[libvirt] [PATCH 2/2] apparmor: Improve profiles
Tested on Debian unstable.
The profile updates are partly taken from the Ubuntu trusty libvirt package.
---
examples/apparmor/libvirt-qemu | 21 +++++++++++++++++----
examples/apparmor/usr.lib.libvirt.virt-aa-helper | 10 ++++++++++
examples/apparmor/usr.sbin.libvirtd | 16 ++++++++++++----
3 files changed, 39 insertions(+), 8 deletions(-)
diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu
index 766a334..e1980b7 100644
--- a/examples/apparmor/libvirt-qemu
+++ b/examples/apparmor/libvirt-qemu
@@ -9,6 +9,10 @@
capability dac_read_search,
capability chown,
+ # needed to drop privileges
+ capability setgid,
+ capability setuid,
+
network inet stream,
network inet6 stream,
@@ -20,7 +24,7 @@
# For hostdev access. The actual devices will be added dynamically
/sys/bus/usb/devices/ r,
- /sys/devices/*/*/usb[0-9]*/** r,
+ /sys/devices/**/usb[0-9]*/** r,
# WARNING: this gives the guest direct access to host hardware and specific
# portions of shared memory. This is required for sound using ALSA with kvm,
@@ -32,6 +36,8 @@
/{dev,run}/shmpulse-shm* rwk,
/dev/snd/* rw,
capability ipc_lock,
+ # spice
+ owner /{dev,run}/shm/spice.* rw,
# 'kill' is not required for sound and is a security risk. Do not enable
# unless you absolutely need it.
deny capability kill,
@@ -58,6 +64,7 @@
/usr/share/proll/** r,
/usr/share/vgabios/** r,
/usr/share/seabios/** r,
+ /usr/share/ovmf/** r,
# access PKI infrastructure
/etc/pki/libvirt-vnc/** r,
@@ -109,9 +116,15 @@
/bin/dd rmix,
/bin/cat rmix,
- /usr/libexec/qemu-bridge-helper Cx,
+ # for usb access
+ /dev/bus/usb/ r,
+ /etc/udev/udev.conf r,
+ /sys/bus/ r,
+ /sys/class/ r,
+
+ /usr/{lib,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
# child profile for bridge helper process
- profile /usr/libexec/qemu-bridge-helper {
+ profile qemu_bridge_helper {
#include <abstractions/base>
capability setuid,
@@ -125,5 +138,5 @@
/etc/qemu/** r,
owner @{PROC}/*/status r,
- /usr/libexec/qemu-bridge-helper rmix,
+ /usr/{lib,libexec}/qemu-bridge-helper rmix,
}
diff --git a/examples/apparmor/usr.lib.libvirt.virt-aa-helper
b/examples/apparmor/usr.lib.libvirt.virt-aa-helper
index 94bf359..bceaaff 100644
--- a/examples/apparmor/usr.lib.libvirt.virt-aa-helper
+++ b/examples/apparmor/usr.lib.libvirt.virt-aa-helper
@@ -12,6 +12,8 @@
network inet,
deny @{PROC}/[0-9]*/mounts r,
+ @{PROC}/[0-9]*/net/psched r,
+ owner @{PROC}/[0-9]*/status r,
@{PROC}/filesystems r,
# for hostdev
@@ -35,4 +37,12 @@
@{HOME}/** r,
/var/lib/libvirt/images/ r,
/var/lib/libvirt/images/** r,
+ /{media,mnt,opt,srv}/** r,
+
+ /**.img r,
+ /**.qcow{,2} r,
+ /**.qed r,
+ /**.vmdk r,
+ /**.[iI][sS][oO] r,
+ /**/disk{,.*} r,
}
diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd
index 1b24835..fd6def1 100644
--- a/examples/apparmor/usr.sbin.libvirtd
+++ b/examples/apparmor/usr.sbin.libvirtd
@@ -4,6 +4,7 @@
/usr/sbin/libvirtd {
#include <abstractions/base>
+ #include <abstractions/dbus>
capability kill,
capability net_admin,
@@ -22,20 +23,25 @@
capability setpcap,
capability mknod,
capability fsetid,
+ capability audit_write,
network inet stream,
network inet dgram,
network inet6 stream,
network inet6 dgram,
+ network packet dgram,
# Very lenient profile for libvirtd since we want to first focus on confining
# the guests. Guests will have a very restricted profile.
+ / r,
/** rwmkl,
- /bin/* Ux,
- /sbin/* Ux,
- /usr/bin/* Ux,
- /usr/sbin/* Ux,
+ /bin/* PUx,
+ /sbin/* PUx,
+ /usr/bin/* PUx,
+ /usr/sbin/* PUx,
+ /lib/udev/scsi_id PUx,
+ /usr/lib/xen-common/bin/xen-toolstack PUx,
# force the use of virt-aa-helper
audit deny /sbin/apparmor_parser rwxl,
@@ -45,6 +51,8 @@
audit deny /sys/kernel/security/apparmor/.* rwxl,
/sys/kernel/security/apparmor/profiles r,
/usr/lib/libvirt/* PUxr,
+ /etc/libvirt/hooks/** rmix,
+ /etc/xen/scripts/** rmix,
# allow changing to our UUID-based named profiles
change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
--
1.8.5.3