Ok, with acks of last year and new ones in and no other feedback nor any Freeze atm I'm pushing these changes any minute. The qemu-smb related one will be dropped, the others pushed with the latest cleanups as discussed in the per-patch threads. Thanks everybody for your participation! On Tue, Aug 14, 2018 at 8:18 AM Christian Ehrhardt < christian.ehrhardt@canonical.com> wrote:
Hi, this is a summary of things I had to touch recently for libvirt 4.6. The first two patches are re-submissions and modifications of last year which were never totally challenged, but also not pushed.
The first was lost in a discussion about virt-aa-helper, whicih eventually turned out to be clear that it could not help in that case. - https://www.redhat.com/archives/libvir-list/2017-February/msg01598.html - https://www.redhat.com/archives/libvir-list/2017-March/msg00052.html
The second even got a few Acks, but neither made it into upstream yet. Parts of it where introduced already, in 7edcbd02 apparmor: allow libvirt to send term signal to unconfined b482925c apparmor: support ptrace checks But there are still signals blocked with those rules, so I resubmit the remaining bit. Also I added the Acks to the resubmission.
The third&fourth change came in recently via various bug reports which I finally wanted to adress - e.g. for ceph lib or smb. If we later on spot more cases that have predictable safe paths under /tmp we can add those.
Finally the fifth change was triggered by me testing libvirt 4.6 in various conditions. Some of them were in containers, and the new libvirt behavior to carry more mount points into the qemu namespace triggers the need to rewrite the existing mount-moving rules that we added last year.
*Updates in V2* - added Acks to path #1 - split former patch #3 into #3/#4 to discuss /tmp access and qemu-smd individually - rewrote reasoning and concerns as well as TODOs to improve later in regard to the /tmp related commits #3/#4 - Updated the rule since the trailing {,/} is not needed after **
Christian Ehrhardt (5): apparmor: allow openGraphicsFD for virt manager >1.4 apparmor: add mediation rules for unconfined guests apparmor: allow expected /tmp access patterns apparmor: allow qemu-smb access in /tmp apparmor: allow to preserve /dev mountpoints into qemu namespaces
examples/apparmor/libvirt-qemu | 20 ++++++++++++++++++++ examples/apparmor/usr.sbin.libvirtd | 24 +++++++++++++----------- 2 files changed, 33 insertions(+), 11 deletions(-)
-- 2.17.1
-- Christian Ehrhardt Software Engineer, Ubuntu Server Canonical Ltd