Re: [libvirt] [PATCH 4/4] apparmor: allow to preserve /dev mountpoints into qemu namespaces
On Mon, Aug 13, 2018 at 7:11 PM Jamie Strandboge wrote: > On Mon, 2018-08-13 at 16:39 +0200, Christian Ehrhardt wrote: > > Libvirt now tries to preserve all mounts under /dev in qemu > > namespaces. > > The old rules only listed a set of known paths but those are no more > > enough. > > > > I found some due to containers like /dev/.lxc/* and such but also > > /dev/console > > and /dev/net/tun. > > > > Libvirt is correct to do so, but we can no more predict the names > > properly, so > > we modify the rule to allow a wildcard based pattern matching what > > libvirt does. > > > > Signed-off-by: Christian Ehrhardt > > --- > > examples/apparmor/usr.sbin.libvirtd | 16 +--- > > 1 file changed, 5 insertions(+), 11 deletions(-) > > > > diff --git a/examples/apparmor/usr.sbin.libvirtd > > b/examples/apparmor/usr.sbin.libvirtd > > index 3ff43c32a2..b2e38fe0ad 100644 > > --- a/examples/apparmor/usr.sbin.libvirtd > > +++ b/examples/apparmor/usr.sbin.libvirtd > > @@ -33,17 +33,11 @@ > >mount options=(rw,rslave) -> /, > >mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/, > > > > - mount options=(rw, move) /dev/ -> > > /{var/,}run/libvirt/qemu/*.dev/, > > - mount options=(rw, move) /dev/hugepages/ -> > > /{var/,}run/libvirt/qemu/*.hugepages/, > > - mount options=(rw, move) /dev/mqueue/-> > > /{var/,}run/libvirt/qemu/*.mqueue/, > > - mount options=(rw, move) /dev/pts/ -> > > /{var/,}run/libvirt/qemu/*.pts/, > > - mount options=(rw, move) /dev/shm/ -> > > /{var/,}run/libvirt/qemu/*.shm/, > > - > > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> > > /dev/, > > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.hugepages/ -> > > /dev/hugepages/, > > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.mqueue/-> > > /dev/mqueue/, > > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.pts/ -> > > /dev/pts/, > > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.shm/ -> > > /dev/shm/, > > + # libvirt provides any mounts under /dev to qemu namespaces > > + mount options=(rw, move) /dev/ -> /{var/,}run/libvirt/qemu/*.dev/, > > + mount options=(rw, move) /dev/**{/,} -> > > /{var/,}run/libvirt/qemu/*{/,}, > > What are you trying to convey with this rule? As written, the '{/,}' is > redundant since '**' will match that. > I had issues on the other end, with different paths being accessed with/without trailing slash /{var/,}run/libvirt/qemu/*{/,}, So I added the trailing "with or without slash" part. You are right, on the other end due to the unpredictable path I already had ** which will cover the trailing slash. I can do a V2 without the trailing part on the side that has the "**" already > > + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> /dev/, > > + mount options=(rw, move) /{var/,}run/libvirt/qemu/*{/,} -> > > /dev/**{/,}, > > ditto > > -- > Jamie Strandboge | http://www.canonical.com -- Christian Ehrhardt Software Engineer, Ubuntu Server Canonical Ltd -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list
Re: [libvirt] [PATCH 4/4] apparmor: allow to preserve /dev mountpoints into qemu namespaces
On Mon, 2018-08-13 at 16:39 +0200, Christian Ehrhardt wrote: > Libvirt now tries to preserve all mounts under /dev in qemu > namespaces. > The old rules only listed a set of known paths but those are no more > enough. > > I found some due to containers like /dev/.lxc/* and such but also > /dev/console > and /dev/net/tun. > > Libvirt is correct to do so, but we can no more predict the names > properly, so > we modify the rule to allow a wildcard based pattern matching what > libvirt does. > > Signed-off-by: Christian Ehrhardt > --- > examples/apparmor/usr.sbin.libvirtd | 16 +--- > 1 file changed, 5 insertions(+), 11 deletions(-) > > diff --git a/examples/apparmor/usr.sbin.libvirtd > b/examples/apparmor/usr.sbin.libvirtd > index 3ff43c32a2..b2e38fe0ad 100644 > --- a/examples/apparmor/usr.sbin.libvirtd > +++ b/examples/apparmor/usr.sbin.libvirtd > @@ -33,17 +33,11 @@ >mount options=(rw,rslave) -> /, >mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/, > > - mount options=(rw, move) /dev/ -> > /{var/,}run/libvirt/qemu/*.dev/, > - mount options=(rw, move) /dev/hugepages/ -> > /{var/,}run/libvirt/qemu/*.hugepages/, > - mount options=(rw, move) /dev/mqueue/-> > /{var/,}run/libvirt/qemu/*.mqueue/, > - mount options=(rw, move) /dev/pts/ -> > /{var/,}run/libvirt/qemu/*.pts/, > - mount options=(rw, move) /dev/shm/ -> > /{var/,}run/libvirt/qemu/*.shm/, > - > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> > /dev/, > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.hugepages/ -> > /dev/hugepages/, > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.mqueue/-> > /dev/mqueue/, > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.pts/ -> > /dev/pts/, > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.shm/ -> > /dev/shm/, > + # libvirt provides any mounts under /dev to qemu namespaces > + mount options=(rw, move) /dev/ -> /{var/,}run/libvirt/qemu/*.dev/, > + mount options=(rw, move) /dev/**{/,} -> > /{var/,}run/libvirt/qemu/*{/,}, What are you trying to convey with this rule? As written, the '{/,}' is redundant since '**' will match that. > + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> /dev/, > + mount options=(rw, move) /{var/,}run/libvirt/qemu/*{/,} -> > /dev/**{/,}, ditto -- Jamie Strandboge | http://www.canonical.com signature.asc Description: This is a digitally signed message part -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list
[libvirt] [PATCH 4/4] apparmor: allow to preserve /dev mountpoints into qemu namespaces
Libvirt now tries to preserve all mounts under /dev in qemu namespaces. The old rules only listed a set of known paths but those are no more enough. I found some due to containers like /dev/.lxc/* and such but also /dev/console and /dev/net/tun. Libvirt is correct to do so, but we can no more predict the names properly, so we modify the rule to allow a wildcard based pattern matching what libvirt does. Signed-off-by: Christian Ehrhardt --- examples/apparmor/usr.sbin.libvirtd | 16 +--- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd index 3ff43c32a2..b2e38fe0ad 100644 --- a/examples/apparmor/usr.sbin.libvirtd +++ b/examples/apparmor/usr.sbin.libvirtd @@ -33,17 +33,11 @@ mount options=(rw,rslave) -> /, mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/, - mount options=(rw, move) /dev/ -> /{var/,}run/libvirt/qemu/*.dev/, - mount options=(rw, move) /dev/hugepages/ -> /{var/,}run/libvirt/qemu/*.hugepages/, - mount options=(rw, move) /dev/mqueue/-> /{var/,}run/libvirt/qemu/*.mqueue/, - mount options=(rw, move) /dev/pts/ -> /{var/,}run/libvirt/qemu/*.pts/, - mount options=(rw, move) /dev/shm/ -> /{var/,}run/libvirt/qemu/*.shm/, - - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> /dev/, - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.hugepages/ -> /dev/hugepages/, - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.mqueue/-> /dev/mqueue/, - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.pts/ -> /dev/pts/, - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.shm/ -> /dev/shm/, + # libvirt provides any mounts under /dev to qemu namespaces + mount options=(rw, move) /dev/ -> /{var/,}run/libvirt/qemu/*.dev/, + mount options=(rw, move) /dev/**{/,} -> /{var/,}run/libvirt/qemu/*{/,}, + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> /dev/, + mount options=(rw, move) /{var/,}run/libvirt/qemu/*{/,} -> /dev/**{/,}, network inet stream, network inet dgram, -- 2.17.1 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list