From: Michal Privoznik Date: Tue, 20 Aug 2024 10:00:16 +0000 (+0200) Subject: security: apparmor: Allow QEMU read /proc/sys/vm/max_map_count X-Git-Tag: v10.7.0-rc1~21 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=85e07fb1ceee7943879f8a374cabfa8ab858a3c6;p=thirdparty%2Flibvirt.git security: apparmor: Allow QEMU read /proc/sys/vm/max_map_count In its commit v9.0.0-rc0~1^2 QEMU started to read /proc/sys/vm/max_map_count file to set up coroutine limits better (something about VMAs, mmap(), see the commit for more info). Allow the file in apparmor profile. Resolves: https://gitlab.com/libvirt/libvirt/-/issues/660 Signed-off-by: Michal Privoznik Reviewed-by: Peter Krempa --- diff --git a/src/security/apparmor/libvirt-qemu.in b/src/security/apparmor/libvirt-qemu.in index 8b92915281..8f17256554 100644 --- a/src/security/apparmor/libvirt-qemu.in +++ b/src/security/apparmor/libvirt-qemu.in @@ -34,6 +34,7 @@ # only modify its comm value or those in its thread group. owner @{PROC}/@{pid}/task/@{tid}/comm rw, @{PROC}/sys/kernel/cap_last_cap r, + @{PROC}/sys/vm/max_map_count r, @{PROC}/sys/vm/overcommit_memory r, # detect hardware capabilities via qemu_getauxval owner @{PROC}/*/auxv r,