Commits on Jun 27, 2024

1. lxd/apparmor/instance_qemu: relax proc rules a bit to workaround bug … …

   …in AppArmor
   
   For some reason (bug in AppArmor?):
     owner @{PROC}/@{pid}/cpuset                     r,
     owner @{PROC}/@{pid}/task/@{tid}/comm           rw,
   rules don't work properly and forbid perfectly legal access of Qemu to proc:
   [13830.493684] audit: type=1400 audit(1719481742.274:388): apparmor="DENIED" operation="open" class="file" profile="lxd-v1_</var/snap/lxd/common/lxd>" name="/proc/94213/task/94293/comm" pid=94213 comm="qemu-system-x86" requested_mask="wr" denied_mask="wr" fsuid=999 ouid=0
   
   I've noticed, that removing the "owner" keyword makes it work.
   Let's do this, despite it relaxes profile and makes things less secure,
   I can't really see any serious security impact from that change.
   
   This only reproducible when core24 is used (new AppArmor) and
   ceph volume is attached to the VM.
   
   Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>

   

   mihalicyn committed Jun 27, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for d911ab0
   • Browse repository at this point

   Copy the full SHA

   d911ab0 View commit details

   Browse the repository at this point in the history