From nobody Mon Feb 2 07:31:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1767645600; cv=none; d=zohomail.com; s=zohoarc; b=k83L4Q0i5roKAsNEmMRr9WQVxaqCuN82DyNRe6aiyKZhyBsTJjkZk4Gfy3317jHYkQLSDCMALQwth1gdwe+s8nahy8tYJWZX9fN9vwYazbWMKPLsSgNSasgskWDCJnhRkTQbaeYDgDOAG/DdZhdEM27thCdGHH2y2AvNCilYiRI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1767645600; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Subject:Subject:To:To:Message-Id; bh=b6ef6Sr1Iiv1X1zTR7eZgyetTg2EhuW5S1qVkhykDR8=; b=bBgVJTKqG/BX3zWOEjcnEyzJaqmXcJ8l4OreC0lRu7QG6E2Vp1aW6M+UU+GJNj1tB35GtFTouBCLV0F9mVviPUB1i5dTXvOY8AndKsCp9yOYHA5AJU3Vlmfe6JShaWs981/mMeWo6TslBjx5NYzS+YAJ1NjfBUq7W1oaWfOy4Po= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1767645600128839.6247302382383; Mon, 5 Jan 2026 12:40:00 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id 385BF4193C; Mon, 5 Jan 2026 15:39:59 -0500 (EST) Received: from [172.19.199.83] (lists.libvirt.org [8.43.85.245]) by lists.libvirt.org (Postfix) with ESMTP id 3782541B06; Mon, 5 Jan 2026 15:38:48 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id C056B41943; Mon, 5 Jan 2026 15:33:53 -0500 (EST) Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits)) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 6DB8C4192F for ; Mon, 5 Jan 2026 15:33:51 -0500 (EST) Received: from mail-yx1-f69.google.com (mail-yx1-f69.google.com [74.125.224.69]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 66DAB3FB62 for ; Mon, 5 Jan 2026 20:28:43 +0000 (UTC) Received: by mail-yx1-f69.google.com with SMTP id 956f58d0204a3-6465127b44fso744160d50.0 for ; Mon, 05 Jan 2026 12:28:43 -0800 (PST) Received: from r.lxd ([147.219.77.79]) by smtp.gmail.com with ESMTPSA id 00721157ae682-790aa57deacsm65117b3.20.2026.01.05.12.28.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 05 Jan 2026 12:28:41 -0800 (PST) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_DNSWL_MED,RCVD_IN_VALIDITY_CERTIFIED_BLOCKED, RCVD_IN_VALIDITY_RPBL_BLOCKED,RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_PASS autolearn=unavailable autolearn_force=no version=4.0.1 X-Greylist: delayed 308 seconds by postgrey-1.37 at lists.libvirt.org; Mon, 05 Jan 2026 15:33:51 EST DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20251003; t=1767644923; bh=b6ef6Sr1Iiv1X1zTR7eZgyetTg2EhuW5S1qVkhykDR8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=SaKed7qqIT521NNFqMu51Hnj8cX2e18EgOKXRcalDvWwvUmfsXc+6Qu23O6rJ6Kzy 6Ih96zI8WQgdtq9+OFRn1URSOhSonRopKi5xi3yitq8HAIOROalhTnAFhJ3t5IgHhm jW4XoCktsiUS/CPulLv2aIkQ1NseqSyzjORGj+WlAv/9uf9va4JkH5M0wM8OTClN94 MxbdsuFSJdIBPocj+jIge8l/xJYVIUBPMZE8nYjhT3AWqP4NS1Q+ytck9uBxstPpIT JFYbubuWhoCEfFBkFT2UEDie0u/YqaQfgtn7WY0+B1mvhs5/UR2DKgXMgycNrW3ltx 305GOr6EStZCAkaJ7JQ02yAbPuNFJtmjFwED7PZxS/ASt4qCuvesadHV5ECR8LPBB8 IPrcG66qVhPhVo2PHYYnzi0Xgt1D4CYlaDAqlRpEucxaaEasi2vnpWDqBR+i649SWu X/ohWSrA+BO4zZFPi27YOeKOhAlYHDP9TnB8W0+7Ty0lLytkkX5UD5sCyXPrXS4R6+ icRLIeN/3OrSoLtAESC4u8VvUCGjdnpf9zhsSNZDmT5ZNXivYDpEsEbzzcsIptFxkH tUppdcT9BK+rBaHY8IgKBCdzCT8iveE5hZfqleZRX3geB3k7/yxe9Aw/LsiPmCMAxo vqBN0dK4ij6/vgSb5SajlWFw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767644922; x=1768249722; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=b6ef6Sr1Iiv1X1zTR7eZgyetTg2EhuW5S1qVkhykDR8=; b=obKZuqr/uRdfGGd3bJ+ilTHkb2h1iMUM66DgL6Z9i2pNlZHAJtYJ4t21pnW+OgmGFe axpO+rldZHac8Y3wJRfe1bSg6D6Ld22X4aRabtM2q4lQcMWCCYRSdYmAUYP0btfg/vUH naK801bKXzRd8qLJRVFwRHLpIdiYUj6atpuoRfBYEI30XT8ApDUo/WExDr5/lb42h4ZJ qa5bTRzgr+jLLb1sI55t+RmNb/PG9OnFr2Hhp0R43/IDPJoRRpUw072djbP8/ek3CoiO 0BjU3Rnb+Qxfb9ZAmJVVad7REhpA1QOlAqokOaiWL63CCJw5B900/iHT6QaVfIK62pYN 4ViA== X-Gm-Message-State: AOJu0Yw6DDk7qMfzEq6Q3U5ugKAFPfCBW4Ax8mfQdYOuo0sCv2ftK6Jj USjIN2fEbY71HJ1DPhmFTo/xG2ia0Yyz7Wx+Oo4qacTlIFGGeu9z1p6a4z2/n1orASo426zQJqb Tx1PvsytUExDIX2ItCvUBjoDhKqtdaGMWVaTgK3yJ0sdk8vVf8426Yv+DSDH85sE1nZo/8XS+0x GAC7cVF0g= X-Gm-Gg: AY/fxX7ac8is/zjJ3HSXS8Exp3AWzjH+lpUW0bwinLjMuvkrfkAVmEzq6PyJl+vTdc2 FUhlY8lntTtuobAcmfh2CTR4+viHZw5CyvKMtQJZFCwV5Rkcy/rFpARa/JpoPBt2iR8XHBw1rMv xirlndK30T5GtzqrwVRx5NbFsCr4nlf9dbtB/gx2JRxj0M88zDpEp9ZOVBS6VVDhEGMkWNapxqp 9KLmQCEEJ0fYv9A8SdSAc7UcLm9mAaYVNNrboL9kCaGuHsfpe57bjTA7CdFxrpyM/Kv4HXxzbz9 OIykbbLtcWDI3L6RIWvka++xErplm63j9DNjnu6m1j/Xc3IXZVsMcCLYLZXI6gK5eBRs6auSvYL LuaXmtC1wRxdWXZ0d X-Received: by 2002:a05:690e:1686:b0:644:44d2:a9cc with SMTP id 956f58d0204a3-6470d25adb8mr352122d50.7.1767644922197; Mon, 05 Jan 2026 12:28:42 -0800 (PST) X-Google-Smtp-Source: AGHT+IGlQezV0958AZGBgVi+s42kpRvH8vHEaAxXEQzV+/C7mei6R/zr6LRiQaj0dkCl5SEOuohERg== X-Received: by 2002:a05:690e:1686:b0:644:44d2:a9cc with SMTP id 956f58d0204a3-6470d25adb8mr352113d50.7.1767644921845; Mon, 05 Jan 2026 12:28:41 -0800 (PST) Date: Mon, 05 Jan 2026 14:27:21 -0600 Subject: [PATCH 1/3] virt-aa-helper: Ask for no deny rule for readonly disk elements MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260105-apparmor-races-v1-1-932cf0e990b7@canonical.com> References: <20260105-apparmor-races-v1-0-932cf0e990b7@canonical.com> In-Reply-To: <20260105-apparmor-races-v1-0-932cf0e990b7@canonical.com> To: devel@lists.libvirt.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=1449; i=wesley.hershberger@canonical.com; h=from:subject:message-id; bh=yFNNLmjNehCooP3I0EPzhGnpyJyZYCBQKljUMERA1Og=; b=owEB7QES/pANAwAKAfkogKziOh25AcsmYgBpXB72EMUC3Gmr+/bGYKVwWIEumX+3tWAfRNKch n9AJsL+KlmJAbMEAAEKAB0WIQQsIHxFLwpehxEbQ8r5KICs4joduQUCaVwe9gAKCRD5KICs4jod uZETDACve1MZUQJNUd+SJJdyn3iQVtcNgyVRO69EGOWKCpbqsNwDIC/hHgOEzdHcNJvcZo/QVBo JbOTUfnpXVW4MsITZ54Tqb/iCGQ42oWvobvQUD9D5OeNXSrSO6xFB7BcZMXClCWp3K0VzIV6Bz8 oYvd9XiumswpIXTo2k15m9SQ/ia9+zN8EEKxdn3ubpLtaVJdj5cgdJW0bVukUQXmpbCpm2t6f3p QSmgb4dM9hWPuzrmWYxYxRTMUZ+rlJUd/7y/7U5Mwzq0gFK5uY7KRY41llj0pY5dvO3wLVPAk8l 1/i/LI30Nc//t2h/b+V5v9cz5lbeDZ3Z2GZDbqjZ8k2kC0HqNW5l0t148Y6TFVskjVyO5Jva4xj 2ujqu6PAEFsRW9m81iHEd9cHLAYI9D9U7Ai42jqMcpowqY5iM5hnghiACEtKTMBDJyeebs/D9Dp bB0KnI5kuY7tXCVv3uTo/EN7LO7676sSobaE8exT22Po4ycpJHXWp8CSdp4d55d/FeSro= X-Developer-Key: i=wesley.hershberger@canonical.com; a=openpgp; fpr=2C207C452F0A5E87111B43CAF92880ACE23A1DB9 Message-ID-Hash: SWMTF6FNDKR7NK5EXVGK6PP2PIUKDI4U X-Message-ID-Hash: SWMTF6FNDKR7NK5EXVGK6PP2PIUKDI4U X-MailFrom: wesley.hershberger@canonical.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: wesley.hershberger@canonical.com, georgia.garcia@canonical.com, hector.cao@canonical.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: <> List-Archive: <> List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Wesley Hershberger via Devel Reply-To: Wesley Hershberger X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1767645604490158500 From: Serge Hallyn Just because a disk element only requests read access doesn't mean there may not be another readwrite request. Using 'R' when creating the apparmor rule will prevent an implicit write-deny rule to be created alongside. This does not mean write is allowed but it would cause a denial message and probably more relevant, allows to add write access later. Resolves: #622 Resolves: #806 Bug-Ubuntu: https://bugs.launchpad.net/bugs/1554031 Bug-Ubuntu: https://bugs.launchpad.net/bugs/1692441 Signed-off-by: Christian Ehrhardt Signed-off-by: Stefan Bader Signed-off-by: Wesley Hershberger Reviewed-by: Michal Privoznik --- src/security/virt-aa-helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index de0a826063..9598b95432 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -835,11 +835,11 @@ add_file_path(virStorageSource *src, =20 if (depth =3D=3D 0) { if (src->readonly) - ret =3D vah_add_file(buf, src->path, "rk"); + ret =3D vah_add_file(buf, src->path, "Rk"); else ret =3D vah_add_file(buf, src->path, "rwk"); } else { - ret =3D vah_add_file(buf, src->path, "rk"); + ret =3D vah_add_file(buf, src->path, "Rk"); } =20 if (ret !=3D 0) --=20 2.51.0 From nobody Mon Feb 2 07:31:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1767645718; cv=none; d=zohomail.com; s=zohoarc; b=PirzRboOwBL7rsVa3h5bKznoYgjT8OQXfbA18d55Uc7jPfpRYiIeDUe9VQSxd22ReV5HBxhftEQyghUQyRasSMtTvedYixUv630AYoWzhIv3xdruhJk8oKuxJ/YfKB4R6e9VKL2qYf62NjcGwjXa13jGT2wHGS8kkXb9nqLJNGg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1767645718; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Subject:Subject:To:To:Message-Id; bh=SZsx/ldHMEPCMcMtqFwsYmp4NIVR38n8S0hh7CYEcQE=; b=NEV0o7V1dPvTp2J3L+6/ww7b4UTbgaht9d2FR6ueszcYkkkcHb3IhjDfRL2mf9ysrD7NK0J1hgjSuccQqRBlPsa9JcoFXwwd6V3PNL4PIlsWwSdDXhd1PC6HDvT1AgVXJqA1G6U4wiNVaKG7O9A6k4jsnXHtMW+zQUnSH/COeDM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1767645718053836.4467046502757; Mon, 5 Jan 2026 12:41:58 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id 1CF9E3FD2A; Mon, 5 Jan 2026 15:41:55 -0500 (EST) Received: from [172.19.199.83] (lists.libvirt.org [8.43.85.245]) by lists.libvirt.org (Postfix) with ESMTP id 6FBF94198C; Mon, 5 Jan 2026 15:40:19 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id A41BA4192F; Mon, 5 Jan 2026 15:33:54 -0500 (EST) Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits)) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 8AAFD41939 for ; Mon, 5 Jan 2026 15:33:51 -0500 (EST) Received: from mail-yw1-f200.google.com (mail-yw1-f200.google.com [209.85.128.200]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 646C43FCF4 for ; Mon, 5 Jan 2026 20:28:44 +0000 (UTC) Received: by mail-yw1-f200.google.com with SMTP id 00721157ae682-78f9d077d9cso4688837b3.3 for ; Mon, 05 Jan 2026 12:28:44 -0800 (PST) Received: from r.lxd ([147.219.77.79]) by smtp.gmail.com with ESMTPSA id 00721157ae682-790aa57deacsm65117b3.20.2026.01.05.12.28.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 05 Jan 2026 12:28:42 -0800 (PST) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED, RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20251003; t=1767644924; bh=SZsx/ldHMEPCMcMtqFwsYmp4NIVR38n8S0hh7CYEcQE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=mZU1ZSQxX41KtDjQWPNp38Pp4ltE98HLJMOLnyhR/DmQR7HE25ngE9H/sYr1MIqhd HERymOHrSpNjyvSagBGcfz8VoCxY0NrLDEqk8dPYYQQeQrBFs7/VW7Xm1j5U/ZkG4c Oh6hPvgLYkUtNr0DmfNWgnVgQlqBGMeLLcMkEEMHfyXQaB1x6ZnshGBYnw8I3G016n cDuZr8g8Wn2RnjPprmsOS4omfH4RJ2yRhoNq/LZGHB1nfvaP03nzSETd0uWG3/kU+J bQ5tNnNjd+XDNCP5cB3ciBYfkDAZAzocJUT4pmC0qmpzVPjghEmIst2altLHaXtjHm 7ZHBcdaU7rMfEQGSemEfVVYUDX1lVX9eIBxsSM5hhopZbXqeTbp+0ch6OxquoX+PC1 4GJ5Yw9gQyUc63a9wTXd1sdJw7F1hcI6j3dRah7kuZmEbvN2vUKLXi88/uS7LcQIZG k6dCEWymUxLrfYmDliepYSELSN/bapRHG/c3JVDjuISoukWvo8cL0qVDbLAhXI0gP3 75j8OKq4GqgBbebGDnMzkb4L1HMktNjBJ86o37z8dFHaX+83T/cDKWlHpJZK47JBAz i0w+XyL/gkZ+dqN+6jh011UHwIVnqHCcETKNs/XYO/pKlgB3UzCNR7gB/UBc6omI+h LrekKyPNXPO7YP0psArfEgC8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767644923; x=1768249723; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=SZsx/ldHMEPCMcMtqFwsYmp4NIVR38n8S0hh7CYEcQE=; b=Oj2grcal8dRTWlQ4gqNGjF7xTxnmwq89SCGatQ11j1LGwIX2v3n40VxqWD8TzNhlyc Ky0JxSgQBST3a0I6wm3yMs9tkefRcqlmq1gg9v/DHQQNEu7Yk+oAj4D01vWOcdyQooab d7RTbxSx24MYjfGpjIAwxJdTxFGDNulHhWeKO+ihau0QKOZrSCyKNkalepm4ej1vFpf8 fVBp42wYtWoU2Ki4dEK3Eie93GniBpYCuWS3nPOsDUy61QITZIqEruuF5XEn5O4JPAah VB35xI32C3TuO1QXLXALxVbAkyyBlL3nF2TXaPnfk5iSmuDQeUyQjyhV9yxDZkKxVvd6 8fIQ== X-Gm-Message-State: AOJu0YxT/of1HDetxnDaD+vatNQSpSq3KqX4LKAK3LHEaFlBxddPCSco w2RnM8+RR5otEkzM8jDNQyx6kbhI1TdPPThVdW7GVfnOwfMg3lT6auO+xueHwvne+0HCtWNKAVz 8qzpJ4/1FQHWQfYnKT4CvLi5kn188KMVWw4uaLB1Wha8tyQmmMAorEqIIWIV+LyvSoJFMm5z56Z c= X-Gm-Gg: AY/fxX7+V9SQAJBCerr2Ic0mmWMyEH66tk34+maOjLeAKwAmr08PQJaVqnH0xJFNocv qeCqZ+FVH6jSGHc1KAZgnY+p0+z4dPYcSHl8B2S6fmt+TlOXA/72EwXpR2P66ZmZh8DMj1XT2HI u7DfMzJh4PquIdg2eKI7nVS41f26meOSdv7XltMZm3HpGp73011y1uuflyMOlqC8kqhHGWBVDTC zyqLUhchOPeNOfHHfrXe57sTeHFrSr1f8EgAQW/wjDpNNPn7Mbun5bulI/1Ll7Lu5mMy7ntPwV4 byOmcNLcK8J11LsHzH+fnfQ0lOR8+WIXgVV8s47fygLG5fPd3nA/SrGKjCujJKpQU+ttymsyea6 U0gX8qRnCtTT8jRMT X-Received: by 2002:a05:690c:4483:b0:788:763:17bd with SMTP id 00721157ae682-790a8b60e60mr7584517b3.60.1767644923379; Mon, 05 Jan 2026 12:28:43 -0800 (PST) X-Google-Smtp-Source: AGHT+IG2BsGrSBcA2mzVEgektvwh/Vi8vVN4BvGeIZfVoRjintIOTQQ1JDgC9ipCwr+MME8L8ifYYw== X-Received: by 2002:a05:690c:4483:b0:788:763:17bd with SMTP id 00721157ae682-790a8b60e60mr7584337b3.60.1767644923001; Mon, 05 Jan 2026 12:28:43 -0800 (PST) Date: Mon, 05 Jan 2026 14:27:22 -0600 Subject: [PATCH 2/3] qemu: Store tapfd path in domstatus XML MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260105-apparmor-races-v1-2-932cf0e990b7@canonical.com> References: <20260105-apparmor-races-v1-0-932cf0e990b7@canonical.com> In-Reply-To: <20260105-apparmor-races-v1-0-932cf0e990b7@canonical.com> To: devel@lists.libvirt.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=4866; i=wesley.hershberger@canonical.com; h=from:subject:message-id; bh=QAXKvQbSh1d3iAoU7CRUFNr35WabcbyuGzCokXoOfww=; b=owEB7QES/pANAwAKAfkogKziOh25AcsmYgBpXB73DFuODKrX0SUdcAHB6d/hXSZPqgpAUiqnY CBwtEQuFf+JAbMEAAEKAB0WIQQsIHxFLwpehxEbQ8r5KICs4joduQUCaVwe9wAKCRD5KICs4jod uSohC/9w227QFLgiNQS8UMWyfZLfjF1wilm0rxUO7RfDnPaJxEgf0M6QxMNRvGof57lOKB0JmSx lxqom0KTwJnQmPjtXMiIxtZO4YUgXRLW8+dQinZEp4/rF/3Y7MCbr2j/kjWC+9gA4AQjGVHmFsE zeijR79I5/2w/im9oBJDL8gLMa2HqP50asgWnoD8w2tDvX369tmWfEFpecZmP1l97IXfvAgp4du csNEb2iG2L1BNFwvEDGyFWoiFNGDCdgkk13lF8wuAXwC1GUl5szAhz2qQ1pyNvaihnZyGk13Hyf Ynsp0Plgv86gCf5rsZUJ0zj8WMDyiOhpzT3kg0pOc00eKM4nhV5hIXDsM9IDUsscO5/EtsmZh3d 7+EtrezeV7IyppL5TQn9CWI50kf7rpzIWVPftimG/Fm8cl00Smq1IE1UEcxWAOl3uN4oQEZN5sI 8efD9jgJ1wmfa9FVJ3C4uZWEgPIfxxeeHnhGLjLzoVBWr97FwNv4NTOE+4hYSQ4VLoQJQ= X-Developer-Key: i=wesley.hershberger@canonical.com; a=openpgp; fpr=2C207C452F0A5E87111B43CAF92880ACE23A1DB9 Message-ID-Hash: HOJZ5XHGJOJ6FBHN3TTYTP6GGKMPRO24 X-Message-ID-Hash: HOJZ5XHGJOJ6FBHN3TTYTP6GGKMPRO24 X-MailFrom: wesley.hershberger@canonical.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: wesley.hershberger@canonical.com, georgia.garcia@canonical.com, hector.cao@canonical.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Wesley Hershberger via Devel Reply-To: Wesley Hershberger X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1767645718473158500 Introduce a read-only `tapfd` element for interfaces of type network, bridge, direct, and ethernet, which contains the path in `/dev` to the backing tapfd for that interface. The element is only included when the domain is being formatted for internal consumption (VIR_DOMAIN_DEF_FORMAT_STATUS) and is not accepted in user-provided XML (!VIR_DOMAIN_DEF_PARSE_INACTIVE). This is used by the AppArmor security driver when re-generating profiles. Partial-Resolves: #692 Bug-Ubuntu: https://bugs.launchpad.net/bugs/2126574 Signed-off-by: Wesley Hershberger --- src/conf/domain_conf.c | 10 ++++++++++ src/conf/domain_conf.h | 1 + src/qemu/qemu_command.c | 9 +++++++++ src/security/security_apparmor.c | 1 + src/security/virt-aa-helper.c | 5 +++++ 5 files changed, 26 insertions(+) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 541dad5bdc..bfeed3dc96 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -2936,6 +2936,9 @@ virDomainNetDefFree(virDomainNetDef *def) g_free(def->virtio); g_free(def->coalesce); g_free(def->sourceDev); + if (def->tapfdpath) { + g_free(def->tapfdpath); + } =20 virNetDevIPInfoClear(&def->guestIP); virNetDevIPInfoClear(&def->hostIP); @@ -10427,6 +10430,10 @@ virDomainNetDefParseXML(virDomainXMLOption *xmlopt, return NULL; } =20 + if (!(flags & VIR_DOMAIN_DEF_PARSE_INACTIVE)) { + def->tapfdpath =3D virXPathString("string(./tapfd/@path)", ctxt); + } + if (virNetworkPortOptionsParseXML(ctxt, &def->isolatedPort) < 0) return NULL; =20 @@ -25596,6 +25603,9 @@ virDomainNetDefFormat(virBuffer *buf, if (def->mtu) virBufferAsprintf(buf, "\n", def->mtu); =20 + if (def->tapfdpath && (flags & VIR_DOMAIN_DEF_FORMAT_STATUS)) + virBufferAsprintf(buf, "\n", def->tapfdpath); + virDomainNetDefCoalesceFormatXML(buf, def->coalesce); =20 virDomainDeviceInfoFormat(buf, &def->info, flags | VIR_DOMAIN_DEF_FORM= AT_ALLOW_BOOT diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index cb35ff06bd..cadbc3e36d 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1201,6 +1201,7 @@ struct _virDomainNetDef { char *downscript; char *domain_name; /* backend domain name */ char *ifname; /* interface name on the host () */ + char *tapfdpath; /* Path for the device's tapfd in /dev on the host */ virTristateBool managed_tap; virNetDevIPInfo hostIP; char *ifname_guest_actual; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 98229d7cf9..96352821d7 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -8880,9 +8880,18 @@ qemuBuildInterfaceConnect(virDomainObj *vm, =20 for (i =3D 0; i < tapfdSize; i++) { g_autofree char *name =3D g_strdup_printf("tapfd-%s%zu", net->= info.alias, i); + g_autofree char *procpath =3D NULL; int fd =3D tapfd[i]; /* we want to keep the array intact for s= ecurity labeling*/ =20 netpriv->tapfds =3D g_slist_prepend(netpriv->tapfds, qemuFDPas= sDirectNew(name, &fd)); + + /* Include tapfd path in the domstatus XML */ + procpath =3D g_strdup_printf("/proc/self/fd/%d", tapfd[i]); + + if (virFileResolveLink(procpath, &net->tapfdpath) < 0) { + /* it's a deleted file, presumably. Ignore? */ + VIR_WARN("could not find path for descriptor %s, skipping"= , procpath); + } } =20 netpriv->tapfds =3D g_slist_reverse(netpriv->tapfds); diff --git a/src/security/security_apparmor.c b/src/security/security_appar= mor.c index 68ac39611f..13dbce67c3 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -156,6 +156,7 @@ load_profile(virSecurityManager *mgr G_GNUC_UNUSED, =20 if (virDomainDefFormatInternal(def, NULL, &buf, VIR_DOMAIN_DEF_FORMAT_SECURE | + VIR_DOMAIN_DEF_FORMAT_STATUS | VIR_DOMAIN_DEF_FORMAT_VOLUME_TRANSLATED= ) < 0) return -1; =20 diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 9598b95432..7920162cdc 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1174,6 +1174,11 @@ get_files(vahControl * ctl) vhu->type) !=3D 0) return -1; } + + if (net->tapfdpath) { + if (vah_add_file(&buf, net->tapfdpath, "rwk") !=3D 0) + return -1; + } } =20 for (i =3D 0; i < ctl->def->nmems; i++) { --=20 2.51.0 From nobody Mon Feb 2 07:31:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1767645979; cv=none; d=zohomail.com; s=zohoarc; b=GVpwv6sLWY/Rz5qenLNg/ALNU6D60MB4iAlCkprRQajD3EyGgRf7iHajH6IuKsOQ1Hb+umgvh0yiYlmpliq03lM6NWVZsa38L/aLMHrfah/oDutXUd8TZ0oCsqcDz13bEwnp+Sz/9aQ4knqNc3hXJ8TY9lLhPUFyIC/X7DST0So= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1767645979; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Subject:Subject:To:To:Message-Id; bh=qd2feiETYGSmELbxNS0ZwB2ccSr1fDwct/4WrLDuphQ=; b=Ty6I1qcnQZ39typS48IISiMcoEhr4GMsqx/kitUHD2KPwAtot/VOgVk22S44LjmxefRQqcvbJYPTia9xbTm87K0M1MV6Sp+RozfLnbgl2pWtfa6/tq4NHMGwR2u7g/y0rtoEoQbMcMpF6Yg4IhhPevuUQo0zPkJVcBSNaBf7KRc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 176764597980862.76732230127686; Mon, 5 Jan 2026 12:46:19 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id E13883F390; Mon, 5 Jan 2026 15:46:18 -0500 (EST) Received: from [172.19.199.83] (lists.libvirt.org [8.43.85.245]) by lists.libvirt.org (Postfix) with ESMTP id 7BE0641B53; Mon, 5 Jan 2026 15:44:13 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 753E041933; Mon, 5 Jan 2026 15:35:03 -0500 (EST) Received: from smtp-relay-internal-1.canonical.com (smtp-relay-internal-1.canonical.com [185.125.188.123]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits)) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 3F5ED4192F for ; Mon, 5 Jan 2026 15:34:58 -0500 (EST) Received: from mail-yx1-f71.google.com (mail-yx1-f71.google.com [74.125.224.71]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 541603F856 for ; Mon, 5 Jan 2026 20:28:45 +0000 (UTC) Received: by mail-yx1-f71.google.com with SMTP id 956f58d0204a3-6447a801fbaso456636d50.2 for ; Mon, 05 Jan 2026 12:28:45 -0800 (PST) Received: from r.lxd ([147.219.77.79]) by smtp.gmail.com with ESMTPSA id 00721157ae682-790aa57deacsm65117b3.20.2026.01.05.12.28.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 05 Jan 2026 12:28:43 -0800 (PST) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_DNSWL_MED,RCVD_IN_VALIDITY_CERTIFIED_BLOCKED, RCVD_IN_VALIDITY_RPBL_BLOCKED,RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20251003; t=1767644925; bh=qd2feiETYGSmELbxNS0ZwB2ccSr1fDwct/4WrLDuphQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=tRZ+Ube+wTWviGpCnI6U0ydBqKyQMuKx92UTukDptxubtiy3gVuxyifcIQU45AI0O BV6yeEs/1BwHwwTFkdfbCUHGavmKtbSkqpeuMFWS2V9ZwMBAgoB/C/fT7UuILbP6P6 IsokHxwrh2DTcXNQJGWVO2dBgEvg5ReDewuMWBFrFyQJ6bk40UC8yFLf9N2qwimhxs Y6QWT82jYHLRlvHFUnOPqwKWPwiQD+uTQv61NVQqgYxxOzlS6usZJk4rcTc40jJ1AX uEXQo0nK0gTZ3oCXl+mUQqkno7F0dXMa5+gBxrBpxcTehUNpS9PlT5VmSxQMCeUhx3 CQgLtGgL9KDBCN3R81tYNAk0CCEAvOF3zCg+qRKcf8cs8txamvT1abPYudhvEFoa3B j5M2an8+0XRkXPYnwpxp84HcvBEZfde4CczxEGJRKM6nlVHequNJSdJ9hhXWk8rkDY blw7myu7ZzXa8mWu80rq7m7iyA8mRdqqTuBOFeuS6QdjdHLbxIGcE8pu35FIgEgTF/ RpOQls2nacxvhX5IT13wtTeqEhHG3aL+3MIwIJlwss4pWnqJ3kF0k0D9eVx6h1QWfK nDto6HkLd0fQzK6AKCJlWHP9U2DRrVx90lHdp6OfbyRPy+Akyii+rbD0ODv+n0A4zr 16jD4Hq5VO55ItMxi2Phpack= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767644924; x=1768249724; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=qd2feiETYGSmELbxNS0ZwB2ccSr1fDwct/4WrLDuphQ=; b=IrMJZI+BN+ah0ixSyk7ebVMwgFDM3yufifbS5ik1qcXUImgCrAiM7ZWb2mBzNdu5Wa ZdVunbnEZH5LpnY7EuJSrv06W2E4Fk8CGzPZ85HShbEjVnF7sc+/9xK949yCwMhvNBco itWEU2uVh1+1UCeTH1cT2JF+4Ab57+XkPD/XaF9brq3FDjOrEfDLyHcXPaFlXLg9pd9O mJRDb/dZzeA22rj9Ga0rv2mQ2fCzptu+y+0fz7mZHoXr1BqQVneVB4vDEP3nkfIuhUi+ zMzYg/MfxXmuLAOifsJtXyHN/QX/2wJE1THN4RwBl8w/ry/TRhcrN1nRB7O+Ej/Lm6ZE sCiw== X-Gm-Message-State: AOJu0YxvRFISPf7d7/zGHz/1Ux8BgsyMveBd6L2uztJy4amnRw058bMv Iyd/YM4hg0GyY+bsTNNVy5pmks1bqS8YPaYCNSy/UX4yk8mAh8wCef/L8Sb0pukKoCMAA7Oskj4 wbl1317noWhkx4Ax9NsyL9xyLoQP5nM5AoWvCBdiL70XU7VlaqWRY7Jd7ox4TpdWMolKLaHivvb A= X-Gm-Gg: AY/fxX6vhlCxTBP6bi6IpM01GMUHPg5EZfeMpdTl+8d+8ZaVmtY4XmQO9bI3T2eB6oc HDDrB/MyfzZ2X/+z6/jGNMeZTqZn/nqbhUrXuWwzFrOlh9WdBHi1DM5DWSSAqS4C8o9uIY+0YbP VSRLU2TIEWxx8NPOpXCFdpcWpsmE1mb7eRDQbjIwxFtlyRJPmYFum7hOweXoE+sBAeRnYmtU+W6 IT6URGtVL5KeFjFfFnlrR8XBlZytr0K8t0wavcXosBvWPAIDkMyOM0o/79lolIn7djIXYlLCmzn fFg6s/MjKqX8Cn3I4smvUqXzpckHKlj2hJt+o6SbDpqqnEK4p+9q9/7etkuL/DWy597ef5PUYV5 mT5EHYXyb7mwQDgRU X-Received: by 2002:a05:690e:1503:b0:646:90aa:bc3d with SMTP id 956f58d0204a3-6470c868276mr689627d50.31.1767644924273; Mon, 05 Jan 2026 12:28:44 -0800 (PST) X-Google-Smtp-Source: AGHT+IHAg3qsWd4SugAvseUChZF8nDOlEveqgBUR7vt4Zw1g1eoUwgYCqvyL63tIf/qvGI53S5Eahg== X-Received: by 2002:a05:690e:1503:b0:646:90aa:bc3d with SMTP id 956f58d0204a3-6470c868276mr689605d50.31.1767644923856; Mon, 05 Jan 2026 12:28:43 -0800 (PST) Date: Mon, 05 Jan 2026 14:27:23 -0600 Subject: [PATCH 3/3] qemu: Store blockcommit permissions in domstatus XML MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260105-apparmor-races-v1-3-932cf0e990b7@canonical.com> References: <20260105-apparmor-races-v1-0-932cf0e990b7@canonical.com> In-Reply-To: <20260105-apparmor-races-v1-0-932cf0e990b7@canonical.com> To: devel@lists.libvirt.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=8267; i=wesley.hershberger@canonical.com; h=from:subject:message-id; bh=ear3/rli5we/eENa9L1JP2NzXJd696GBj5T+KPUTBSI=; b=owEB7QES/pANAwAKAfkogKziOh25AcsmYgBpXB73qAvWWV8/BUjF7y8pCZbvGN2XKWQMdoxMm qb/nW7t6t2JAbMEAAEKAB0WIQQsIHxFLwpehxEbQ8r5KICs4joduQUCaVwe9wAKCRD5KICs4jod uT0dC/44Zycmp+BlDPlc5TF/ENni1EXu4aB75SA0CUZlhcjDmLXJAA2ExChcVc2RC1BazpBAmqw zZosvo3H+17rdmZNOQgkRq4BBFRyQqaYfkyZMPH0HCLon+R/P8M4mngPc/ke2ulEA9200l0vuqs B92Zjt1sUnJmHX5+mVFtpfKi2SPqSFCTS/NcLLBlpmuA54FpTM9jAdhPMFM7U0gcIe98RzWQfAh WJiGakFHRccea4g3Q258orAGtnaJgzmV0Q6Muk2WksejkXvVPy+p92sHZZ9vZ5NDupFzG2D1ilR J3Gn34P7y0UwvTfL8PTqj/ajmCRe1QbyH2M0SOKAo1BhxpHBQVp8AWc87LgzllegVjPN8kCJRHt p0sGuWmfnaRTN4+JOE18evUTijVcIyU8TCFz3624ov0//oafdwH4V4hmBtpiQ+8M+3hBIBS2FSX Db4klL1jV8Tsyx4Z7GsQr6SiZB97ZZXPxDCVDT/hLFLXN/w4vkSkhjGg+rhu2wadx6Bwg= X-Developer-Key: i=wesley.hershberger@canonical.com; a=openpgp; fpr=2C207C452F0A5E87111B43CAF92880ACE23A1DB9 Message-ID-Hash: XZJLPDAFBV62FKNBMA2SCTRTXKP5LTQ6 X-Message-ID-Hash: XZJLPDAFBV62FKNBMA2SCTRTXKP5LTQ6 X-MailFrom: wesley.hershberger@canonical.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: wesley.hershberger@canonical.com, georgia.garcia@canonical.com, hector.cao@canonical.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Wesley Hershberger via Devel Reply-To: Wesley Hershberger X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1767645981782158500 Adds a read-only attribute allowWrite to a disk's backingStore source element for the duration of a block commit operation, which records that write access is needed for that backingStore. This is used by the AppArmor security driver when re-generating profiles. Partial-Resolves: #692 Bug-Ubuntu: https://bugs.launchpad.net/bugs/2126574 Signed-off-by: Wesley Hershberger --- src/conf/domain_conf.c | 7 +++++++ src/conf/storage_source_conf.c | 2 ++ src/conf/storage_source_conf.h | 3 +++ src/qemu/qemu_block.c | 26 ++++++++++++++++++++++++++ src/qemu/qemu_blockjob.c | 8 ++++++++ src/qemu/qemu_security.c | 7 +++++++ src/security/virt-aa-helper.c | 7 ++----- 7 files changed, 55 insertions(+), 5 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index bfeed3dc96..02ff45626e 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -7842,6 +7842,10 @@ virDomainStorageSourceParse(xmlNodePtr node, return -1; } =20 + if (!(flags & VIR_DOMAIN_DEF_PARSE_INACTIVE) && + g_strcmp0(virXMLPropString(node, "allowWrite"), "yes") =3D=3D 0) + src->secAllowWrite =3D true; + if ((tmp =3D virXPathNode("./auth", ctxt)) && !(src->auth =3D virStorageAuthDefParse(tmp, ctxt))) return -1; @@ -23753,6 +23757,9 @@ virDomainDiskSourceFormat(virBuffer *buf, if (attrIndex && src->id !=3D 0) virBufferAsprintf(&attrBuf, " index=3D'%u'", src->id); =20 + if ((flags & VIR_DOMAIN_DEF_FORMAT_STATUS) && src->secAllowWrite) + virBufferAddLit(&attrBuf, " allowWrite=3D'yes'"); + if (virDomainDiskDataStoreFormat(&childBuf, src, xmlopt, flags) < 0) return -1; =20 diff --git a/src/conf/storage_source_conf.c b/src/conf/storage_source_conf.c index 087de1eaf2..4550a25500 100644 --- a/src/conf/storage_source_conf.c +++ b/src/conf/storage_source_conf.c @@ -911,6 +911,8 @@ virStorageSourceCopy(const virStorageSource *src, def->nfs_uid =3D src->nfs_uid; def->nfs_gid =3D src->nfs_gid; =20 + def->secAllowWrite =3D src->secAllowWrite; + /* 'ioerror_timestamp' and 'ioerror_message' are deliberately not copi= ed */ =20 return g_steal_pointer(&def); diff --git a/src/conf/storage_source_conf.h b/src/conf/storage_source_conf.h index fc868b31af..0a54ff8c9c 100644 --- a/src/conf/storage_source_conf.h +++ b/src/conf/storage_source_conf.h @@ -449,6 +449,9 @@ struct _virStorageSource { * to do this decision. */ bool seclabelSkipRemember; + /* Temporary write access to this source is required (currently only f= or + * QEMU blockcommit) */ + bool secAllowWrite; =20 /* Last instance of hypervisor originated I/O error message and timest= amp. * The error stored here is not designed to be stable. The message diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c index a7062d3e96..3aed5d5a7f 100644 --- a/src/qemu/qemu_block.c +++ b/src/qemu/qemu_block.c @@ -3763,6 +3763,20 @@ qemuBlockCommit(virDomainObj *vm, * operation succeeds, but doing that requires tracking the * operation in XML across libvirtd restarts. */ clean_access =3D true; + + /* Ensure needed perms are present in domstatus XML; this prevents rac= es + * in the AppArmor secdriver */ + baseSource->secAllowWrite =3D true; + if (baseSource->dataFileStore) + baseSource->dataFileStore->secAllowWrite =3D true; + if (top_parent && top_parent !=3D disk->src) { + top_parent->secAllowWrite =3D true; + if (top_parent->dataFileStore) + top_parent->dataFileStore->secAllowWrite =3D true; + } + + qemuDomainSaveStatus(vm); + if (qemuDomainStorageSourceAccessAllow(driver, vm, baseSource, false, false, false) < 0) goto cleanup; @@ -3838,6 +3852,18 @@ qemuBlockCommit(virDomainObj *vm, virErrorPtr orig_err; virErrorPreserveLast(&orig_err); =20 + /* Revert changes to domstatus XML */ + baseSource->secAllowWrite =3D false; + if (baseSource->dataFileStore) + baseSource->dataFileStore->secAllowWrite =3D false; + if (top_parent && top_parent !=3D disk->src) { + top_parent->secAllowWrite =3D false; + if (top_parent->dataFileStore) + top_parent->dataFileStore->secAllowWrite =3D false; + } + + qemuDomainSaveStatus(vm); + /* Revert access to read-only, if possible. */ if (baseSource->dataFileStore) { qemuDomainStorageSourceAccessAllow(driver, vm, baseSource->dat= aFileStore, diff --git a/src/qemu/qemu_blockjob.c b/src/qemu/qemu_blockjob.c index b54a5b3811..97a6afe7e3 100644 --- a/src/qemu/qemu_blockjob.c +++ b/src/qemu/qemu_blockjob.c @@ -1065,20 +1065,24 @@ qemuBlockJobProcessEventCompletedCommit(virQEMUDriv= er *driver, =20 /* revert access to images */ if (job->data.commit.base->dataFileStore) { + job->data.commit.base->dataFileStore->secAllowWrite =3D false; qemuDomainStorageSourceAccessAllow(driver, vm, job->data.commit.ba= se->dataFileStore, true, false, false); qemuBlockReopenReadOnly(vm, job->data.commit.base->dataFileStore, = asyncJob); } + job->data.commit.base->secAllowWrite =3D false; qemuDomainStorageSourceAccessAllow(driver, vm, job->data.commit.base, true, false, false); =20 if (job->data.commit.topparent !=3D job->disk->src) { if (job->data.commit.topparent->dataFileStore) { + job->data.commit.topparent->dataFileStore->secAllowWrite =3D f= alse; qemuDomainStorageSourceAccessAllow(driver, vm, job->data.commi= t.topparent->dataFileStore, true, false, false); =20 qemuBlockReopenReadWrite(vm, job->data.commit.topparent->dataF= ileStore, asyncJob); } + job->data.commit.topparent->secAllowWrite =3D false; qemuDomainStorageSourceAccessAllow(driver, vm, job->data.commit.to= pparent, true, false, true); } @@ -1177,6 +1181,10 @@ qemuBlockJobProcessEventCompletedActiveCommit(virQEM= UDriver *driver, baseparent->backingStore =3D NULL; job->disk->src =3D job->data.commit.base; job->disk->src->readonly =3D job->data.commit.top->readonly; + job->disk->src->secAllowWrite =3D false; + if (job->disk->src->dataFileStore) { + job->disk->src->dataFileStore->secAllowWrite =3D false; + } =20 if (qemuBlockJobProcessEventCompletedCommitBitmaps(vm, job, asyncJob) = < 0) return; diff --git a/src/qemu/qemu_security.c b/src/qemu/qemu_security.c index 6bb0f9170d..603feba87e 100644 --- a/src/qemu/qemu_security.c +++ b/src/qemu/qemu_security.c @@ -201,6 +201,13 @@ qemuSecurityMoveImageMetadata(virQEMUDriver *driver, if (qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT)) pid =3D vm->pid; =20 + if (dst) { + dst->secAllowWrite =3D src->secAllowWrite; + if (dst->backingStore && src->backingStore) { + dst->backingStore->secAllowWrite =3D src->backingStore->secAll= owWrite; + } + } + return virSecurityManagerMoveImageMetadata(driver->securityManager, cfg->sharedFilesystems, pid, src, dst); diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 7920162cdc..fc2d4d9d41 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -833,11 +833,8 @@ add_file_path(virStorageSource *src, if (!src->path || !virStorageSourceIsLocalStorage(src)) return 0; =20 - if (depth =3D=3D 0) { - if (src->readonly) - ret =3D vah_add_file(buf, src->path, "Rk"); - else - ret =3D vah_add_file(buf, src->path, "rwk"); + if ((depth =3D=3D 0 && !src->readonly) || src->secAllowWrite) { + ret =3D vah_add_file(buf, src->path, "rwk"); } else { ret =3D vah_add_file(buf, src->path, "Rk"); } --=20 2.51.0