On Tue, 2017-12-19 at 14:13 +0100, Christian Ehrhardt wrote:

On live migration with --p2p like: $ virsh migrate --live --p2p kvmguest-bionic-normal \ qemu+ssh://10.6.221.80/system

We hit an apparmor deny like: apparmor="DENIED" operation="file_inherit" profile="/usr/sbin/libvirtd" pid=23477 comm="ssh" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send" addr=none peer_addr=none peer="unconfined"

The rule is not perfect, but can't be restricted further at the moment (new upstream kernel features needed). For now the lack of a profile on the peer as well as comm not being a conditional on rules do not allow to filter further.

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com> --- examples/apparmor/usr.sbin.libvirtd | 3 +++ 1 file changed, 3 insertions(+)

diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd index 8d61d15..febe8a4 100644 --- a/examples/apparmor/usr.sbin.libvirtd +++ b/examples/apparmor/usr.sbin.libvirtd @@ -53,6 +53,9 @@ network packet dgram, network packet raw,

+ # for --p2p migrations + unix (send, receive) type=stream addr=none peer=(label=unconfined addr=none), +

This rule is fine, but for completeness note that the upstream kernel doesn't support unix rules yet. apparmor_parsers that do will handle this rule fine though, so +1 to apply. -- Jamie Strandboge | http://www.canonical.com