On Mon, Aug 13, 2018 at 7:11 PM Jamie Strandboge <[email protected]> wrote:
> On Mon, 2018-08-13 at 16:39 +0200, Christian Ehrhardt wrote: > > Libvirt now tries to preserve all mounts under /dev in qemu > > namespaces. > > The old rules only listed a set of known paths but those are no more > > enough. > > > > I found some due to containers like /dev/.lxc/* and such but also > > /dev/console > > and /dev/net/tun. > > > > Libvirt is correct to do so, but we can no more predict the names > > properly, so > > we modify the rule to allow a wildcard based pattern matching what > > libvirt does. > > > > Signed-off-by: Christian Ehrhardt <[email protected]> > > --- > > examples/apparmor/usr.sbin.libvirtd | 16 +++++----------- > > 1 file changed, 5 insertions(+), 11 deletions(-) > > > > diff --git a/examples/apparmor/usr.sbin.libvirtd > > b/examples/apparmor/usr.sbin.libvirtd > > index 3ff43c32a2..b2e38fe0ad 100644 > > --- a/examples/apparmor/usr.sbin.libvirtd > > +++ b/examples/apparmor/usr.sbin.libvirtd > > @@ -33,17 +33,11 @@ > > mount options=(rw,rslave) -> /, > > mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/, > > > > - mount options=(rw, move) /dev/ -> > > /{var/,}run/libvirt/qemu/*.dev/, > > - mount options=(rw, move) /dev/hugepages/ -> > > /{var/,}run/libvirt/qemu/*.hugepages/, > > - mount options=(rw, move) /dev/mqueue/ -> > > /{var/,}run/libvirt/qemu/*.mqueue/, > > - mount options=(rw, move) /dev/pts/ -> > > /{var/,}run/libvirt/qemu/*.pts/, > > - mount options=(rw, move) /dev/shm/ -> > > /{var/,}run/libvirt/qemu/*.shm/, > > - > > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> > > /dev/, > > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.hugepages/ -> > > /dev/hugepages/, > > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.mqueue/ -> > > /dev/mqueue/, > > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.pts/ -> > > /dev/pts/, > > - mount options=(rw, move) /{var/,}run/libvirt/qemu/*.shm/ -> > > /dev/shm/, > > + # libvirt provides any mounts under /dev to qemu namespaces > > + mount options=(rw, move) /dev/ -> /{var/,}run/libvirt/qemu/*.dev/, > > + mount options=(rw, move) /dev/**{/,} -> > > /{var/,}run/libvirt/qemu/*{/,}, > > What are you trying to convey with this rule? As written, the '{/,}' is > redundant since '**' will match that. > I had issues on the other end, with different paths being accessed with/without trailing slash /{var/,}run/libvirt/qemu/*{/,}, So I added the trailing "with or without slash" part. You are right, on the other end due to the unpredictable path I already had ** which will cover the trailing slash. I can do a V2 without the trailing part on the side that has the "**" already > > + mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> /dev/, > > + mount options=(rw, move) /{var/,}run/libvirt/qemu/*{/,} -> > > /dev/**{/,}, > > ditto > > -- > Jamie Strandboge | http://www.canonical.com -- Christian Ehrhardt Software Engineer, Ubuntu Server Canonical Ltd
-- libvir-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/libvir-list
