Re: [PATCH] apparmor: avoid denials on libpmem initialization
On Wed, 08 Apr 2020, Jamie Strandboge wrote:
On Wed, 08 Apr 2020, Christian Ehrhardt wrote:
> With libpmem support compiled into qemu it will trigger the following
> denials on every startup.
> apparmor="DENIED" operation="open" name="/"
> apparmor="DENIED" operation="open"
name="/sys/bus/nd/devices/"
>
> This is due to [1] that tries to auto-detect if the platform supports
> auto flush for all region.
>
> Once we know all the paths that are potentially needed if this feature
> is really used we can add them conditionally in virt-aa-helper and labelling
> calls in case </pmem> is enabled.
>
> But until then the change here silences the denial warnings seen above.
>
> [1]: https://github.com/pmem/pmdk/blob/master/src/libpmem2/auto_flush_linux.c#...
>
> Bug: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1871354
>
> + /sys/bus/nd/devices/* r,
Can you list what files libpem init is looking at? I'm a bit
uncomfortable with the glob here and would rather not guess that today's
and all future files in /sys/bus/nd/devices are safe for all qemu
processes to read.
Answering myself after looking at the pmdk source code, fs_new() is
calling fts_open() without FTS_NOCHDIR (and based on your '/' rule,
starting in '/'), then calls fs_read() which calls fts_read() on the
files it finds in /sys/bus/nd/devices (it makes sure to only look at
symlinks, but that doesn't impact our rules). Writing some test code to
simulate this and testing on /sys/bus/usb/devices (since I have usb
devices here, but not nd and this dir is populated with symlinks as the
libpmem code expects), I think the full rules you want are:
# required by libpmem init to fts_open()/fts_read() the symlinks in
# /sys/bus/nd/devices
/ r,
/sys/bus/nd/devices/{,**/} r,
Ideally this access would only be needed if using NFIT-ND devices, but
as you mentioned, that is not possible at the point of the denial. I
think these rules are fine to apply to the default VM policy since they
are only a collection of directory reads (note the trailing '/'s in the
second rule), which should have no impact guest isolation or host
protections.
--
Jamie Strandboge | http://www.canonical.com