From nobody Tue Jan 21 07:27:19 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=fail(p=none dis=none) header.from=canonical.com Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1736263841482917.1807151316451; Tue, 7 Jan 2025 07:30:41 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 996) id 7F51FCEC; Tue, 7 Jan 2025 10:30:40 -0500 (EST) Received: from lists.libvirt.org (localhost [IPv6:::1]) by lists.libvirt.org (Postfix) with ESMTP id ED7F8EA1; Tue, 7 Jan 2025 10:25:03 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 996) id 32AC01123; Tue, 7 Jan 2025 10:25:01 -0500 (EST) Received: from smtp-relay-internal-1.canonical.com (smtp-relay-internal-1.canonical.com [185.125.188.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 43EE3CE3 for ; Tue, 7 Jan 2025 10:24:26 -0500 (EST) Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 892393F2BD for ; Tue, 7 Jan 2025 15:24:25 +0000 (UTC) Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2166e907b5eso208132785ad.3 for ; Tue, 07 Jan 2025 07:24:25 -0800 (PST) Received: from georgia.. ([2001:1284:f502:1965:7bc6:bb4:7636:7bb1]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-842b85f00f9sm31048120a12.43.2025.01.07.07.24.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jan 2025 07:24:21 -0800 (PST) X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, RCVD_IN_MSPIKE_H2,RCVD_IN_VALIDITY_RPBL_BLOCKED, RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=3.4.4 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1736263465; bh=RLAcTU5rnttoRjS/0VotrjMEcq0PGHy/3yK+t6vnMMk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=twmHNBr2SYSohMEkItmug1Yx8RAecJYx/fsKgLkzIAg2Nd+8AkyG4ujDNMF8Bf11Q r97pdlRk3nx1n2EnFnM04rOf32CC3UJbSg+2h2qsc55isZL08EVNeD1bx3OtE5Ctyc 22k55xHS9ouUsFfuP3oEkwWwXukl2xaP5b69fP+CYnftWNH364f1R+HcR7Hwqp/QUQ LHiW66ZfM+Q6XRRDGaCZbjHPxqlELOL+bpYMWJJ0nV8GDKKFJ8xA7dn6yt7aAYxQ8y 8YPgjROGkb4rPo9INM8k630tg5HpIP8t3DWf+JhTG8B1NeuK3fMqDc1XFlpCAJ08ks iSgBQfPmhM+9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1736263463; x=1736868263; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=RLAcTU5rnttoRjS/0VotrjMEcq0PGHy/3yK+t6vnMMk=; b=w7AVAqQL+kuwKUJwQLm6nYGgWtiNH53aNJfRgseW7LEFRR07jWt/9KQqfw+mznY+DM t6Eq3OM32uDJr4LppX5PCWNc9k0Zuu0ce4xnHVJoAZVL2dvy6BcDjml+YYPyghba0v6H 9Wo4JAtOPskffzkm4q1EQ45cL0IgynEi8R5Lt5Sd2XE+E/eyj+lPli2UXQc4nFW+zVDg 6rgAYXRZbGH0hcNGhO29u8h9TeVTQmfdKR9tOD1aUvlg8cSQS8/WvwXHH8yL9COsMuG/ 0Cjj/8Ug7IJG8tI2nftqEHpnllzMJJowzAzHXa10V5NiPS8rsRvSImuh5K5L4kTbWrhO eUgA== X-Gm-Message-State: AOJu0YwE9Mmtq7aewE73FcSB0vWF0JTkGVwoPX+kPrT88IeHSE8URDwW 8dnfA1/DDOT+mUhni9SJ2uuvSbGo6yVWJ9rVAi0+Kd5vtcJrljbw2FQOLHEWBTAnk7/70O0Ewzb WpusNgqnoHOVc4hgVQniVSTy6K6vUNzkkJLX1wWglW8Eqz6z848W/KzIDkB+OKYgpa0+hrjgn6r fMfzc= X-Gm-Gg: ASbGnctpl08eGnLxmCDeqmNuL+RP0WFx0ENm80UZSMnoGy+iTKKfKxKE5kui7JG31BT 8792YDWp07JwlpLCO5ih12epAHI2VkMc/prjJJv1focUW+Ii5nvpagFQf/ylmPPLoDDYPQ1gxhB WoxowC7vtEb63GJv0y1uCppvPvYGpPdcGwiKV7RgAJR7gaGGMehFx4YI7zEy7M2ILxSacFhJdKA exg2mz1p1iDY7YydQGZMqQv/VSqaFjoSIRmWTr7w6NQCn/fQCzufqahUPllIpQdeQO/ X-Received: by 2002:a05:6a20:8412:b0:1e1:a671:7122 with SMTP id adf61e73a8af0-1e5e044635dmr99520606637.2.1736263462672; Tue, 07 Jan 2025 07:24:22 -0800 (PST) X-Google-Smtp-Source: AGHT+IEBq81kPAZ4wP9b13di0S8OdoxXGh4eF93e+GQnEWFe16ggxvW5hvQ96Djbdha8gaTYYPZvnQ== X-Received: by 2002:a05:6a20:8412:b0:1e1:a671:7122 with SMTP id adf61e73a8af0-1e5e044635dmr99520578637.2.1736263462360; Tue, 07 Jan 2025 07:24:22 -0800 (PST) From: Georgia Garcia To: devel@lists.libvirt.org Subject: [PATCH v3 3/4] apparmor: fix UUID specification Date: Tue, 7 Jan 2025 12:23:38 -0300 Message-ID: <20250107152357.1026544-4-georgia.garcia@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20250107152357.1026544-1-georgia.garcia@canonical.com> References: <20250107152357.1026544-1-georgia.garcia@canonical.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Message-ID-Hash: LOE3XT3EHVZZOY2TCRXTIRDIH45QZY36 X-Message-ID-Hash: LOE3XT3EHVZZOY2TCRXTIRDIH45QZY36 X-MailFrom: georgia.garcia@canonical.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-config-1; header-match-config-2; header-match-config-3; header-match-devel.lists.libvirt.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; suspicious-header CC: Georgia Garcia X-Mailman-Version: 3.2.2 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: fail (Computed bodyhash is different from the expected one) X-ZM-MESSAGEID: 1736263843172116600 Content-Type: text/plain; charset="utf-8" There is a common misconception when writing AppArmor policy that [0-9]* applies * to the [0-9] class, but that's not the case. For this example, [0-9]* matches a single digit followed by any number of characters except for / Create a UUID variable that uses the following format 8-4-4-4-12. Signed-off-by: Georgia Garcia Reviewed-by: Jim Fehlig --- src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in | 5 ++++- src/security/apparmor/usr.sbin.libvirtd.in | 7 +++++-- src/security/apparmor/usr.sbin.virtqemud.in | 6 ++++-- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in b/src/= security/apparmor/usr.lib.libvirt.virt-aa-helper.in index 44645c6989..90a8b7072c 100644 --- a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in +++ b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in @@ -1,5 +1,8 @@ #include =20 +@{hextet}=3D[0-9a-f][0-9a-f][0-9a-f][0-9a-f] +@{UUID}=3D@{hextet}@{hextet}-@{hextet}-@{hextet}-@{hextet}-@{hextet}@{hext= et}@{hextet} + profile virt-aa-helper @libexecdir@/virt-aa-helper { #include #include @@ -44,7 +47,7 @@ profile virt-aa-helper @libexecdir@/virt-aa-helper { /{usr/,}{s,}bin/apparmor_parser Ux, =20 @sysconfdir@/apparmor.d/libvirt/* r, - @sysconfdir@/apparmor.d/libvirt/libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0= -9a-f]*-[0-9a-f]* rw, + @sysconfdir@/apparmor.d/libvirt/libvirt-@{UUID}* rw, =20 # for backingstore -- allow access to non-hidden files in @{HOME} as well # as storage pools diff --git a/src/security/apparmor/usr.sbin.libvirtd.in b/src/security/appa= rmor/usr.sbin.libvirtd.in index 70e586895f..3659ddc219 100644 --- a/src/security/apparmor/usr.sbin.libvirtd.in +++ b/src/security/apparmor/usr.sbin.libvirtd.in @@ -1,4 +1,7 @@ #include + +@{hextet}=3D[0-9a-f][0-9a-f][0-9a-f][0-9a-f] +@{UUID}=3D@{hextet}@{hextet}-@{hextet}-@{hextet}-@{hextet}-@{hextet}@{hext= et}@{hextet} @{LIBVIRT}=3D"libvirt" =20 profile libvirtd @sbindir@/libvirtd flags=3D(attach_disconnected) { @@ -72,7 +75,7 @@ profile libvirtd @sbindir@/libvirtd flags=3D(attach_disco= nnected) { signal (send) set=3D("term") peer=3Dlibvirtd//qemu_bridge_helper, =20 # allow connect with openGraphicsFD, direction reversed in newer versions - unix (send, receive) type=3Dstream addr=3Dnone peer=3D(label=3Dlibvirt-[= 0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*), + unix (send, receive) type=3Dstream addr=3Dnone peer=3D(label=3Dlibvirt-@= {UUID}), # unconfined also required if guests run without security module unix (send, receive) type=3Dstream addr=3Dnone peer=3D(label=3Dunconfine= d), =20 @@ -115,7 +118,7 @@ profile libvirtd @sbindir@/libvirtd flags=3D(attach_dis= connected) { /etc/xen/scripts/** rmix, =20 # allow changing to our UUID-based named profiles - change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-= 9a-f]*, + change_profile -> @{LIBVIRT}-@{UUID}, =20 /usr/{lib,lib64,lib/qemu,libexec,libexec/qemu}/qemu-bridge-helper Cx -> = qemu_bridge_helper, # child profile for bridge helper process diff --git a/src/security/apparmor/usr.sbin.virtqemud.in b/src/security/app= armor/usr.sbin.virtqemud.in index 42fa4813da..86b23465b6 100644 --- a/src/security/apparmor/usr.sbin.virtqemud.in +++ b/src/security/apparmor/usr.sbin.virtqemud.in @@ -1,5 +1,7 @@ #include @{LIBVIRT}=3D"libvirt" +@{hextet}=3D[0-9a-f][0-9a-f][0-9a-f][0-9a-f] +@{UUID}=3D@{hextet}@{hextet}-@{hextet}-@{hextet}-@{hextet}-@{hextet}@{hext= et}@{hextet} =20 profile virtqemud @sbindir@/virtqemud flags=3D(attach_disconnected) { #include @@ -71,7 +73,7 @@ profile virtqemud @sbindir@/virtqemud flags=3D(attach_dis= connected) { signal (send) set=3D(term) peer=3Dlibvirtd//qemu_bridge_helper, =20 # allow connect with openGraphicsFD, direction reversed in newer versions - unix (send, receive) type=3Dstream addr=3Dnone peer=3D(label=3Dlibvirt-[= 0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*), + unix (send, receive) type=3Dstream addr=3Dnone peer=3D(label=3Dlibvirt-@= {UUID}), # unconfined also required if guests run without security module unix (send, receive) type=3Dstream addr=3Dnone peer=3D(label=3Dunconfine= d), =20 @@ -109,7 +111,7 @@ profile virtqemud @sbindir@/virtqemud flags=3D(attach_d= isconnected) { /etc/libvirt/hooks/** rmix, =20 # allow changing to our UUID-based named profiles - change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-= 9a-f]*, + change_profile -> @{LIBVIRT}-@{UUID}, =20 /usr/{lib,lib64,lib/qemu,libexec,libexec/qemu}/qemu-bridge-helper Cx -> = qemu_bridge_helper, # child profile for bridge helper process --=20 2.43.0