From: intrigeri <intrigeri+libv...@boum.org>
This set of rules was proposed by Christian Boltz <appar...@cboltz.de>
on https://bugzilla.opensuse.org/show_bug.cgi?id=1065123.
---
examples/apparmor/usr.sbin.libvirtd | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/examples/apparmor/usr.sbin.libvirtd
b/examples/apparmor/usr.sbin.libvirtd
index d2831aa491..8d61d154e1 100644
--- a/examples/apparmor/usr.sbin.libvirtd
+++ b/examples/apparmor/usr.sbin.libvirtd
@@ -30,7 +30,20 @@
# Needed for vfio
capability sys_resource,
- mount,
+ mount options=(rw,rslave) -> /,
+ mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/,
+
+ mount options=(rw, move) /dev/ -> /{var/,}run/libvirt/qemu/*.dev/,
+ mount options=(rw, move) /dev/hugepages/ ->
/{var/,}run/libvirt/qemu/*.hugepages/,
+ mount options=(rw, move) /dev/mqueue/ ->
/{var/,}run/libvirt/qemu/*.mqueue/,
+ mount options=(rw, move) /dev/pts/ -> /{var/,}run/libvirt/qemu/*.pts/,
+ mount options=(rw, move) /dev/shm/ -> /{var/,}run/libvirt/qemu/*.shm/,
+
+ mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> /dev/,
+ mount options=(rw, move) /{var/,}run/libvirt/qemu/*.hugepages/ ->
/dev/hugepages/,
+ mount options=(rw, move) /{var/,}run/libvirt/qemu/*.mqueue/ ->
/dev/mqueue/,
+ mount options=(rw, move) /{var/,}run/libvirt/qemu/*.pts/ -> /dev/pts/,
+ mount options=(rw, move) /{var/,}run/libvirt/qemu/*.shm/ -> /dev/shm/,
network inet stream,
network inet dgram,
--
2.15.0
--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list
