From f552e68d9f0288037d2372e863837749cedd1c27 Mon Sep 17 00:00:00 2001 From: Jim Fehlig Date: Wed, 16 Jun 2021 15:11:14 -0600 Subject: [PATCH] Apparmor: Allow reading libnl's classid file I noticed the following denial messages from apparmor in audit.log when starting confined VMs via the QEMU driver type=AVC msg=audit(1623864006.370:837): apparmor="DENIED" operation="open" \ profile="virt-aa-helper" name="/etc/libnl/classid" pid=11265 \ comm="virt-aa-helper" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 type=AVC msg=audit(1623864006.582:849): apparmor="DENIED" operation="open" \ profile="libvirt-0ca2720d-6cff-48bb-86c2-61ab9a79b6e9" \ name="/etc/libnl/classid" pid=11270 comm="qemu-system-x86" \ requested_mask="r" denied_mask="r" fsuid=107 ouid=0 It is possible for site admins to assign names to classids in this file, which are then used by all libnl tools, possibly those used by libvirt. To be on the safe side, allow read access to the file in the virt-aa-helper profile and the libvirt-qemu abstraction. Signed-off-by: Jim Fehlig Reviewed-by: Christian Ehrhardt --- src/security/apparmor/libvirt-qemu | 2 ++ src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu index 85c9e61d6c..6275b6e95b 100644 --- a/src/security/apparmor/libvirt-qemu +++ b/src/security/apparmor/libvirt-qemu @@ -35,6 +35,8 @@ @{PROC}/sys/vm/overcommit_memory r, # detect hardware capabilities via qemu_getauxval owner @{PROC}/*/auxv r, + # allow reading libnl's classid file + /etc/libnl{,-3}/classid r, # For hostdev access. The actual devices will be added dynamically /sys/bus/usb/devices/ r, diff --git a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in index dd18c8ab89..8ebb47596a 100644 --- a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in +++ b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in @@ -19,7 +19,8 @@ profile virt-aa-helper @libexecdir@/virt-aa-helper { # Used when internally running another command (namely apparmor_parser) @{PROC}/@{pid}/fd/ r, - @sysconfdir@/libnl-3/classid r, + # allow reading libnl's classid file + @sysconfdir@/libnl{,-3}/classid r, # for gl enabled graphics /dev/dri/{,*} r, -- 2.47.2