From: Jamie Strandboge <jamie@ubuntu.com>

Bug-Ubuntu: https://bugs.launchpad.net/bugs/591769

Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
---
 examples/apparmor/usr.lib.libvirt.virt-aa-helper | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/examples/apparmor/usr.lib.libvirt.virt-aa-helper b/examples/apparmor/usr.lib.libvirt.virt-aa-helper
index bd6181d..d63c844 100644
--- a/examples/apparmor/usr.lib.libvirt.virt-aa-helper
+++ b/examples/apparmor/usr.lib.libvirt.virt-aa-helper
@@ -47,6 +47,10 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper {
   audit deny @{HOME}/bin/** mrwkl,
   @{HOME}/ r,
   @{HOME}/** r,
+  # Alow access to ecryptfs files (LP: #591769)
+  @{HOME}/.Private/** mrwlk,
+  @{HOMEDIRS}/.ecryptfs/*/.Private/** mrwlk,
+
   /var/lib/libvirt/images/ r,
   /var/lib/libvirt/images/** r,
   /{media,mnt,opt,srv}/** r,
-- 
2.7.4

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

On Tue, 2017-12-19 at 16:03 +0100, Christian Ehrhardt wrote:
> From: Jamie Strandboge <jamie@ubuntu.com>
> 
> Bug-Ubuntu: https://bugs.launchpad.net/bugs/591769
> 
> Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
> ---
>  examples/apparmor/usr.lib.libvirt.virt-aa-helper | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/examples/apparmor/usr.lib.libvirt.virt-aa-helper
> b/examples/apparmor/usr.lib.libvirt.virt-aa-helper
> index bd6181d..d63c844 100644
> --- a/examples/apparmor/usr.lib.libvirt.virt-aa-helper
> +++ b/examples/apparmor/usr.lib.libvirt.virt-aa-helper
> @@ -47,6 +47,10 @@ profile virt-aa-helper
> /usr/{lib,lib64}/libvirt/virt-aa-helper {
>    audit deny @{HOME}/bin/** mrwkl,
>    @{HOME}/ r,
>    @{HOME}/** r,
> +  # Alow access to ecryptfs files (LP: #591769)
> +  @{HOME}/.Private/** mrwlk,
> +  @{HOMEDIRS}/.ecryptfs/*/.Private/** mrwlk,
> +

Hrmm, these rules were never meant to last as long as they have. That
said, they are already a part of the AppArmor base abstraction (using
owner match though) and virt-aa-helper uses '#include
<abstractions/base>'. Are these rules still needed considering the base
abstraction? I imagine at worst virt-aa-helper would only need 'r' for
some of these...

-- 
Jamie Strandboge             | http://www.canonical.com--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Jamie Strandboge:
> On Tue, 2017-12-19 at 16:03 +0100, Christian Ehrhardt wrote:
>> +  # Alow access to ecryptfs files (LP: #591769)
>> +  @{HOME}/.Private/** mrwlk,
>> +  @{HOMEDIRS}/.ecryptfs/*/.Private/** mrwlk,

> Hrmm, these rules were never meant to last as long as they have. That
> said, they are already a part of the AppArmor base abstraction (using
> owner match though) and virt-aa-helper uses '#include
> <abstractions/base>'. Are these rules still needed considering the base
> abstraction? I imagine at worst virt-aa-helper would only need 'r' for
> some of these...

I concur with Jamie: I'd rather can avoid spreading copies of these
rules around if we can.

Cheers,
-- 
intrigeri

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

On Wed, Dec 20, 2017 at 10:50 AM, intrigeri <intrigeri+libvirt@boum.org> wrote:
> Jamie Strandboge:
>> On Tue, 2017-12-19 at 16:03 +0100, Christian Ehrhardt wrote:
>>> +  # Alow access to ecryptfs files (LP: #591769)
>>> +  @{HOME}/.Private/** mrwlk,
>>> +  @{HOMEDIRS}/.ecryptfs/*/.Private/** mrwlk,
>
>> Hrmm, these rules were never meant to last as long as they have. That
>> said, they are already a part of the AppArmor base abstraction (using
>> owner match though) and virt-aa-helper uses '#include
>> <abstractions/base>'. Are these rules still needed considering the base
>> abstraction? I imagine at worst virt-aa-helper would only need 'r' for
>> some of these...
>
> I concur with Jamie: I'd rather can avoid spreading copies of these
> rules around if we can.

Checked as well - no more needed.
Thanks for the hint I missed that those were moved into the base abstraction.

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list