** Description changed: - TODO + [ Impact ] + QEMU processes spawned by Libvirt can't read /proc/sys/vm/max_map_count. This matters because as of QEMU v9.0.0 (commit 86a637e4), QEMU reads that file to limit the coroutine pool size. + + Without this change, QEMU processes spawned by Libvirt will read an + incorrect value of vm.max_map_count, which has the effect of increasing + the limit of pooled coroutines and thus can increase allocated VMAs. + + See the related LP: #2168803 for more info. This SRU blocks 2168803. + + The upstream fix adds the relevant path to the template AppArmor + profile. It has been merged since tag v10.7.0-rc1. + + [ Test plan ] + # Create a trivial domain in order to create a test AppArmor profile. + + # Test the trivial domain's AppArmor profile + aa-exec -p [any libvirt domain profile] cat /proc/sys/vm/max_map_count + + # Fail output (before patch) + + # Success output (after patch) + + [ Regression risk ] + The regression risk with adding a single entry to the Libvirt AppArmor template is such that every guest's emulator process spawned by Libvirt will have access to the aforementioned file listed in the profile by default. + + Technically speaking, if a guest-to-host escape is performed, then that + means one more file will be allowed by AppArmor. However, this patch + only allows 'read' access, so this additon would only serve as an + information source. + + QEMU necessarily needs to read the value of vm.max_map_count to + calculate a sane limit for pooled coroutines. Every QEMU process that + spawns after commit 86a637e4 will need to read this file, so it makes + sense to make the change in the template. + + [ Other info ] + LP bug tracking QEMU SRU (LP: #2168803): https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2168803 + Upstream Libvirt patch: https://gitlab.com/libvirt/libvirt/-/commit/85e07fb1ceee + Upstream QEMU patch necesitating this change: https://gitlab.com/qemu-project/qemu/-/commit/86a637e4
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2170732 Title: AppArmor fix for LP2168803; reads from /proc/sys/vm/max_map_count denied To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/2170732/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
