[libvirt] [PATCH] apparmor: allow unix stream for p2p migrations
Michal Privoznik
mprivozn at redhat.com
Wed Jan 3 08:48:31 UTC 2018
On 12/19/2017 02:13 PM, Christian Ehrhardt wrote:
> On live migration with --p2p like:
> $ virsh migrate --live --p2p kvmguest-bionic-normal \
> qemu+ssh://10.6.221.80/system
>
> We hit an apparmor deny like:
> apparmor="DENIED" operation="file_inherit"
> profile="/usr/sbin/libvirtd" pid=23477 comm="ssh" family="unix"
> sock_type="stream" protocol=0 requested_mask="send receive"
> denied_mask="send" addr=none peer_addr=none peer="unconfined"
>
> The rule is not perfect, but can't be restricted further at the moment
> (new upstream kernel features needed). For now the lack of a profile on the
> peer as well as comm not being a conditional on rules do not allow to filter
> further.
>
> Signed-off-by: Christian Ehrhardt <christian.ehrhardt at canonical.com>
> ---
> examples/apparmor/usr.sbin.libvirtd | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd
> index 8d61d15..febe8a4 100644
> --- a/examples/apparmor/usr.sbin.libvirtd
> +++ b/examples/apparmor/usr.sbin.libvirtd
> @@ -53,6 +53,9 @@
> network packet dgram,
> network packet raw,
>
> + # for --p2p migrations
> + unix (send, receive) type=stream addr=none peer=(label=unconfined addr=none),
> +
> ptrace (trace) peer=unconfined,
> ptrace (trace) peer=/usr/sbin/libvirtd,
> ptrace (trace) peer=/usr/sbin/dnsmasq,
>
ACKed and pushed.
Michal
More information about the libvir-list
mailing list