From nobody Sat Nov 23 10:45:08 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=fail(p=none dis=none) header.from=canonical.com Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 173150823783118.8972935469817; Wed, 13 Nov 2024 06:30:37 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 996) id C30B417D9; Wed, 13 Nov 2024 09:30:36 -0500 (EST) Received: from lists.libvirt.org (localhost [IPv6:::1]) by lists.libvirt.org (Postfix) with ESMTP id 7B3971735; Wed, 13 Nov 2024 09:29:13 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 996) id E1268172F; Wed, 13 Nov 2024 09:29:07 -0500 (EST) Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 616F01949 for ; Wed, 13 Nov 2024 09:28:57 -0500 (EST) Received: from mail-oi1-f197.google.com (mail-oi1-f197.google.com [209.85.167.197]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 989663F336 for ; Wed, 13 Nov 2024 14:28:56 +0000 (UTC) Received: by mail-oi1-f197.google.com with SMTP id 5614622812f47-3e5f7514c0bso535823b6e.0 for ; Wed, 13 Nov 2024 06:28:56 -0800 (PST) Received: from georgia.. ([2001:1284:f502:9d8:a684:3ba4:302a:698d]) by smtp.gmail.com with ESMTPSA id 5614622812f47-3e7b09b26f6sm574965b6e.37.2024.11.13.06.28.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 13 Nov 2024 06:28:53 -0800 (PST) X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.1 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, RCVD_IN_VALIDITY_RPBL_BLOCKED,RCVD_IN_VALIDITY_SAFE_BLOCKED, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=3.4.4 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1731508136; bh=MgHn0QZdgAzT3Xoi6pHsDavXqkx1daSdm9n6D+aqlM4=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=vsRXWQslc77C4r+gSrwkTC5FF0r4q7o7LXZpd/o7WWDQpQ9bRZIiG3Lu30O08nOA0 9uYPEQrScXLYXwhKs2v9XhtOd07ZrmSf8SKumQYBlhNygg+hF6Rd23x0WmPjwtu3gz ZrrYuEjUNTSUr7th0xKEo3sMOPvN07ZvemNupjeZHxkSWkolY4I/cGI9DUJ66M10Qb vz67XL0ulhw/jemAqDkKiwzL8jXHSI7n2AGtuEixj6TSoAhqO/Y9mgtLwas7DnTI/Y YwZGrKg2t3RIg7M+wdlXb9Li7C4gzi3bCmJpdbZNjH/S7ytbRS39rBnZpNZFGt6jS6 FCk4vPlCBFtZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1731508135; x=1732112935; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=MgHn0QZdgAzT3Xoi6pHsDavXqkx1daSdm9n6D+aqlM4=; b=wx5FyXFzNKByKF7fjxHF2FH95Fw9jr5g5ONGNfs+nLisGlgG8QEwYi94ibA+SZxVb6 wuVxvIADAlW9ym3GfEpHdaXyPepRj2LYfhVopJwbv4aMVHR3ro7w8rhEM7hrKa7k/UdT kbaOyrysw5n/XENNnJuYmOvqHsST4D9AApzDLMJtPJpiuCCRr2T5+KGgEpPMCzV6hGXk 1XzN6bk2A5kKNJ2jwiHiMC4q9q1GZh+bN5n8TP2vWSykKXpzTkiL6pHlcdhfBoP8HGBD el/lJXCbLtqfjKxAzRgKbEn2fHq0pwnkZMKmHWKNgKohPL857a0LumgO6jv1P/NjAdrR E86A== X-Gm-Message-State: AOJu0YwjDb24o2/oN2MiUuDQjz/EZFQ5kEwJjSUModndaVix6oeoucQ4 YU6ek/A0bvkf+eHUysT+UtepE9M4G7YrXqwY4pH2Xdh6Uzf/GiktFn3fdvfktL878d1rEQGBc17 OpMyNUhFAz7FoGrF1clw4iPb/DhlcX0xMQEF1JLVkKqH75vKQyKgDL2kPSerw+wFCS7Ps/PczQK QtIbugsw== X-Received: by 2002:a05:6808:3c94:b0:3e7:65c7:f260 with SMTP id 5614622812f47-3e793ebdf69mr11432628b6e.1.1731508134990; Wed, 13 Nov 2024 06:28:54 -0800 (PST) X-Google-Smtp-Source: AGHT+IEH4LD0ZUVxpMb2i4sPHZ/qgrpj6PDOmoiq61JnmBdBQ3AJIWuu8eecj9O+NdNOTVbLLmUilw== X-Received: by 2002:a05:6808:3c94:b0:3e7:65c7:f260 with SMTP id 5614622812f47-3e793ebdf69mr11432609b6e.1.1731508134693; Wed, 13 Nov 2024 06:28:54 -0800 (PST) From: Georgia Garcia To: devel@lists.libvirt.org Subject: [PATCH v2 3/4] apparmor: fix UUID specification Date: Wed, 13 Nov 2024 11:28:36 -0300 Message-Id: <20241113142837.529332-4-georgia.garcia@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20241113142837.529332-1-georgia.garcia@canonical.com> References: <20241113142837.529332-1-georgia.garcia@canonical.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Message-ID-Hash: OXR7SZYJ47FFTIM2GM4IOJV77JMPOGTN X-Message-ID-Hash: OXR7SZYJ47FFTIM2GM4IOJV77JMPOGTN X-MailFrom: georgia.garcia@canonical.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-config-1; header-match-config-2; header-match-config-3; header-match-devel.lists.libvirt.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; suspicious-header CC: Georgia Garcia X-Mailman-Version: 3.2.2 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: fail (Computed bodyhash is different from the expected one) X-ZM-MESSAGEID: 1731508239559116600 Content-Type: text/plain; charset="utf-8" There is a common misconception when writing AppArmor policy that [0-9]* applies * to the [0-9] class, but that's not the case. For this example, [0-9]* matches a single digit followed by any number of characters except for / Create a UUID variable that uses the following format 8-4-4-4-12. Signed-off-by: Georgia Garcia --- src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in | 5 ++++- src/security/apparmor/usr.sbin.libvirtd.in | 7 +++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in b/src/= security/apparmor/usr.lib.libvirt.virt-aa-helper.in index 44645c6989..90a8b7072c 100644 --- a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in +++ b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in @@ -1,5 +1,8 @@ #include =20 +@{hextet}=3D[0-9a-f][0-9a-f][0-9a-f][0-9a-f] +@{UUID}=3D@{hextet}@{hextet}-@{hextet}-@{hextet}-@{hextet}-@{hextet}@{hext= et}@{hextet} + profile virt-aa-helper @libexecdir@/virt-aa-helper { #include #include @@ -44,7 +47,7 @@ profile virt-aa-helper @libexecdir@/virt-aa-helper { /{usr/,}{s,}bin/apparmor_parser Ux, =20 @sysconfdir@/apparmor.d/libvirt/* r, - @sysconfdir@/apparmor.d/libvirt/libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0= -9a-f]*-[0-9a-f]* rw, + @sysconfdir@/apparmor.d/libvirt/libvirt-@{UUID}* rw, =20 # for backingstore -- allow access to non-hidden files in @{HOME} as well # as storage pools diff --git a/src/security/apparmor/usr.sbin.libvirtd.in b/src/security/appa= rmor/usr.sbin.libvirtd.in index 70e586895f..3659ddc219 100644 --- a/src/security/apparmor/usr.sbin.libvirtd.in +++ b/src/security/apparmor/usr.sbin.libvirtd.in @@ -1,4 +1,7 @@ #include + +@{hextet}=3D[0-9a-f][0-9a-f][0-9a-f][0-9a-f] +@{UUID}=3D@{hextet}@{hextet}-@{hextet}-@{hextet}-@{hextet}-@{hextet}@{hext= et}@{hextet} @{LIBVIRT}=3D"libvirt" =20 profile libvirtd @sbindir@/libvirtd flags=3D(attach_disconnected) { @@ -72,7 +75,7 @@ profile libvirtd @sbindir@/libvirtd flags=3D(attach_disco= nnected) { signal (send) set=3D("term") peer=3Dlibvirtd//qemu_bridge_helper, =20 # allow connect with openGraphicsFD, direction reversed in newer versions - unix (send, receive) type=3Dstream addr=3Dnone peer=3D(label=3Dlibvirt-[= 0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*), + unix (send, receive) type=3Dstream addr=3Dnone peer=3D(label=3Dlibvirt-@= {UUID}), # unconfined also required if guests run without security module unix (send, receive) type=3Dstream addr=3Dnone peer=3D(label=3Dunconfine= d), =20 @@ -115,7 +118,7 @@ profile libvirtd @sbindir@/libvirtd flags=3D(attach_dis= connected) { /etc/xen/scripts/** rmix, =20 # allow changing to our UUID-based named profiles - change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-= 9a-f]*, + change_profile -> @{LIBVIRT}-@{UUID}, =20 /usr/{lib,lib64,lib/qemu,libexec,libexec/qemu}/qemu-bridge-helper Cx -> = qemu_bridge_helper, # child profile for bridge helper process --=20 2.34.1