From: Sergio Durigan Junior Date: Thu, 11 Jan 2024 21:17:41 +0000 (-0500) Subject: apparmor: Allow access to /sys/devices/system/node/*/cpumap for libnuma X-Git-Tag: v10.0.0-rc2~5 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6fa82fd8e23bed12ca67b86e6d093c0031881887;p=thirdparty%2Flibvirt.git apparmor: Allow access to /sys/devices/system/node/*/cpumap for libnuma A QEMU change (10218ae6d006f76410804cc4dc690085b3d008b5) introduced some libnuma calls that require read access to /sys/devices/system/node/*/cpumap, which currently is forbidden by the standard apparmor profile. This commit allows read-only access to the file specified above. Closes: https://gitlab.com/libvirt/libvirt/-/issues/515 Signed-off-by: Sergio Durigan Junior Reviewed-by: Jim Fehlig --- diff --git a/src/security/apparmor/libvirt-qemu.in b/src/security/apparmor/libvirt-qemu.in index 53f45c3a28..f40f471891 100644 --- a/src/security/apparmor/libvirt-qemu.in +++ b/src/security/apparmor/libvirt-qemu.in @@ -252,6 +252,9 @@ /sys/devices/system/node/node[0-9]*/meminfo r, /sys/module/vhost/parameters/max_mem_regions r, + # Access to libnuma + /sys/devices/system/node/*/cpumap r, + # silence refusals to open lttng files (see LP: #1432644) deny /dev/shm/lttng-ust-wait-* r, deny /run/shm/lttng-ust-wait-* r,