mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-18 00:48:10 +01:00
Move libvirtd profiles.
This commit is contained in:
Alexandre Pujol
parent
b79ffa52c6
commit
adabcd6b94
8 changed files with 40 additions and 244 deletions
|
|
@ -13,7 +13,7 @@ profile libvirt-dbus @{exec_path} {
|
|||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}{s,}bin/libvirtd rPUx,
|
||||
/{usr/,}{s,}bin/libvirtd rPx,
|
||||
|
||||
/usr/share/dbus-1/interfaces/org.libvirt.*.xml r,
|
||||
|
||||
|
|
|
|||
21
apparmor.d/groups/virt/libvirt/TEMPLATE.lxc
Normal file
21
apparmor.d/groups/virt/libvirt/TEMPLATE.lxc
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) Libvirt Team
|
||||
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
# This profile is for the container whose UUID matches this file.
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
profile LIBVIRT_TEMPLATE flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/libvirt-lxc>
|
||||
|
||||
# Globally allows everything to run under this profile
|
||||
# These can be narrowed depending on the container's use.
|
||||
file,
|
||||
capability,
|
||||
network,
|
||||
}
|
||||
17
apparmor.d/groups/virt/libvirt/TEMPLATE.qemu
Normal file
17
apparmor.d/groups/virt/libvirt/TEMPLATE.qemu
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) Libvirt Team
|
||||
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
# This profile is for the VM whose UUID matches this file.
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
profile LIBVIRT_TEMPLATE flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/libvirt-qemu>
|
||||
}
|
||||
|
|
@ -7,7 +7,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}{,s}bin/libvirtd
|
||||
@{exec_path} = /{usr/,}sbin/libvirtd /{usr/,}bin/libvirtd
|
||||
profile libvirtd @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus>
|
||||
|
|
|
|||
|
|
@ -1,15 +0,0 @@
|
|||
#
|
||||
# This profile is for the domain whose UUID matches this file.
|
||||
#
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
profile LIBVIRT_TEMPLATE flags=(attach_disconnected) {
|
||||
include <abstractions/libvirt-lxc>
|
||||
|
||||
# Globally allows everything to run under this profile
|
||||
# These can be narrowed depending on the container's use.
|
||||
file,
|
||||
capability,
|
||||
network,
|
||||
}
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
#
|
||||
# This profile is for the domain whose UUID matches this file.
|
||||
#
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
profile LIBVIRT_TEMPLATE flags=(attach_disconnected) {
|
||||
include <abstractions/libvirt-qemu>
|
||||
}
|
||||
|
|
@ -1,75 +0,0 @@
|
|||
#include <tunables/global>
|
||||
|
||||
profile virt-aa-helper /usr/lib/libvirt/virt-aa-helper {
|
||||
#include <abstractions/base>
|
||||
#include <abstractions/openssl>
|
||||
|
||||
# needed for searching directories
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
|
||||
# needed for when disk is on a network filesystem
|
||||
network inet,
|
||||
network inet6,
|
||||
|
||||
deny @{PROC}/[0-9]*/mounts r,
|
||||
@{PROC}/[0-9]*/net/psched r,
|
||||
owner @{PROC}/[0-9]*/status r,
|
||||
@{PROC}/filesystems r,
|
||||
|
||||
# Used when internally running another command (namely apparmor_parser)
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
|
||||
# allow reading libnl's classid file
|
||||
/etc/libnl{,-3}/classid r,
|
||||
|
||||
# for gl enabled graphics
|
||||
/dev/dri/{,*} r,
|
||||
|
||||
# for hostdev
|
||||
/sys/devices/ r,
|
||||
/sys/devices/** r,
|
||||
/sys/bus/usb/devices/ r,
|
||||
deny /dev/sd* r,
|
||||
deny /dev/vd* r,
|
||||
deny /dev/dm-* r,
|
||||
deny /dev/drbd[0-9]* r,
|
||||
deny /dev/dasd* r,
|
||||
deny /dev/nvme* r,
|
||||
deny /dev/zd[0-9]* r,
|
||||
deny /dev/mapper/ r,
|
||||
deny /dev/mapper/* r,
|
||||
|
||||
/usr/lib/libvirt/virt-aa-helper mr,
|
||||
/{usr/,}{s,}bin/apparmor_parser Ux,
|
||||
|
||||
/etc/apparmor.d/libvirt/* r,
|
||||
/etc/apparmor.d/libvirt/libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw,
|
||||
|
||||
# for backingstore -- allow access to non-hidden files in @{HOME} as well
|
||||
# as storage pools
|
||||
audit deny @{HOME}/.* mrwkl,
|
||||
audit deny @{HOME}/.*/ rw,
|
||||
audit deny @{HOME}/.*/** mrwkl,
|
||||
audit deny @{HOME}/bin/ rw,
|
||||
audit deny @{HOME}/bin/** mrwkl,
|
||||
@{HOME}/ r,
|
||||
@{HOME}/** r,
|
||||
/var/lib/libvirt/images/ r,
|
||||
/var/lib/libvirt/images/** r,
|
||||
/var/lib/nova/instances/_base/* r,
|
||||
/{media,mnt,opt,srv}/** r,
|
||||
# For virt-sandbox
|
||||
/{,var/}run/libvirt/**/[sv]d[a-z] r,
|
||||
|
||||
/**.img r,
|
||||
/**.raw r,
|
||||
/**.qcow{,2} r,
|
||||
/**.qed r,
|
||||
/**.vmdk r,
|
||||
/**.vhd r,
|
||||
/**.[iI][sS][oO] r,
|
||||
/**/disk{,.*} r,
|
||||
|
||||
include if exists <local/usr.lib.libvirt.virt-aa-helper>
|
||||
}
|
||||
|
|
@ -1,143 +0,0 @@
|
|||
#include <tunables/global>
|
||||
@{LIBVIRT}="libvirt"
|
||||
|
||||
profile libvirtd /usr/sbin/libvirtd flags=(attach_disconnected) {
|
||||
#include <abstractions/base>
|
||||
#include <abstractions/dbus>
|
||||
|
||||
capability kill,
|
||||
capability net_admin,
|
||||
capability net_raw,
|
||||
capability setgid,
|
||||
capability sys_admin,
|
||||
capability sys_module,
|
||||
capability sys_ptrace,
|
||||
capability sys_pacct,
|
||||
capability sys_nice,
|
||||
capability sys_chroot,
|
||||
capability setuid,
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability fowner,
|
||||
capability chown,
|
||||
capability setpcap,
|
||||
capability mknod,
|
||||
capability fsetid,
|
||||
capability audit_write,
|
||||
capability ipc_lock,
|
||||
capability sys_rawio,
|
||||
capability bpf,
|
||||
capability perfmon,
|
||||
|
||||
# Needed for vfio
|
||||
capability sys_resource,
|
||||
|
||||
mount options=(rw,rslave) -> /,
|
||||
mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/,
|
||||
umount /{var/,}run/libvirt/qemu/*.dev/,
|
||||
|
||||
# libvirt provides any mounts under /dev to qemu namespaces
|
||||
mount options=(rw, move) /dev/ -> /{,var/}run/libvirt/qemu/*.dev/,
|
||||
mount options=(rw, move) /dev/** -> /{,var/}run/libvirt/qemu/*{,/},
|
||||
mount options=(rw, move) /{,var/}run/libvirt/qemu/*.dev/ -> /dev/,
|
||||
mount options=(rw, move) /{,var/}run/libvirt/qemu/*{,/} -> /dev/**,
|
||||
|
||||
network inet stream,
|
||||
network inet dgram,
|
||||
network inet6 stream,
|
||||
network inet6 dgram,
|
||||
network netlink raw,
|
||||
network packet dgram,
|
||||
network packet raw,
|
||||
|
||||
# for --p2p migrations
|
||||
unix (send, receive) type=stream addr=none peer=(label=unconfined addr=none),
|
||||
|
||||
ptrace (read,trace) peer=unconfined,
|
||||
ptrace (read,trace) peer=@{profile_name},
|
||||
ptrace (read,trace) peer=dnsmasq,
|
||||
ptrace (read,trace) peer=/usr/sbin/dnsmasq,
|
||||
ptrace (read,trace) peer=libvirt-*,
|
||||
ptrace (read,trace) peer=virt-manager,
|
||||
|
||||
signal (send) peer=dnsmasq,
|
||||
signal (send) peer=/usr/sbin/dnsmasq,
|
||||
signal (read, send) peer=libvirt-*,
|
||||
signal (send) set=("kill", "term") peer=unconfined,
|
||||
|
||||
# For communication/control to qemu-bridge-helper
|
||||
unix (send, receive) type=stream addr=none peer=(label=libvirtd//qemu_bridge_helper),
|
||||
signal (send) set=("term") peer=libvirtd//qemu_bridge_helper,
|
||||
|
||||
# allow connect with openGraphicsFD, direction reversed in newer versions
|
||||
unix (send, receive) type=stream addr=none peer=(label=libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*),
|
||||
# unconfined also required if guests run without security module
|
||||
unix (send, receive) type=stream addr=none peer=(label=unconfined),
|
||||
|
||||
# required if guests run unconfined seclabel type='none' but libvirtd is confined
|
||||
signal (read, send) peer=unconfined,
|
||||
|
||||
# Very lenient profile for libvirtd since we want to first focus on confining
|
||||
# the guests. Guests will have a very restricted profile.
|
||||
/ r,
|
||||
/** rwmkl,
|
||||
|
||||
/bin/* PUx,
|
||||
/sbin/* PUx,
|
||||
/usr/bin/* PUx,
|
||||
/usr/sbin/virtlogd pix,
|
||||
/usr/sbin/* PUx,
|
||||
/{usr/,}lib/udev/scsi_id PUx,
|
||||
/usr/{lib,lib64}/xen-common/bin/xen-toolstack PUx,
|
||||
/usr/{lib,lib64,libexec}/xen/bin/* Ux,
|
||||
/usr/{lib,libexec}/xen-*/bin/libxl-save-helper PUx,
|
||||
/usr/{lib,libexec}/xen-*/bin/pygrub PUx,
|
||||
/usr/{lib,lib64,lib/qemu,libexec}/vhost-user-gpu PUx,
|
||||
/usr/{lib,lib64,lib/qemu,libexec}/virtiofsd PUx,
|
||||
|
||||
# Required by nwfilter_ebiptables_driver.c:ebiptablesWriteToTempFile() to
|
||||
# read and run an ebtables script.
|
||||
/var/lib/libvirt/virtd* ixr,
|
||||
|
||||
# force the use of virt-aa-helper
|
||||
audit deny /{usr/,}{s,}bin/apparmor_parser rwxl,
|
||||
audit deny /etc/apparmor.d/libvirt/** wxl,
|
||||
audit deny /sys/kernel/security/apparmor/features rwxl,
|
||||
audit deny /sys/kernel/security/apparmor/matching rwxl,
|
||||
audit deny /sys/kernel/security/apparmor/.* rwxl,
|
||||
/sys/kernel/security/apparmor/profiles r,
|
||||
/usr/lib/libvirt/* PUxr,
|
||||
/usr/lib/libvirt/libvirt_parthelper ix,
|
||||
/usr/lib/libvirt/libvirt_iohelper ix,
|
||||
/etc/libvirt/hooks/** rmix,
|
||||
/etc/xen/scripts/** rmix,
|
||||
|
||||
# allow changing to our UUID-based named profiles
|
||||
change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
|
||||
|
||||
/usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
|
||||
# child profile for bridge helper process
|
||||
profile qemu_bridge_helper {
|
||||
#include <abstractions/base>
|
||||
|
||||
capability setuid,
|
||||
capability setgid,
|
||||
capability setpcap,
|
||||
capability net_admin,
|
||||
|
||||
network inet stream,
|
||||
|
||||
# For communication/control from libvirtd
|
||||
unix (send, receive) type=stream addr=none peer=(label=libvirtd),
|
||||
signal (receive) set=("term") peer=/usr/sbin/libvirtd,
|
||||
signal (receive) set=("term") peer=libvirtd,
|
||||
|
||||
/dev/net/tun rw,
|
||||
/etc/qemu/** r,
|
||||
owner @{PROC}/*/status r,
|
||||
|
||||
/usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper rmix,
|
||||
}
|
||||
|
||||
include if exists <local/usr.sbin.libvirtd>
|
||||
}
|
||||
Loading…
Reference in a new issue