D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
etc
/
apparmor.d
/
Filename :
systemd-detect-virt
back
Copy
abi <abi/5.0>, include <tunables/global> # /proc/device-tree is sometimes a symlink, so we need to handle the # symlink targets as well as cases where it isn't a symlink @{device_tree_dir}=/proc/device-tree /sys/firmware/devicetree/base # See comments on /proc/@{pid}/ns/{cgroup,pid} for why we need the flag profile systemd-detect-virt /usr/bin/systemd-detect-virt flags=(attach_disconnected.path=/apparmor/disconnected/) { include <abstractions/base> # Temporarily needed until fd delegation lands # Also needed while delegation from unconfined is broken include <abstractions/consoles> /usr/bin/systemd-detect-virt mr, # Not using @{run}, etc. because all the paths below are hardcoded absolute prefixes # F_OK and access(2) not mediated but still note these in case we need to do something with them later ## systemd/src/basic/virt.c:detect_container #/proc/{vz,bc} r, # F_OK /proc/sys/kernel/osrelease r, # /proc/self/status -> /proc/@{TracerPid}/comm -> startswith("proot") /proc/@{pid}/status r, /proc/@{pids}/comm r, /run/host/container-manager r, /run/systemd/container r, # Check env vars of non-systemd init, which (according to source comment) needs CAP_SYS_PTRACE /proc/1/environ r, capability sys_ptrace, # peer=systemd itself but unfortunately we can't be more fine-grained than this ptrace read peer=unconfined, # systemd/src/basic/virt.c:detect_container_files #/run/.containerenv r, # F_OK #/.dockerenv r, # F_OK # systemd/src/basic/virt.c:running_in_pidns -> systemd/src/basic/namespace-util.c:namespace_is_init /proc/sys/kernel/cap_last_cap r, /proc/filesystems r, /proc/@{pid}/{g,u}id_map r, #/proc/ns/pid/ r, # stat # Unsure if /proc/ r, is needed for checking whether /proc/ is set up #/proc/@{pid}/ns/cgroup r, # F_OK # Ubuntu Plucky+ systemd-detect-virt does getattr on the symlink # See further comment below for why we don't just add this rule #/proc/@{pid}/ns/{cgroup,pid} r, #/sys/fs/cgroup/ r, # statfs #/sys/fs/cgroup/cgroup.events r, # F_OK ## systemd/src/basic/virt.c:detect_vm # detect_vm_dmi -> detect_vm_dmi_vendor # /sys/class/dmi/id is symlink to /sys/devices/virtual/dmi/id /sys/devices/virtual/dmi/id/{product_name,sys_vendor,board_vendor,bios_vendor,product_version} r, # detect_vm_dmi -> detect_vm_smbios /sys/firmware/dmi/entries/0-0/raw r, # detect_vm_uml /proc/cpuinfo r, # detect_vm_xen #/proc/xen r, # F_OK # detect_vm_xen -> detect_vm_xen_dom0 /sys/hypervisor/properties/features r, /proc/xen/capabilities r, # detect_vm_cpuid uses the cpuid instruction and doesn't need rules # detect_vm_hypervisor /sys/hypervisor/type r, # detect_vm_device_tree @{device_tree_dir}/hypervisor/compatible r, #"@{device_tree_dir}/ibm,partition-name" r, # F_OK #"@{device_tree_dir}/hmc-managed?" r, # F_OK #"@{device_tree_dir}/chosen/qemu,graphic-width" r, #F_OK @{device_tree_dir}/ r, # FOREACH_DIRENT looking for @{device_tree_dir}/*fw-cfg* @{device_tree_dir}/compatible r, # detect_vm_zvm /proc/sysinfo r, ##systemd/src/basic/confidential-virt.c:detect_confidential_virtualization # defined(__x86_64__) # detect_sev -> msr /dev/cpu/0/msr r, # detect_tdx has no accesses # defined(__s390x__) /sys/firmware/uv/prot_virt_guest r, # defined(__aarch64__) #/sys/devices/platform/arm-cca-dev r, # F_OK # Addressing Ubuntu Plucky+Questing denial logs capability net_admin, @{run}/systemd/notify w, @{run}/systemd/journal/socket w, # getattr is called on /proc/@{pid}/ns/{cgroup,pid} above. However, these are # symlinks to magic files that do not exist on the filesystem and whose paths # get resolved to a disconnected "/". Until we can better mediate such magic # files, we can only allow them through allowing read access to "/" # (translated to /apparmor/disconnected/ via attach_disconnected.path) /apparmor/disconnected/ r, include if exists <local/systemd-detect-virt> }