mirror of
https://github.com/stefanberger/swtpm.git
synced 2025-08-22 10:30:52 +00:00
a771ecf4c4
When running a VM connected to qemu:///session, swtpm needs access to its own process id and socket files in /run/user/<UID>/libvirt/qemu/run/swtpm/. Add permissions to access them in the apparmor profile. Signed-off-by: Lena Voytek <lena.voytek@canonical.com>
41 lines
1.1 KiB
Plaintext
41 lines
1.1 KiB
Plaintext
# vim:syntax=apparmor
|
|
# AppArmor policy for swtpm
|
|
|
|
#include <tunables/global>
|
|
|
|
profile swtpm /usr/bin/swtpm {
|
|
#include <abstractions/base>
|
|
#include <abstractions/openssl>
|
|
|
|
# Site-specific additions and overrides. See local/README for details.
|
|
#include <local/usr.bin.swtpm>
|
|
|
|
capability chown,
|
|
capability dac_override,
|
|
capability dac_read_search,
|
|
capability fowner,
|
|
capability fsetid,
|
|
capability setgid,
|
|
capability setuid,
|
|
|
|
network inet stream,
|
|
network inet6 stream,
|
|
unix (send) type=dgram addr=none peer=(addr=none),
|
|
unix (send, receive) type=stream addr=none peer=(label=libvirt-*),
|
|
|
|
/usr/bin/swtpm rm,
|
|
|
|
/tmp/** rwk,
|
|
owner @{HOME}/** rwk,
|
|
owner /var/lib/libvirt/swtpm/** rwk,
|
|
/run/libvirt/qemu/swtpm/*.sock rwk,
|
|
owner /run/user/[0-9]*/libvirt/qemu/run/swtpm/*.sock rwk,
|
|
owner /var/log/swtpm/libvirt/qemu/*.log rwk,
|
|
owner /run/libvirt/qemu/swtpm/*.pid rwk,
|
|
owner /run/user/[0-9]*/libvirt/qemu/run/swtpm/*.pid rwk,
|
|
owner /dev/vtpmx rw,
|
|
owner /etc/nsswitch.conf r,
|
|
owner /var/lib/swtpm/** rwk,
|
|
owner /run/swtpm/sock rw,
|
|
}
|