is mounted as:
tmpfs on /run type tmpfs (rw,nosuid,nodev,noexec,relatime,size=348508k,mode=755,inode64)
and /var/run is then just a symlink:
# ls -ld /var/run lrwxrwxrwx 1 root root 4 Apr 23 2024 /var/run -> /run
But because we still think it's 2004 and FHS 2.3 is active we have a rule in our meson.build which constructs RUNSTATEDIR as the following:
runstatedir = get_option('runstatedir') if runstatedir == '' runstatedir = localstatedir / 'run' endif
which (if unspecified on meson setup line) results in "/var/run".
This in turn means, when when we're generating an AppArmor profile for a domain with allowed paths it contains stuff like:
/var/run/libvirt/qemu/swtpm/2-guest-swtpm.sock
But because of the aforementioned symlink the real path is:
/run/libvirt/qemu/swtpm/2-guest-swtpm.sock
and thus AppArmor denies access:
audit: type=1400 audit(1740480419.348:415): apparmor="DENIED" operation="connect" class="file" profile="libvirt-126f2720-6f8e-45ab-a886-ec9277079a67" name="/run/libvirt/qemu/swtpm/2-guest-swtpm.sock" pid=8080 comm="qemu-system-x86" requested_mask="wr" denied_mask="wr" fsuid=64055 ouid=64055
Fortunately, there's a nice trick: AppArmor profile variables. We already use some of them (@{PROC}, @{HOME}, @{multiarch}) and instead of RUNSTATEDIR we can use @{run} which is declared as:
# cat /etc/apparmor.d/tunables/run @{run}=/run/ /var/run/
But that will break if @{run} is not the same as the value someone gives to -Drundir, where -Drundir is a real path. It feels like the real problem here is that the paths decided in meson are wrong for the system in question. With -Dsystem we should just pick '/run' by default. Without -Dsystem, distros/users should be responsible for setting -Drundir to the right (non-symlink) path. With regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|