From 624a7927f076b58a6a27af2d00a2edef49326d11 Mon Sep 17 00:00:00 2001 From: Jamie Strandboge Date: Thu, 8 Oct 2009 16:42:05 +0200 Subject: Documentation and examples for SVirt Apparmor driver * docs/drvqemu.html.in: include documentation for AppArmor sVirt confinement * examples/apparmor/TEMPLATE examples/apparmor/libvirt-qemu examples/apparmor/usr.lib.libvirt.virt-aa-helper examples/apparmor/usr.sbin.libvirtd: example templates and configuration files for SVirt Apparmor when using KVM/QEmu --- examples/apparmor/TEMPLATE | 9 +++ examples/apparmor/libvirt-qemu | 71 ++++++++++++++++++++++++ examples/apparmor/usr.lib.libvirt.virt-aa-helper | 22 ++++++++ examples/apparmor/usr.sbin.libvirtd | 48 ++++++++++++++++ 4 files changed, 150 insertions(+) create mode 100644 examples/apparmor/TEMPLATE create mode 100644 examples/apparmor/libvirt-qemu create mode 100644 examples/apparmor/usr.lib.libvirt.virt-aa-helper create mode 100644 examples/apparmor/usr.sbin.libvirtd (limited to 'examples') diff --git a/examples/apparmor/TEMPLATE b/examples/apparmor/TEMPLATE new file mode 100644 index 000000000..008a22124 --- /dev/null +++ b/examples/apparmor/TEMPLATE @@ -0,0 +1,9 @@ +# +# This profile is for the domain whose UUID matches this file. +# + +#include + +profile LIBVIRT_TEMPLATE { + #include +} diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu new file mode 100644 index 000000000..6555f85ba --- /dev/null +++ b/examples/apparmor/libvirt-qemu @@ -0,0 +1,71 @@ +# Last Modified: Wed Jul 8 09:57:41 2009 + + #include + #include + #include + + # required for reading disk images + capability dac_override, + capability dac_read_search, + capability chown, + + network inet stream, + network inet6 stream, + + /dev/net/tun rw, + /dev/kvm rw, + /dev/ptmx rw, + /dev/kqemu rw, + + # WARNING: uncommenting these gives the guest direct access to host hardware. + # This is required for USB pass through but is a security risk. You have been + # warned. + #/sys/bus/usb/devices/ r, + #/sys/devices/*/*/usb[0-9]*/** r, + #/dev/bus/usb/*/[0-9]* rw, + + /usr/share/kvm/** r, + /usr/share/qemu/** r, + /usr/share/bochs/** r, + /usr/share/openbios/** r, + /usr/share/openhackware/** r, + /usr/share/proll/** r, + /usr/share/vgabios/** r, + + # the various binaries + /usr/bin/kvm rmix, + /usr/bin/qemu rmix, + /usr/bin/qemu-system-arm rmix, + /usr/bin/qemu-system-cris rmix, + /usr/bin/qemu-system-i386 rmix, + /usr/bin/qemu-system-m68k rmix, + /usr/bin/qemu-system-mips rmix, + /usr/bin/qemu-system-mips64 rmix, + /usr/bin/qemu-system-mips64el rmix, + /usr/bin/qemu-system-mipsel rmix, + /usr/bin/qemu-system-ppc rmix, + /usr/bin/qemu-system-ppc64 rmix, + /usr/bin/qemu-system-ppcemb rmix, + /usr/bin/qemu-system-sh4 rmix, + /usr/bin/qemu-system-sh4eb rmix, + /usr/bin/qemu-system-sparc rmix, + /usr/bin/qemu-system-sparc64 rmix, + /usr/bin/qemu-system-x86_64 rmix, + /usr/bin/qemu-alpha rmix, + /usr/bin/qemu-arm rmix, + /usr/bin/qemu-armeb rmix, + /usr/bin/qemu-cris rmix, + /usr/bin/qemu-i386 rmix, + /usr/bin/qemu-m68k rmix, + /usr/bin/qemu-mips rmix, + /usr/bin/qemu-mipsel rmix, + /usr/bin/qemu-ppc rmix, + /usr/bin/qemu-ppc64 rmix, + /usr/bin/qemu-ppc64abi32 rmix, + /usr/bin/qemu-sh4 rmix, + /usr/bin/qemu-sh4eb rmix, + /usr/bin/qemu-sparc rmix, + /usr/bin/qemu-sparc64 rmix, + /usr/bin/qemu-sparc32plus rmix, + /usr/bin/qemu-sparc64 rmix, + /usr/bin/qemu-x86_64 rmix, diff --git a/examples/apparmor/usr.lib.libvirt.virt-aa-helper b/examples/apparmor/usr.lib.libvirt.virt-aa-helper new file mode 100644 index 000000000..096b6753f --- /dev/null +++ b/examples/apparmor/usr.lib.libvirt.virt-aa-helper @@ -0,0 +1,22 @@ +# Last Modified: Mon Jul 06 17:22:37 2009 +#include + +/usr/lib/libvirt/virt-aa-helper { + #include + + # needed for searching directories + capability dac_override, + capability dac_read_search, + + # needed for when disk is on a network filesystem + network inet, + + deny @{PROC}/[0-9]*/mounts r, + @{PROC}/filesystems r, + + /usr/lib/libvirt/virt-aa-helper mr, + /sbin/apparmor_parser Ux, + + /etc/apparmor.d/libvirt/* r, + /etc/apparmor.d/libvirt/libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw, +} diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd new file mode 100644 index 000000000..47d391633 --- /dev/null +++ b/examples/apparmor/usr.sbin.libvirtd @@ -0,0 +1,48 @@ +# Last Modified: Wed Sep 23 23:23:58 2009 +#include +@{LIBVIRT}="libvirt" + +/usr/sbin/libvirtd { + #include + + capability kill, + capability net_admin, + capability net_raw, + capability setgid, + capability sys_admin, + capability sys_module, + capability sys_ptrace, + capability sys_nice, + capability sys_chroot, + capability setuid, + capability dac_override, + capability dac_read_search, + capability fowner, + capability chown, + capability setpcap, + capability mknod, + + network inet stream, + + # Very lenient profile for libvirtd since we want to first focus on confining + # the guests. Guests will have a very restricted profile. + /** rwmkl, + + /bin/* Ux, + /sbin/* Ux, + /usr/bin/* Ux, + /usr/sbin/* Ux, + + # force the use of virt-aa-helper + audit deny /sbin/apparmor_parser rwxl, + audit deny /etc/apparmor.d/libvirt/** wxl, + audit deny /sys/kernel/security/apparmor/features rwxl, + audit deny /sys/kernel/security/apparmor/matching rwxl, + audit deny /sys/kernel/security/apparmor/.* rwxl, + /sys/kernel/security/apparmor/profiles r, + /usr/lib/libvirt/virt-aa-helper Pxr, + + # allow changing to our UUID-based named profiles + change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*, + +} -- cgit v1.2.3-65-gdbad