[libvirt] [PATCH 06/12] apparmor, libvirt-qemu: Allow access to hugepage mounts

[Jamie Strandboge]

On Tue, 2017-12-19 at 16:03 +0100, Christian Ehrhardt wrote:
> From: Serge Hallyn <serge.hallyn at ubuntu.com>
> 
> Allows owner access to hugepage mounts (both, the old and
> new systemd variant).
> 
> Bug-Ubuntu: https://bugs.launchpad.net/bugs/1250216
> Bug-Ubuntu: https://bugs.launchpad.net/bugs/1524737
> 
> Signed-off-by: Stefan Bader <stefan.bader at canonical.com>
> ---
>  examples/apparmor/libvirt-qemu | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/examples/apparmor/libvirt-qemu
> b/examples/apparmor/libvirt-qemu
> index 912b4ac..bb30530 100644
> --- a/examples/apparmor/libvirt-qemu
> +++ b/examples/apparmor/libvirt-qemu
> @@ -184,6 +184,10 @@
>    /sys/bus/ r,
>    /sys/class/ r,
>  
> +  # for access to hugepages (LP: #1250216 and LP: #1524737)
> +  owner "/run/hugepages/kvm/libvirt/qemu/**" rw,
> +  owner "/dev/hugepages/libvirt/qemu/**" rw,
> +

These rules are not vm-specific. I'm not familiar with the hugepages
feature in libvirt, but the rule suggests that libvirtd will create
files in these directories per-vm, and then the vm uses what libvirtd
created for it. I see virSecurityManagerSetHugepages() in
security_manager.c, is it possible that these rules can be removed and
vm-specific ones added dynamically with virt-aa-helper?

-- 
Jamie Strandboge             | http://www.canonical.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20171219/905da8be/attachment-0001.sig>