[libvirt] [PATCH] security: aa-helper: fix static defined vfio MDEVs

[Christian Ehrhardt]

For vfio MDEVs we need to allow qemu the vfio access in apparmor.

This is extending the older fix 74e86b6b: "Fix apparmor profile
to make vfio pci passthrough work" which was for VFIO PCI
passthrough on static hostdevs to now also cover vfio MDEVs.
It is having the same limitations of the lifecycle at that time
being unable to detect the actual vfio device and therefore
adds a wildcars.

Please also note that hotplug - which in can detect the right
device at runtime - is covered by labeling callbacks in
606afafb: "security: Enable labeling of vfio mediated devices"

Signed-off-by: Christian Ehrhardt <***@canonical.com>
---
src/security/virt-aa-helper.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)

diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index 03cc15c9d3..c7488432d6 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -1105,6 +1105,23 @@ get_files(vahControl * ctl)
break;
}

+ case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_MDEV: {
+ virDomainHostdevSubsysMediatedDevPtr mdevsrc = &dev->source.subsys.u.mdev;
+ switch ((virMediatedDeviceModelType) mdevsrc->model) {
+ case VIR_MDEV_MODEL_TYPE_VFIO_PCI:
+ case VIR_MDEV_MODEL_TYPE_VFIO_AP:
+ case VIR_MDEV_MODEL_TYPE_VFIO_CCW:
+ needsVfio = true;
+ break;
+ case VIR_MDEV_MODEL_TYPE_LAST:
+ default:
+ virReportEnumRangeError(virMediatedDeviceModelType,
+ mdevsrc->model);
+ break;
+ }
+ break;
+ }
+
case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI: {
virPCIDevicePtr pci = virPCIDeviceNew(
dev->source.subsys.u.pci.addr.domain,

[Christian Ehrhardt]

On Thu, Nov 22, 2018 at 11:27 AM Christian Ehrhardt <

Post by Christian Ehrhardt
For vfio MDEVs we need to allow qemu the vfio access in apparmor.
This is extending the older fix 74e86b6b: "Fix apparmor profile
to make vfio pci passthrough work" which was for VFIO PCI
passthrough on static hostdevs to now also cover vfio MDEVs.
It is having the same limitations of the lifecycle at that time
being unable to detect the actual vfio device and therefore
adds a wildcars.

obviously wildcards - not afraid of bad traffic, but not worth a V2.
Fixed locally already as well as the first line which had the word "access"
twice.

Waiting for feedback to make a V2 with actual (not just commit words)
changes as needed.

P.S. @Boris as I know you are affected by missing this I you to CC on the
thread as well. Enjoy my typos :-/

[Boris Fiuczynski]

Post by Christian Ehrhardt
On Thu, Nov 22, 2018 at 11:27 AM Christian Ehrhardt <

Post by Christian Ehrhardt
For vfio MDEVs we need to allow qemu the vfio access in apparmor.
This is extending the older fix 74e86b6b: "Fix apparmor profile
to make vfio pci passthrough work" which was for VFIO PCI
passthrough on static hostdevs to now also cover vfio MDEVs.
It is having the same limitations of the lifecycle at that time
being unable to detect the actual vfio device and therefore
adds a wildcars.

obviously wildcards - not afraid of bad traffic, but not worth a V2.
Fixed locally already as well as the first line which had the word "access"
twice.
Waiting for feedback to make a V2 with actual (not just commit words)
changes as needed.

Since the code changes except for vfio-ccw seem to be in line with the
ppa I tested already

Post by Christian Ehrhardt
thread as well. Enjoy my typos :-/

I sure am! :)

Post by Christian Ehrhardt
--
libvir-list mailing list
https://www.redhat.com/mailman/listinfo/libvir-list

[Erik Skultety]

virt-aa-helper needs to grant QEMU access to VFIO MDEV devices.
This extends commit 74e86b6b which only covered PCI hostdevs for VFIO-PCI
assignment by now also covering vfio MDEVs.
It has still the same limitations regarding the device lifecycle, IOW we're
unable to predict the actual VFIO device being created, thus we need
wildcards.
Also note that the hotplug case, where apparmor is able to detect the actual
VFIO device during runtime, is already covered by commit 606afafb.
---

I'm sorry if I sounded like I need to see a v2, I just wanted to give other
people time to look at it too before I merge it.
Anyhow, I merged the patch.

Thanks,
Erik

[Erik Skultety]

Post by Christian Ehrhardt
For vfio MDEVs we need to allow qemu the vfio access in apparmor.

How about:
"Apparmor needs to be able to grant QEMU access to VFIO MDEV devices."

Post by Christian Ehrhardt
This is extending the older fix 74e86b6b: "Fix apparmor profile

This extends commit 74e86b6b which only covered PCI hostdevs for VFIO-PCI
assignment.

Post by Christian Ehrhardt
to make vfio pci passthrough work" which was for VFIO PCI
passthrough on static hostdevs to now also cover vfio MDEVs.
It is having the same limitations of the lifecycle at that time

It has still the same limitations regarding the device lifecycle, IOW we're
unable to predict the actual VFIO device being created, thus we need wildcards.

Post by Christian Ehrhardt
being unable to detect the actual vfio device and therefore
adds a wildcars.
Please also note that hotplug - which in can detect the right
device at runtime - is covered by labeling callbacks in
606afafb: "security: Enable labeling of vfio mediated devices"

Also note that the hotplug case, where apparmor is able to detect the actual
VFIO device during runtime, is already covered by commit 606afafb.

Post by Christian Ehrhardt
---

Apart from the tiny typographical nit pick I had - you don't even need to agree
to them as I'm not a native speaker myself - I don't see a functional problem
with the patch from libvirt's perspective, so:

Reviewed-by: Erik Skultety <***@redhat.com>