8000
Skip to content

Apparmor tweaks (from Incus)#16132

Merged
tomponline merged 4 commits intocanonical:mainfrom
simondeziel:apparmor-tweaks-from-incus
Aug 1, 2025
Merged

Apparmor tweaks (from Incus)#16132
tomponline merged 4 commits intocanonical:mainfrom
simondeziel:apparmor-tweaks-from-incus

Conversation

@simondeziel
Copy link
Copy Markdown
Member
@simondeziel simondeziel commented Jul 31, 2025 •
edited
Loading

Silence some Apparmor denials observed on my Jammy system with LXD latest/edge:

audit: type=1400 audit(1753913832.485:3291): apparmor="DENIED" operation="open" class="file" profile="lxd_qemu-img-<var-snap-lxd-common-lxd-storage-pools-default-custom-default_images-images-36bbe9a5cf01d179510b005caced1f3642cf86ae3141e2a2c6c50637e53b5f4b.rootfs>_<dev-zd0>" name="/sys/devices/system/node/" pid=262067 comm="qemu-img" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
audit: type=1400 audit(1753913832.489:3293): apparmor="DENIED" operation="open" class="file" profile="lxd_qemu-img-<var-snap-lxd-common-lxd-storage-pools-default-custom-default_images-images-36bbe9a5cf01d179510b005caced1f3642cf86ae3141e2a2c6c50637e53b5f4b.rootfs>_<dev-zd0>" name="/sys/devices/virtual/block/zd0/queue/zoned" pid=262067 comm="qemu-img" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

stgraber added 3 commits July 31, 2025 15:42
@stgraber @simondeziel
lxd/apparmor: Update for current QEMU
1c9db8d 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
(cherry picked from commit d06441c0fd92ce88be56d4b2c409e7e063e5cbeb)
Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
License: Apache-2.0
@stgraber @simondeziel
lxd/apparmor/qemu: Allow reading gid_map/uid_map
6db037b 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
(cherry picked from commit 858f3afbd5ef2712f5049f9e794b97e4245a80f2)
Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
License: Apache-2.0
@stgraber @simondeziel
lxd/apparmor/qemuimg: Fix typo in rules
7be3f7d 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
(cherry picked from commit 81e19ac8c12359ac8b84ea15e4155bafe3ee26e3)
Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
License: Apache-2.0
@simondeziel simondeziel requested a review from Copilot July 31, 2025 19:42
Copilot AI reviewed Jul 31, 2025
View reviewed changes
Copy link
Copy Markdown
Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates AppArmor profiles for QEMU-related components by adding additional file system access permissions. The changes appear to be ported from the Incus project to enhance compatibility and functionality.

Key Changes:

  • Added process and system file access permissions for QEMU image operations
  • Enhanced QEMU instance profile with additional proc filesystem access rules
  • Improved system device and node information access capabilities

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
lxd/apparmor/qemuimg.go Added proc/sys access and system device/node read permissions for QEMU image operations
lxd/apparmor/instance_qemu.go Enhanced with proc filesystem access for process information, task communication, and memory mapping

Comment thread lxd/apparmor/qemuimg.go
Comment thread lxd/apparmor/instance_qemu.go Outdated
@simondeziel
lxd/apparmor/instance_qemu: restrict QEMU to rename its own process a…
a77f188 
…nd threads only

Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
@simondeziel simondeziel marked this pull request as ready for review August 1, 2025 14:07
@simondeziel
Copy link
Copy Markdown
Member Author
simondeziel commented Aug 1, 2025 •
edited
Loading

This was tested locally and it indeed avoids the denials from qemu-img and VMs are still working fine.

@simondeziel simondeziel requested a review from tomponline August 1, 2025 14:11
tomponline
tomponline approved these changes Aug 1, 2025
View reviewed changes
Copy link
Copy Markdown
Member
@tomponline tomponline left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ta

@tomponline tomponline merged commit 45c0063 into canonical:main Aug 1, 2025
31 checks passed
@simondeziel simondeziel deleted the apparmor-tweaks-from-incus branch August 1, 2025 15:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@tomponline tomponline tomponline approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@simondeziel @tomponline @stgraber
0