/etc/apparmor.d/usr.lib.libvirt.virt-aa-helper is in libvirt-bin 1.3.1-1ubuntu10.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 | # Last Modified: Mon Jul 06 17:22:37 2009
#include <tunables/global>
/usr/lib/libvirt/virt-aa-helper {
#include <abstractions/base>
#include <abstractions/user-tmp>
# needed for searching directories
capability dac_override,
capability dac_read_search,
# needed for when disk is on a network filesystem
network inet,
network inet6,
deny @{PROC}/[0-9]*/mounts r,
@{PROC}/[0-9]*/net/psched r,
owner @{PROC}/[0-9]*/status r,
@{PROC}/filesystems r,
# for hostdev
/sys/devices/ r,
/sys/devices/** r,
/sys/bus/usb/devices/ r,
/sys/bus/usb/devices/** r,
deny /dev/sd* r,
deny /dev/dm-* r,
deny /dev/mapper/ r,
deny /dev/mapper/* r,
/usr/lib/libvirt/virt-aa-helper mr,
/sbin/apparmor_parser Ux,
# for openvswitch
/{,var/}run/** rw,
/etc/apparmor.d/libvirt/* r,
/etc/apparmor.d/libvirt/libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw,
# For backingstore, virt-aa-helper needs to peek inside the disk image, so
# allow access to non-hidden files in @{HOME} as well as storage pools, and
# removable media and filesystems, and certain file extentions. A
# virt-aa-helper failure when checking a disk for backinsgstore is non-fatal
# (but obviously the backingstore won't be added).
audit deny @{HOME}/.* mrwkl,
audit deny @{HOME}/.*/ rw,
audit deny @{HOME}/.*/** mrwkl,
@{HOME}/ r,
@{HOME}/** r,
@{HOME}/.Private/** mrwlk,
@{HOMEDIRS}/.ecryptfs/*/.Private/** mrwlk,
/var/lib/libvirt/images/ r,
/var/lib/libvirt/images/** r,
/var/lib/nova/images/** r,
/var/lib/nova/instances/_base/** r,
/var/lib/nova/instances/snapshots/** r,
/var/lib/eucalyptus/instances/**/disk* r,
/var/lib/eucalyptus/instances/**/loader* r,
/var/lib/uvtool/libvirt/images/** r,
/{media,mnt,opt,srv}/** r,
/**.img r,
/**.qcow{,2} r,
/**.qed r,
/**.vmdk r,
/**.[iI][sS][oO] r,
/**/disk{,.*} r,
}
|