File suse-apparmor-signal.patch of Package libvirt

Overview Repositories Revisions Requests Users Attributes Meta

File suse-apparmor-signal.patch of Package libvirt (Revision e5b254e9a1626b9b6542a408dceb41e5)

Currently displaying revision e5b254e9a1626b9b6542a408dceb41e5 , Show latest

apparmor: allow libvirtd to send signals to unconfined processes

When confinement of QEMU/KVM domains is not enforced (security_default_confined = 0),
qemu processes run unconfined. Add a rule to the libvirtd apparmor profile allowing
sending signals to unconfined processes. Without the rule, libvirtd
is unable to signal QEMU/KVM domains. E.g. 'virsh destroy dom' results in the
following denial in audit.log

type=AVC msg=audit(1510951646.581:939): apparmor="DENIED" operation="signal"
profile="/usr/sbin/libvirtd" pid=18891 comm="libvirtd" requested_mask="send"
denied_mask="send" signal=term peer="unconfined"

Index: libvirt-3.10.0/examples/apparmor/usr.sbin.libvirtd
===================================================================
--- libvirt-3.10.0.orig/examples/apparmor/usr.sbin.libvirtd
+++ libvirt-3.10.0/examples/apparmor/usr.sbin.libvirtd
@@ -60,6 +60,9 @@
 
   signal (send) peer=/usr/sbin/dnsmasq,
   signal (read, send) peer=libvirt-*,
+  # When confinement is not enforced (security_default_confined = 0), qemu
+  # processes run unconfined, hence 'peer=unconfined'
+  signal send set=(hup,kill,term) peer=unconfined,
 
   # Very lenient profile for libvirtd since we want to first focus on confining
   # the guests. Guests will have a very restricted profile.

Places

File suse-apparmor-signal.patch of Package libvirt (Revision e5b254e9a1626b9b6542a408dceb41e5)

Places