1
0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-22 17:34:18 +03:00
libvirt/examples
Christian Ehrhardt a15bab0c68
apparmor: fix vfio usage without initial hostdev
The base vfio has not much functionality but to provide a custom
container by opening this path.
See https://www.kernel.org/doc/Documentation/vfio.txt for more.

Systems with static hostdevs will get /dev/vfio/vfio by virt-aa-hotplug
right from the beginning. But if the guest initially had no hostdev at
all it will run into the following deny before the security module
labelling callbacks will make the actual vfio device (like /dev/vfio/93)
known.

Example of such a deny:
[ 2652.756712] audit: type=1400 audit(1491303691.719:25):
  apparmor="DENIED" operation="open"
  profile="libvirt-17a61b87-5132-497c-b928-421ac2ee0c8a"
  name="/dev/vfio/vfio" pid=8486 comm="qemu-system-x86"
  requested_mask="wr" denied_mask="wr" fsuid=64055 ouid=0

Bug-Ubuntu: https://bugs.launchpad.net/bugs/1678322
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1775777

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Jamie Strandboge <jamie@canonical.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2018-06-12 16:09:25 +02:00
..
admin examples: Resolve sign-compare warnings 2016-12-20 13:11:25 +01:00
apparmor apparmor: fix vfio usage without initial hostdev 2018-06-12 16:09:25 +02:00
dominfo examples: Use one top level makefile 2016-01-09 21:14:12 -05:00
dommigrate examples: Use one top level makefile 2016-01-09 21:14:12 -05:00
domsuspend Remove backslash alignment attempts 2017-11-03 13:24:12 +01:00
domtop Remove backslash alignment attempts 2017-11-03 13:24:12 +01:00
hellolibvirt examples: Resolve sign-compare warnings 2016-12-20 13:11:25 +01:00
lxcconvert lxc: allow use of lxc:///system URI as preferred format 2018-04-12 16:52:01 +01:00
object-events Remove backslash alignment attempts 2017-11-03 13:24:12 +01:00
openauth lib: Fix c99 style comments 2017-04-27 14:13:19 +02:00
polkit examples: Use one top level makefile 2016-01-09 21:14:12 -05:00
rename examples: Use one top level makefile 2016-01-09 21:14:12 -05:00
systemtap examples: Use one top level makefile 2016-01-09 21:14:12 -05:00
xml examples: Use one top level makefile 2016-01-09 21:14:12 -05:00
Makefile.am virt-aa-helper: handle more disk images 2017-12-20 11:05:54 +01:00