felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Read-only root compatibility (#86)

Browse source 
* Read-only root compatibility

* remove complain

Co-authored-by: nobodysu <nobodysu@users.noreply.github.com>
This commit is contained in:
nobody43 2022-10-18 18:23:52 +00:00 • committed by GitHub
parent 5fdbc2d00e
commit f94faf697e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
13 changed files with 26 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

6
apparmor.d/groups/virt/libvirtd
View file

@ -132,8 +132,8 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
/usr/share/mime/mime.cache r,
/usr/share/qemu/{,**} r,
/etc/apparmor.d/libvirt/libvirt-@{uuid} r,
/etc/libvirt/{,**} rw,
@{etc_rw}/apparmor.d/libvirt/libvirt-@{uuid} r,
@{etc_rw}/libvirt/{,**} rw,
/etc/mdevctl.d/{,**} r,
/etc/xml/catalog r,
@ -243,7 +243,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
# Force the use of virt-aa-helper
audit deny /{usr/,}{s,}bin/apparmor_parser rwxl,
audit deny /etc/apparmor.d/libvirt/** wxl,
audit deny @{etc_rw}/apparmor.d/libvirt/** wxl,
audit deny @{sys}/kernel/security/apparmor/features rwxl,
audit deny @{sys}/kernel/security/apparmor/matching rwxl,
audit deny @{sys}/kernel/security/apparmor/.* rwxl,

2
apparmor.d/groups/virt/virt-aa-helper
View file

@ -23,7 +23,7 @@ profile virt-aa-helper @{exec_path} {
/{usr/,}{s,}bin/apparmor_parser rPx,
/etc/apparmor.d/libvirt/* r,
/etc/apparmor.d/libvirt/libvirt-@{uuid} rw,
@{etc_rw}/apparmor.d/libvirt/libvirt-@{uuid} rw,
/etc/libnl{,-3}/classid r, # Allow reading libnl's classid file