Control: tags -1 fixed-upstream On Wed, Sep 11, 2024 at 08:06:18PM +0200, Andrea Bolognani wrote: > On Wed, Sep 11, 2024 at 02:21:07PM +0200, intrigeri wrote: > > If libvirt-daemon-driver-lxc is not installed, libvirtd logs this on > > startup: > > > > libvirtd[2085]: internal error: template > > '/etc/apparmor.d/libvirt/TEMPLATE.lxc' does not exist > > > > … and then apparently the logic to generate AppArmor profiles for QEMU VMs > > and > > enforce them is disabled. That was not obvious to me: I thought "OK, I don't > > have the LXC driver installed, so sure that file is missing, it's fine" and > > did > > not guess this would break a previously working security feature. > > Thanks for the report. > > This is definitely *not* expected and *not* acceptable. AppArmor > confinement for QEMU domains should work regardless of whether or not > an unrelated hypervisor driver is installed. > > I'll look into it. I'm fairly sure it will require an upstream fix.
Fixed upstream with
commit d622ca04f6525b90cfe6d8274efaf4bee043d8ba
Author: Andrea Bolognani <abolo...@redhat.com>
Date: Mon Sep 16 16:39:11 2024 +0200
apparmor: Don't check for existence of templates upfront
Currently, if either template is missing AppArmor support is
completely disabled. This means that uninstalling the LXC
driver from a system results in QEMU domains being started
without AppArmor confinement, which obviously doesn't make any
sense.
The problematic scenario was impossible to hit in Debian until
very recently, because all AppArmor files were shipped as part
of the same package; now that the Debian package is much closer
to the Fedora one, and specifically ships the AppArmor files
together with the corresponding driver, it becomes trivial to
trigger it.
Drop the checks entirely. virt-aa-helper, which is responsible
for creating the per-domain profiles starting from the
driver-specific template, already fails if the latter is not
present, so they were always redundant.
https://bugs.debian.org/1081396
Signed-off-by: Andrea Bolognani <abolo...@redhat.com>
Reviewed-by: Daniel P. Berrangé <berra...@redhat.com>
I'll prepare an upload shortly.
--
Andrea Bolognani <e...@kiyuko.org>
Resistance is futile, you will be garbage collected.
signature.asc
Description: PGP signature
