virt-aa-helper: Actually fix AppArmor profile

[libvirt] [PATCH] virt-aa-helper: Actually fix AppArmor profile

Posted by Andrea Bolognani 6 years, 5 months ago

Tried previously in

  commit b1eb8b3e8fd1d4cb1da8e5e2b16f2c10837fd823
  Author: Andrea Bolognani <abologna@redhat.com>
  Date:   Mon Aug 19 10:23:42 2019 +0200

    virt-aa-helper: Fix AppArmor profile

  v5.6.0-243-gb1eb8b3e8f

with somewhat disappointing results.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
---
 src/security/apparmor/usr.lib.libvirt.virt-aa-helper | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper
index d81dddef30..64772f0756 100644
--- a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper
+++ b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper
@@ -18,8 +18,8 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper {
   @{PROC}/filesystems r,
 
   # Used when internally running another command (namely apparmor_parser)
-  @{PROC}/self/fd r,
-  @{PROC}/@{pid}/fd r,
+  @{PROC}/self/fd/ r,
+  @{PROC}/@{pid}/fd/ r,
 
   /etc/libnl-3/classid r,
 
-- 
2.21.0

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Re: [libvirt] [PATCH] virt-aa-helper: Actually fix AppArmor profile

Posted by Ján Tomko 6 years, 5 months ago

On Tue, Aug 20, 2019 at 09:56:26AM +0200, Andrea Bolognani wrote:
>Tried previously in
>
>  commit b1eb8b3e8fd1d4cb1da8e5e2b16f2c10837fd823
>  Author: Andrea Bolognani <abologna@redhat.com>
>  Date:   Mon Aug 19 10:23:42 2019 +0200
>
>    virt-aa-helper: Fix AppArmor profile
>
>  v5.6.0-243-gb1eb8b3e8f
>
>with somewhat disappointing results.
>

Third time's the charm!

>Signed-off-by: Andrea Bolognani <abologna@redhat.com>
>---
> src/security/apparmor/usr.lib.libvirt.virt-aa-helper | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>

Reviewed-by: Ján Tomko <jtomko@redhat.com>

Jano
--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Re: [libvirt] [PATCH] virt-aa-helper: Actually fix AppArmor profile

Posted by Jamie Strandboge 6 years, 5 months ago

On Tue, 20 Aug 2019, Andrea Bolognani wrote:

> --- a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper
> +++ b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper
> @@ -18,8 +18,8 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper {
>    @{PROC}/filesystems r,
>  
>    # Used when internally running another command (namely apparmor_parser)
> -  @{PROC}/self/fd r,
> -  @{PROC}/@{pid}/fd r,
> +  @{PROC}/self/fd/ r,

/proc/self is a 'magic symlink' and apparmor will resolve symlinks
before performing checks. As such, @{PROC}/self/fd/ is redundant with
the next rule.

> +  @{PROC}/@{pid}/fd/ r,

This access LGTM. +1 to apply.

-- 
Jamie Strandboge             | http://www.canonical.com
--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Re: [libvirt] [PATCH] virt-aa-helper: Actually fix AppArmor profile

Posted by Andrea Bolognani 6 years, 5 months ago

On Tue, 2019-08-20 at 12:09 -0500, Jamie Strandboge wrote:
> On Tue, 20 Aug 2019, Andrea Bolognani wrote:
> >    # Used when internally running another command (namely apparmor_parser)
> > +  @{PROC}/self/fd/ r,
> 
> /proc/self is a 'magic symlink' and apparmor will resolve symlinks
> before performing checks. As such, @{PROC}/self/fd/ is redundant with
> the next rule.
> 
> > +  @{PROC}/@{pid}/fd/ r,
> 
> This access LGTM. +1 to apply.

Well, it's already been merged:

  https://libvirt.org/git/?p=libvirt.git;a=commit;h=9c2446ed4a81450f6482f259f9a0cf720cb0e423

I'll post a patch removing the unnecessary rule.

-- 
Andrea Bolognani / Red Hat / Virtualization

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list