From: intrigeri Date: Sun, 19 Nov 2017 14:57:34 +0000 (+0000) Subject: AppArmor: add mount rules needed with additional mediation features brought by Linux... X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=3343ab0cd99c04761c17a36d9af354536df9e741;p=libvirt.git AppArmor: add mount rules needed with additional mediation features brought by Linux 4.14 This set of rules was proposed by Christian Boltz on https://bugzilla.opensuse.org/show_bug.cgi?id=1065123. --- diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd index 12b9d45bf0..8d61d154e1 100644 --- a/examples/apparmor/usr.sbin.libvirtd +++ b/examples/apparmor/usr.sbin.libvirtd @@ -30,6 +30,21 @@ # Needed for vfio capability sys_resource, + mount options=(rw,rslave) -> /, + mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/, + + mount options=(rw, move) /dev/ -> /{var/,}run/libvirt/qemu/*.dev/, + mount options=(rw, move) /dev/hugepages/ -> /{var/,}run/libvirt/qemu/*.hugepages/, + mount options=(rw, move) /dev/mqueue/ -> /{var/,}run/libvirt/qemu/*.mqueue/, + mount options=(rw, move) /dev/pts/ -> /{var/,}run/libvirt/qemu/*.pts/, + mount options=(rw, move) /dev/shm/ -> /{var/,}run/libvirt/qemu/*.shm/, + + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> /dev/, + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.hugepages/ -> /dev/hugepages/, + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.mqueue/ -> /dev/mqueue/, + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.pts/ -> /dev/pts/, + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.shm/ -> /dev/shm/, + network inet stream, network inet dgram, network inet6 stream,