From nobody Sat Dec 21 17:17:22 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1726498590169495.5797906722785; Mon, 16 Sep 2024 07:56:30 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 996) id 26C11186B; Mon, 16 Sep 2024 10:56:29 -0400 (EDT) Received: from lists.libvirt.org (localhost [IPv6:::1]) by lists.libvirt.org (Postfix) with ESMTP id 31887185F; Mon, 16 Sep 2024 10:56:13 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 996) id 805741A5D; Mon, 16 Sep 2024 10:56:09 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id A6381186B for ; Mon, 16 Sep 2024 10:56:02 -0400 (EDT) Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-312--KXOCOQmN3-QfOSoKcGb7w-1; Mon, 16 Sep 2024 10:56:00 -0400 Received: from mx-prod-int-02.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-02.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.15]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id ACF201956077 for ; Mon, 16 Sep 2024 14:55:59 +0000 (UTC) Received: from harajuku.usersys.redhat.com (unknown [10.45.226.85]) by mx-prod-int-02.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 87CF91956086 for ; Mon, 16 Sep 2024 14:55:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-0.5 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=3.4.4 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1726498562; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qkbDAkPEWHeXkodzqXDUOuditakY1SW/qBKhoY7go4E=; b=J/r1cYmuEBp3HE/tPzH8WZ2UHcQHq12JCK4y6LWnKOSErUPJj6DOHo60a6c0x4LFkHjLi5 H8NX60EXk+z8xqmisCRP870m0Hsm0ekieR0w0m27EW+iqs44KtOn0Ca2yASL6ewLijfcJL GTw2su7+YH05/gZpVA/ksJRzpGXp3ow= X-MC-Unique: -KXOCOQmN3-QfOSoKcGb7w-1 From: Andrea Bolognani To: devel@lists.libvirt.org Subject: [PATCH] apparmor: Don't check for existence of templates upfront Date: Mon, 16 Sep 2024 16:55:55 +0200 Message-ID: <20240916145555.76207-1-abologna@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.15 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: ETIQHL5V7Z4GJOGC5GIBNGBMZMXJZADV X-Message-ID-Hash: ETIQHL5V7Z4GJOGC5GIBNGBMZMXJZADV X-MailFrom: abologna@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-config-1; header-match-config-2; header-match-config-3; header-match-devel.lists.libvirt.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; suspicious-header X-Mailman-Version: 3.2.2 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1726498591606116600 Content-Type: text/plain; charset="utf-8"; x-default="true" Currently, if either template is missing AppArmor support is completely disabled. This means that uninstalling the LXC driver from a system results in QEMU domains being started without AppArmor confinement, which obviously doesn't make any sense. The problematic scenario was impossible to hit in Debian until very recently, because all AppArmor files were shipped as part of the same package; now that the Debian package is much closer to the Fedora one, and specifically ships the AppArmor files together with the corresponding driver, it becomes trivial to trigger it. Drop the checks entirely. virt-aa-helper, which is responsible for creating the per-domain profiles starting from the driver-specific template, already fails if the latter is not present, so they were always redundant. https://bugs.debian.org/1081396 Signed-off-by: Andrea Bolognani Reviewed-by: Daniel P. Berrang=C3=A9 --- src/security/security_apparmor.c | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/src/security/security_apparmor.c b/src/security/security_appar= mor.c index 27184aef7f..a62ec1b10d 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -318,27 +318,9 @@ AppArmorSetSecurityHostLabel(virSCSIVHostDevice *dev G= _GNUC_UNUSED, static virSecurityDriverStatus AppArmorSecurityManagerProbe(const char *virtDriver G_GNUC_UNUSED) { - g_autofree char *template_qemu =3D NULL; - g_autofree char *template_lxc =3D NULL; - if (use_apparmor() < 0) return SECURITY_DRIVER_DISABLE; =20 - /* see if template file exists */ - template_qemu =3D g_strdup_printf("%s/TEMPLATE.qemu", APPARMOR_DIR "/l= ibvirt"); - template_lxc =3D g_strdup_printf("%s/TEMPLATE.lxc", APPARMOR_DIR "/lib= virt"); - - if (!virFileExists(template_qemu)) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("template \'%1$s\' does not exist"), template_qem= u); - return SECURITY_DRIVER_DISABLE; - } - if (!virFileExists(template_lxc)) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("template \'%1$s\' does not exist"), template_lxc= ); - return SECURITY_DRIVER_DISABLE; - } - return SECURITY_DRIVER_ENABLE; } =20 --=20 2.46.0