incusd/apparmor/qemu: Allow access to agent path

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
lxc · Jan 24, 2024 · 07c74ed · 07c74ed
1 parent 5218bed
commit 07c74ed
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/internal/server/apparmor/instance.go b/internal/server/apparmor/instance.go
@@ -200,6 +200,14 @@ func instanceProfile(sysOS *sys.OS, inst instance, extraBinaries []string) (stri
 			return "", err
 		}
 
+		agentPath := ""
+		if os.Getenv("INCUS_AGENT_PATH") != "" {
+			agentPath, err = filepath.EvalSymlinks(os.Getenv("INCUS_AGENT_PATH"))
+			if err != nil {
+				return "", err
+			}
+		}
+
 		execPath := localUtil.GetExecPath()
 		execPathFull, err := filepath.EvalSymlinks(execPath)
 		if err == nil {
@@ -217,6 +225,7 @@ func instanceProfile(sysOS *sys.OS, inst instance, extraBinaries []string) (stri
 			"path":           path,
 			"raw":            rawContent,
 			"ovmfPath":       ovmfPath,
+			"agentPath":      agentPath,
 		})
 		if err != nil {
 			return "", err

diff --git a/internal/server/apparmor/instance_qemu.go b/internal/server/apparmor/instance_qemu.go
@@ -72,6 +72,11 @@ profile "{{ .name }}" flags=(attach_disconnected,mediate_deleted) {
   deny /sys/module/apparmor/parameters/enabled r,
   deny /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
 
+{{if .agentPath -}}
+  {{ .agentPath }}/ r,
+  {{ .agentPath }}/* r,
+{{- end }}
+
 {{if .libraryPath -}}
   # Entries from LD_LIBRARY_PATH
 {{range $index, $element := .libraryPath}}