4168ffd536
Contrail Nova VIF plugin relies on Nova (core) code to create a tap interface before a vrouter interface is plugged. Thus nova-compute needs to be able to access /dev/net/tun which it cannot with the current apparmor profile when enforcing mode is enabled. See LP: #1841111 Change-Id: I31033bc7d95dfce6b677c6e948303f7154395f66 Closes-Bug: #1841111
139 lines
3.3 KiB
Plaintext
139 lines
3.3 KiB
Plaintext
# Last Modified: Tue Apr 5 22:19:53 2016
|
|
# Mode: {{aa_profile_mode}}
|
|
#include <tunables/global>
|
|
|
|
/usr/bin/nova-compute {
|
|
#include <abstractions/authentication>
|
|
#include <abstractions/base>
|
|
#include <abstractions/bash>
|
|
#include <abstractions/nameservice>
|
|
#include <abstractions/python>
|
|
#include <abstractions/wutmp>
|
|
|
|
capability audit_write,
|
|
capability chown,
|
|
capability dac_override,
|
|
capability dac_read_search,
|
|
capability fowner,
|
|
capability net_admin,
|
|
capability net_raw,
|
|
capability setgid,
|
|
capability setuid,
|
|
capability sys_admin,
|
|
capability sys_resource,
|
|
capability sys_module,
|
|
|
|
network inet raw,
|
|
network inet stream,
|
|
network unix stream,
|
|
|
|
deny /* w,
|
|
|
|
/bin/* rix,
|
|
/dev/disk/** r,
|
|
/dev/disk/by-id/* r,
|
|
/dev/mapper/control wr,
|
|
/dev/nbd* rw,
|
|
/dev/tty rw,
|
|
/dev/pts/* r,
|
|
/dev/sd* r,
|
|
/etc/default/locale r,
|
|
/etc/environment r,
|
|
/etc/iscsi/** rw,
|
|
/etc/machine-id r,
|
|
/etc/mime.types r,
|
|
/etc/modprobe.d/ r,
|
|
/etc/modprobe.d/** r,
|
|
/etc/mtab rw,
|
|
/etc/multipath/bindings wr,
|
|
/etc/multipath/wwids wr,
|
|
/etc/nova/** r,
|
|
/etc/ssh/ssh_config r,
|
|
/etc/ssl/openssl.cnf r,
|
|
/etc/sudoers r,
|
|
/etc/sudoers.d/ r,
|
|
/etc/sudoers.d/* r,
|
|
/etc/udev/udev.conf r,
|
|
/proc/*/cmdline r,
|
|
/proc/cmdline r,
|
|
/proc/devices r,
|
|
/proc/sys/fs/nr_open r,
|
|
/proc/sys/net/ipv6/conf/** w,
|
|
/proc/*/task/*/comm wr,
|
|
/proc/*/fd/ r,
|
|
/proc/*/net/ip_tables_names r,
|
|
/proc/*/net/psched r,
|
|
/proc/*/stat r,
|
|
/proc/uptime r,
|
|
/proc/version r,
|
|
/proc/loadavg r,
|
|
/run/libvirt/libvirt-sock rw,
|
|
/run/lock/iscsi/ rw,
|
|
/run/lock/iscsi/** rwl,
|
|
/run/lock/nova/nova-iptables wk,
|
|
/run/lock/qemu-nbd-nbd* w,
|
|
/run/openvswitch/db.sock rw,
|
|
/sbin/blockdev rix,
|
|
/sbin/brctl rix,
|
|
/sbin/iscsiadm rix,
|
|
/sbin/ldconfig rix,
|
|
/sbin/ldconfig.real rix,
|
|
/sbin/mkfs rix,
|
|
/sbin/mkfs.fat rix,
|
|
/sbin/hdparm rix,
|
|
/sbin/xtables-multi rix,
|
|
/sbin/mkswap rix,
|
|
/sbin/multipath rix,
|
|
/sbin/multipathd rix,
|
|
/sys/block/ r,
|
|
/sys/class/fc_host/{,**} r,
|
|
/sys/class/iscsi_host/ r,
|
|
/sys/class/iscsi_session/ r,
|
|
/sys/class/iscsi_transport/ r,
|
|
/sys/class/scsi_host/ r,
|
|
/sys/devices/pci*/** r,
|
|
/sys/devices/pci/** r,
|
|
/sys/devices/pci*/**/scan rw,
|
|
/sys/devices/pci*/**/delete rw,
|
|
/sys/devices/platform/** rw,
|
|
/sys/devices/system/cpu/ r,
|
|
/sys/devices/system/cpu/** r,
|
|
/sys/devices/system/node/ r,
|
|
/sys/devices/system/node/** r,
|
|
/sys/devices/virtual/block/dm*/ r,
|
|
/sys/devices/virtual/block/nbd*/ r,
|
|
/sys/devices/virtual/iscsi_transport/** r,
|
|
/sys/devices/virtual/net/** w,
|
|
/sys/module/scsi_transport_iscsi/** r,
|
|
/sys/module/libiscsi/** r,
|
|
/sys/module/libiscsi_tcp/** r,
|
|
/sys/module/iscsi_tcp/** r,
|
|
/tmp/{,**} rw,
|
|
/{usr/,}lib/udev/scsi_id PUx,
|
|
/usr/bin/ r,
|
|
/usr/bin/* rix,
|
|
/usr/lib/gcc/x86_64-linux-gnu/4.8/collect2 rix,
|
|
/usr/lib{,32,64}/** mrw,
|
|
/usr/lib{,32,64}/python{2,3}.[34567]/**.{pyc,so} mrw,
|
|
/var/lib/nova/** rwk,
|
|
{% if virt_type == 'lxd' %}
|
|
/var/lib/lxd/unix.socket rw,
|
|
{% endif %}
|
|
/var/log/nova/nova-compute.log w,
|
|
/var/log/nova/privsep-helper.log w,
|
|
/var/run/libvirt/* rw,
|
|
/var/run/libvirt/libvirt-sock rw,
|
|
/var/run/openvswitch/db.sock rw,
|
|
/var/tmp/{,**} rw,
|
|
{% if ubuntu_release <= '12.04' %}
|
|
/proc/*/mounts r,
|
|
/proc/*/status r,
|
|
{% else %}
|
|
owner @{PROC}/@{pid}/mounts r,
|
|
owner @{PROC}/@{pid}/status r,
|
|
{% endif %}
|
|
/var/lib/charm/*/ceph.conf r,
|
|
/etc/ceph/* r,
|
|
/dev/net/tun rw,
|
|
}
|