incusd/apparmor: Update for current QEMU

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
lxc · Jun 21, 2024 · d06441c · d06441c
1 parent 2bbcd64
commit d06441c
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/internal/server/apparmor/instance_qemu.go b/internal/server/apparmor/instance_qemu.go
@@ -30,6 +30,7 @@ profile "{{ .name }}" flags=(attach_disconnected,mediate_deleted) {
   /etc/ceph/**                              r,
   /etc/machine-id                           r,
   /run/udev/data/*                          r,
+  /proc/sys/vm/max_map_count                r,
   /sys/bus/                                 r,
   /sys/bus/nd/devices/                      r,
   /sys/bus/usb/devices/                     r,

diff --git a/internal/server/apparmor/qemuimg.go b/internal/server/apparmor/qemuimg.go
@@ -22,7 +22,11 @@ profile "{{ .name }}" flags=(attach_disconnected,mediate_deleted) {
   capability dac_read_search,
   capability ipc_lock,
 
+  /proc/sys/vm/max_map_count r,
   /sys/devices/**/block/*/queue/max_segments  r,
+  /sys/devices/**/block/*/zoned  r,
+  /sys/devices/system/node r,
+  /sys/devices/system/node/** r,
 
 {{range $index, $element := .allowedCmdPaths}}
   {{$element}} mixr,