A new apparmor profile derived from the libvirtd profile, with non-QEMU
related rules removed. Adopt the libvirt-qemu abstraction to work with
the new profile.

Signed-off-by: Jim Fehlig <jfehlig@suse.com>
Reviewed-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
---

I pursued a suggestion to use qemu's `make check-acceptance` as an
additional driver of qemu for verifying if all the host capabilities
in virtqemud profile are actually needed. That allowed me to shrink
the list of unverified capabilities to net_raw, sys_chroot, sys_ptrace,
setpcap, and sys_pacct. All but the last were added by the original
libvirtd profile commit 624a7927f07. sys_pacct was added in 2015 by
commit b61fb8e8af1. The capability was needed for xen, but from
the description sounds like it could be applicable to qemu as well

"Allow CAP_SYS_PACCT, which is required when resetting some multi-port
Broadcom cards by writting to the PCI config space"

As for the others, I'm hesitant to remove them even though I've been
unable to verify the capabilities are required. The paranoid side of me
says to keep them to avoid some unforeseen breakage.

 src/security/apparmor/libvirt-qemu          |   3 +
 src/security/apparmor/meson.build           |   1 +
 src/security/apparmor/usr.sbin.virtqemud.in | 134 ++++++++++++++++++++
 3 files changed, 138 insertions(+)

diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu
index 6275b6e95b..4156428163 100644
--- a/src/security/apparmor/libvirt-qemu
+++ b/src/security/apparmor/libvirt-qemu
@@ -16,9 +16,11 @@
 
   ptrace (readby, tracedby) peer=libvirtd,
   ptrace (readby, tracedby) peer=/usr/sbin/libvirtd,
+  ptrace (readby, tracedby) peer=virtqemud,
 
   signal (receive) peer=libvirtd,
   signal (receive) peer=/usr/sbin/libvirtd,
+  signal (receive) peer=virtqemud,
 
   /dev/kvm rw,
   /dev/net/tun rw,
@@ -223,6 +225,7 @@
   # allow connect with openGraphicsFD to work
   unix (send, receive) type=stream addr=none peer=(label=libvirtd),
   unix (send, receive) type=stream addr=none peer=(label=/usr/sbin/libvirtd),
+  unix (send, receive) type=stream addr=none peer=(label=virtqemud),
 
   # for gathering information about available host resources
   /sys/devices/system/cpu/ r,
diff --git a/src/security/apparmor/meson.build b/src/security/apparmor/meson.build
index af43780211..56f308bf3a 100644
--- a/src/security/apparmor/meson.build
+++ b/src/security/apparmor/meson.build
@@ -1,6 +1,7 @@
 apparmor_gen_profiles = [
   'usr.lib.libvirt.virt-aa-helper',
   'usr.sbin.libvirtd',
+  'usr.sbin.virtqemud',
 ]
 
 apparmor_gen_profiles_conf = configuration_data()
diff --git a/src/security/apparmor/usr.sbin.virtqemud.in b/src/security/apparmor/usr.sbin.virtqemud.in
new file mode 100644
index 0000000000..2d16ea821d
--- /dev/null
+++ b/src/security/apparmor/usr.sbin.virtqemud.in
@@ -0,0 +1,134 @@
+#include <tunables/global>
+@{LIBVIRT}="libvirt"
+
+profile virtqemud @sbindir@/virtqemud flags=(attach_disconnected) {
+  #include <abstractions/base>
+  #include <abstractions/dbus>
+
+  capability kill,
+  capability net_admin,
+  capability net_raw,
+  capability setgid,
+  capability sys_admin,
+  capability sys_module,
+  capability sys_ptrace,
+  capability sys_pacct,
+  capability sys_nice,
+  capability sys_chroot,
+  capability setuid,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability chown,
+  capability setpcap,
+  capability mknod,
+  capability fsetid,
+  capability audit_write,
+  capability ipc_lock,
+  capability sys_rawio,
+  capability bpf,
+  capability perfmon,
+
+  # Needed for vfio
+  capability sys_resource,
+
+  mount options=(rw,rslave)  -> /,
+  mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/,
+  umount /{var/,}run/libvirt/qemu/*.dev/,
+
+  # libvirt provides any mounts under /dev to qemu namespaces
+  mount options=(rw, move) /dev/ -> /{,var/}run/libvirt/qemu/*.dev/,
+  mount options=(rw, move) /dev/** -> /{,var/}run/libvirt/qemu/*{,/},
+  mount options=(rw, move) /{,var/}run/libvirt/qemu/*.dev/ -> /dev/,
+  mount options=(rw, move) /{,var/}run/libvirt/qemu/*{,/} -> /dev/**,
+
+  network inet stream,
+  network inet dgram,
+  network inet6 stream,
+  network inet6 dgram,
+  network netlink raw,
+  network packet dgram,
+  network packet raw,
+
+  # for --p2p migrations
+  unix (send, receive) type=stream addr=none peer=(label=unconfined addr=none),
+
+  ptrace (read,trace) peer=unconfined,
+  ptrace (read,trace) peer=@{profile_name},
+  ptrace (read,trace) peer=dnsmasq,
+  ptrace (read,trace) peer=/usr/sbin/dnsmasq,
+  ptrace (read,trace) peer=libvirt-*,
+
+  signal (send) peer=dnsmasq,
+  signal (send) peer=/usr/sbin/dnsmasq,
+  signal (read, send) peer=libvirt-*,
+  signal (send) set=("kill", "term") peer=unconfined,
+
+  # For communication/control to qemu-bridge-helper
+  unix (send, receive) type=stream addr=none peer=(label=libvirtd//qemu_bridge_helper),
+  signal (send) set=("term") peer=libvirtd//qemu_bridge_helper,
+
+  # allow connect with openGraphicsFD, direction reversed in newer versions
+  unix (send, receive) type=stream addr=none peer=(label=libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*),
+  # unconfined also required if guests run without security module
+  unix (send, receive) type=stream addr=none peer=(label=unconfined),
+
+  # required if guests run unconfined seclabel type='none' but libvirtd is confined
+  signal (read, send) peer=unconfined,
+
+  # Very lenient profile for libvirtd since we want to first focus on confining
+  # the guests. Guests will have a very restricted profile.
+  / r,
+  /** rwmkl,
+
+  /bin/* PUx,
+  /sbin/* PUx,
+  /usr/bin/* PUx,
+  @sbindir@/virtlogd pix,
+  @sbindir@/* PUx,
+  /{usr/,}lib/udev/scsi_id PUx,
+  /usr/{lib,lib64,lib/qemu,libexec}/vhost-user-gpu PUx,
+  /usr/{lib,lib64,lib/qemu,libexec}/virtiofsd PUx,
+
+  # Required by nwfilter_ebiptables_driver.c:ebiptablesWriteToTempFile() to
+  # read and run an ebtables script.
+  /var/lib/libvirt/virtd* ixr,
+
+  # force the use of virt-aa-helper
+  audit deny /{usr/,}sbin/apparmor_parser rwxl,
+  audit deny /etc/apparmor.d/libvirt/** wxl,
+  audit deny /sys/kernel/security/apparmor/features rwxl,
+  audit deny /sys/kernel/security/apparmor/matching rwxl,
+  audit deny /sys/kernel/security/apparmor/.* rwxl,
+  /sys/kernel/security/apparmor/profiles r,
+  @libexecdir@/* PUxr,
+  @libexecdir@/libvirt_parthelper ix,
+  @libexecdir@/libvirt_iohelper ix,
+  /etc/libvirt/hooks/** rmix,
+
+  # allow changing to our UUID-based named profiles
+  change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
+
+  /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
+  # child profile for bridge helper process
+  profile qemu_bridge_helper {
+   #include <abstractions/base>
+
+   capability setuid,
+   capability setgid,
+   capability setpcap,
+   capability net_admin,
+
+   network inet stream,
+
+   # For communication/control from virtqemud
+   unix (send, receive) type=stream addr=none peer=(label=virtqemud),
+   signal (receive) set=("term") peer=virtqemud,
+
+   /dev/net/tun rw,
+   /etc/qemu/** r,
+   owner @{PROC}/*/status r,
+
+   /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper rmix,
+  }
+}
-- 
2.31.1

Hello,

[please CC me in replies]

Your updated patches still look good, I just noticed something that is 
probably minor nitpicking:

Am Donnerstag, 24. Juni 2021, 22:48:58 CEST schrieb Jim Fehlig:
[...]
> +  signal (send) set=("kill", "term") peer=unconfined,
[...]
> +  signal (send) set=("term") peer=libvirtd//qemu_bridge_helper, 

The quotes around the signal names are superfluous. You can simply use 
    set=(kill, term)
    set=(term)

Actually the parenthesis are optional if there's only a single signal 
mentioned, so you could also use
    set=term
(keeping the parenthesis for consistency with other rules is also fine)


There are several signal rules with superfluous quotes in this patch, 
and also one in the 2/2 patch.

(There's no need to re-send the patch for such a minor change IMHO.)


Regards,

Christian Boltz
-- 
I'm root - if you see me laughing you better have a backup!

On 6/25/21 5:19 AM, Christian Boltz wrote:
> Hello,
> 
> [please CC me in replies]
> 
> Your updated patches still look good, I just noticed something that is
> probably minor nitpicking:
> 
> Am Donnerstag, 24. Juni 2021, 22:48:58 CEST schrieb Jim Fehlig:
> [...]
>> +  signal (send) set=("kill", "term") peer=unconfined,
> [...]
>> +  signal (send) set=("term") peer=libvirtd//qemu_bridge_helper,
> 
> The quotes around the signal names are superfluous. You can simply use
>      set=(kill, term)
>      set=(term)
> 
> Actually the parenthesis are optional if there's only a single signal
> mentioned, so you could also use
>      set=term
> (keeping the parenthesis for consistency with other rules is also fine)
> 
> 
> There are several signal rules with superfluous quotes in this patch,
> and also one in the 2/2 patch.
> 
> (There's no need to re-send the patch for such a minor change IMHO.)

Thanks. I've squashed the below diff into my local branch (along with a similar 
change to the one instance in 2/2).

Regards,
Jim

diff --git a/src/security/apparmor/usr.sbin.virtqemud.in 
b/src/security/apparmor/usr.sbin.virtqemud.in
index 2d16ea821d..3de03d49fc 100644
--- a/src/security/apparmor/usr.sbin.virtqemud.in
+++ b/src/security/apparmor/usr.sbin.virtqemud.in
@@ -62,11 +62,11 @@ profile virtqemud @sbindir@/virtqemud 
flags=(attach_disconnected) {
    signal (send) peer=dnsmasq,
    signal (send) peer=/usr/sbin/dnsmasq,
    signal (read, send) peer=libvirt-*,
-  signal (send) set=("kill", "term") peer=unconfined,
+  signal (send) set=(kill, term) peer=unconfined,

    # For communication/control to qemu-bridge-helper
    unix (send, receive) type=stream addr=none 
peer=(label=libvirtd//qemu_bridge_helper),
-  signal (send) set=("term") peer=libvirtd//qemu_bridge_helper,
+  signal (send) set=(term) peer=libvirtd//qemu_bridge_helper,

    # allow connect with openGraphicsFD, direction reversed in newer versions
    unix (send, receive) type=stream addr=none 
peer=(label=libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*),
@@ -123,7 +123,7 @@ profile virtqemud @sbindir@/virtqemud 
flags=(attach_disconnected) {

     # For communication/control from virtqemud
     unix (send, receive) type=stream addr=none peer=(label=virtqemud),
-   signal (receive) set=("term") peer=virtqemud,
+   signal (receive) set=(term) peer=virtqemud,

     /dev/net/tun rw,
     /etc/qemu/** r,