Libvirt now tries to preserve all mounts under /dev in qemu namespaces.
The old rules only listed a set of known paths but those are no more enough.

I found some due to containers like /dev/.lxc/* and such but also /dev/console
and /dev/net/tun.

Libvirt is correct to do so, but we can no more predict the names properly, so
we modify the rule to allow a wildcard based pattern matching what libvirt does.

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
---
 examples/apparmor/usr.sbin.libvirtd | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd
index 3ff43c32a2..b2e38fe0ad 100644
--- a/examples/apparmor/usr.sbin.libvirtd
+++ b/examples/apparmor/usr.sbin.libvirtd
@@ -33,17 +33,11 @@
   mount options=(rw,rslave)  -> /,
   mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/,
 
-  mount options=(rw, move) /dev/           -> /{var/,}run/libvirt/qemu/*.dev/,
-  mount options=(rw, move) /dev/hugepages/ -> /{var/,}run/libvirt/qemu/*.hugepages/,
-  mount options=(rw, move) /dev/mqueue/    -> /{var/,}run/libvirt/qemu/*.mqueue/,
-  mount options=(rw, move) /dev/pts/       -> /{var/,}run/libvirt/qemu/*.pts/,
-  mount options=(rw, move) /dev/shm/       -> /{var/,}run/libvirt/qemu/*.shm/,
-
-  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/       -> /dev/,
-  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.hugepages/ -> /dev/hugepages/,
-  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.mqueue/    -> /dev/mqueue/,
-  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.pts/       -> /dev/pts/,
-  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.shm/       -> /dev/shm/,
+  # libvirt provides any mounts under /dev to qemu namespaces
+  mount options=(rw, move) /dev/ -> /{var/,}run/libvirt/qemu/*.dev/,
+  mount options=(rw, move) /dev/**{/,} -> /{var/,}run/libvirt/qemu/*{/,},
+  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> /dev/,
+  mount options=(rw, move) /{var/,}run/libvirt/qemu/*{/,} -> /dev/**{/,},
 
   network inet stream,
   network inet dgram,
-- 
2.17.1

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

On Mon, 2018-08-13 at 16:39 +0200, Christian Ehrhardt wrote:
> Libvirt now tries to preserve all mounts under /dev in qemu
> namespaces.
> The old rules only listed a set of known paths but those are no more
> enough.
> 
> I found some due to containers like /dev/.lxc/* and such but also
> /dev/console
> and /dev/net/tun.
> 
> Libvirt is correct to do so, but we can no more predict the names
> properly, so
> we modify the rule to allow a wildcard based pattern matching what
> libvirt does.
> 
> Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
> ---
>  examples/apparmor/usr.sbin.libvirtd | 16 +++++-----------
>  1 file changed, 5 insertions(+), 11 deletions(-)
> 
> diff --git a/examples/apparmor/usr.sbin.libvirtd
> b/examples/apparmor/usr.sbin.libvirtd
> index 3ff43c32a2..b2e38fe0ad 100644
> --- a/examples/apparmor/usr.sbin.libvirtd
> +++ b/examples/apparmor/usr.sbin.libvirtd
> @@ -33,17 +33,11 @@
>    mount options=(rw,rslave)  -> /,
>    mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/,
>  
> -  mount options=(rw, move) /dev/           ->
> /{var/,}run/libvirt/qemu/*.dev/,
> -  mount options=(rw, move) /dev/hugepages/ ->
> /{var/,}run/libvirt/qemu/*.hugepages/,
> -  mount options=(rw, move) /dev/mqueue/    ->
> /{var/,}run/libvirt/qemu/*.mqueue/,
> -  mount options=(rw, move) /dev/pts/       ->
> /{var/,}run/libvirt/qemu/*.pts/,
> -  mount options=(rw, move) /dev/shm/       ->
> /{var/,}run/libvirt/qemu/*.shm/,
> -
> -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/       ->
> /dev/,
> -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.hugepages/ ->
> /dev/hugepages/,
> -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.mqueue/    ->
> /dev/mqueue/,
> -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.pts/       ->
> /dev/pts/,
> -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.shm/       ->
> /dev/shm/,
> +  # libvirt provides any mounts under /dev to qemu namespaces
> +  mount options=(rw, move) /dev/ -> /{var/,}run/libvirt/qemu/*.dev/,
> +  mount options=(rw, move) /dev/**{/,} ->
> /{var/,}run/libvirt/qemu/*{/,},

What are you trying to convey with this rule? As written, the '{/,}' is
redundant since '**' will match that.

> +  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> /dev/,
> +  mount options=(rw, move) /{var/,}run/libvirt/qemu/*{/,} ->
> /dev/**{/,},

ditto

-- 
Jamie Strandboge             | http://www.canonical.com--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

On Mon, Aug 13, 2018 at 7:11 PM Jamie Strandboge <jamie@canonical.com>
wrote:

> On Mon, 2018-08-13 at 16:39 +0200, Christian Ehrhardt wrote:
> > Libvirt now tries to preserve all mounts under /dev in qemu
> > namespaces.
> > The old rules only listed a set of known paths but those are no more
> > enough.
> >
> > I found some due to containers like /dev/.lxc/* and such but also
> > /dev/console
> > and /dev/net/tun.
> >
> > Libvirt is correct to do so, but we can no more predict the names
> > properly, so
> > we modify the rule to allow a wildcard based pattern matching what
> > libvirt does.
> >
> > Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
> > ---
> >  examples/apparmor/usr.sbin.libvirtd | 16 +++++-----------
> >  1 file changed, 5 insertions(+), 11 deletions(-)
> >
> > diff --git a/examples/apparmor/usr.sbin.libvirtd
> > b/examples/apparmor/usr.sbin.libvirtd
> > index 3ff43c32a2..b2e38fe0ad 100644
> > --- a/examples/apparmor/usr.sbin.libvirtd
> > +++ b/examples/apparmor/usr.sbin.libvirtd
> > @@ -33,17 +33,11 @@
> >    mount options=(rw,rslave)  -> /,
> >    mount options=(rw, nosuid) -> /{var/,}run/libvirt/qemu/*.dev/,
> >
> > -  mount options=(rw, move) /dev/           ->
> > /{var/,}run/libvirt/qemu/*.dev/,
> > -  mount options=(rw, move) /dev/hugepages/ ->
> > /{var/,}run/libvirt/qemu/*.hugepages/,
> > -  mount options=(rw, move) /dev/mqueue/    ->
> > /{var/,}run/libvirt/qemu/*.mqueue/,
> > -  mount options=(rw, move) /dev/pts/       ->
> > /{var/,}run/libvirt/qemu/*.pts/,
> > -  mount options=(rw, move) /dev/shm/       ->
> > /{var/,}run/libvirt/qemu/*.shm/,
> > -
> > -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/       ->
> > /dev/,
> > -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.hugepages/ ->
> > /dev/hugepages/,
> > -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.mqueue/    ->
> > /dev/mqueue/,
> > -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.pts/       ->
> > /dev/pts/,
> > -  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.shm/       ->
> > /dev/shm/,
> > +  # libvirt provides any mounts under /dev to qemu namespaces
> > +  mount options=(rw, move) /dev/ -> /{var/,}run/libvirt/qemu/*.dev/,
> > +  mount options=(rw, move) /dev/**{/,} ->
> > /{var/,}run/libvirt/qemu/*{/,},
>
> What are you trying to convey with this rule? As written, the '{/,}' is
> redundant since '**' will match that.
>

I had issues on the other end, with different paths being accessed
with/without trailing slash
  /{var/,}run/libvirt/qemu/*{/,},
So I added the trailing "with or without slash" part.
You are right, on the other end due to the unpredictable path I already had
** which will cover the trailing slash.
I can do a V2 without the trailing part on the side that has the "**"
already


> > +  mount options=(rw, move) /{var/,}run/libvirt/qemu/*.dev/ -> /dev/,
> > +  mount options=(rw, move) /{var/,}run/libvirt/qemu/*{/,} ->
> > /dev/**{/,},
>
> ditto
>
> --
> Jamie Strandboge             | http://www.canonical.com



-- 
Christian Ehrhardt
Software Engineer, Ubuntu Server
Canonical Ltd
--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list