Add AppArmor confinement for Qemu, Qemu-img and DNSMasq #995

gerboland · 2019-08-26T14:43:21Z

ProcessFactory will return AppArmor-wrapped Processes if using qemu backend or DISABLE_APPARMOR env var set.
On creation these Processes install the AppArmor profile defined in the ProcessSpec, and executes the binary within this confinement. On Process deletion, the AppArmor profile is uninstalled.
Add AppArmor profiles for Qemu, Qemu-img and DNSMasq

For testing, I needed to add mpt::ResetProcessFactory to ensure the ProcessFactory is reset before & after the test suite runs.

Tip for reviewing:

Use sudo aa-status to check the list of AppArmor profiles loaded. The multipass profiles will be in enforce mode (except multipassd, as it's classicly confined still). PIDs being confined are listed after the profile name.

- ProcessFactory will return AppArmor-wrapped Processes if using qemu backend. - On creation these Processes install the AppArmor profile defined in the ProcessSpec, and executes the binary within this confinement. On Process deletion, the AppArmor profile is uninstalled. - Add AppArmor profiles for Qemu, Qemu-img and DNSMasq

…ions

Saviq · 2019-08-26T15:53:35Z

Available in the edge/strict channel now: edge/strict 0.9.0-dev.84+g5702c72 1082

codecov · 2019-08-27T11:31:11Z

Codecov Report

Merging #995 into master will increase coverage by 0.14%.
The diff coverage is 82.89%.

@@            Coverage Diff             @@
##           master     #995      +/-   ##
==========================================
+ Coverage   69.43%   69.58%   +0.14%     
==========================================
  Files         191      193       +2     
  Lines        6992     7114     +122     
==========================================
+ Hits         4855     4950      +95     
- Misses       2137     2164      +27

Impacted Files	Coverage Δ
src/platform/backends/qemu/qemu_vm_process_spec.h	`50% <ø> (ø)`	⬆️
include/multipass/process.h	`0% <ø> (ø)`	⬆️
...tform/backends/shared/linux/qemuimg_process_spec.h	`0% <ø> (ø)`	⬆️
src/platform/backends/shared/linux/process_spec.h	`0% <ø> (-50%)`	⬇️
src/platform/backends/qemu/dnsmasq_process_spec.h	`0% <ø> (-100%)`	⬇️
...c/platform/backends/shared/linux/process_factory.h	`0% <ø> (ø)`	⬆️
...rc/platform/backends/qemu/qemu_vm_process_spec.cpp	`98.63% <100%> (+0.35%)`	⬆️
src/platform/backends/shared/linux/apparmor.h	`100% <100%> (ø)`
...rc/platform/backends/qemu/dnsmasq_process_spec.cpp	`95% <100%> (+4.09%)`	⬆️
...orm/backends/qemu/qemu_virtual_machine_factory.cpp	`87.42% <100%> (+0.88%)`	⬆️
... and 20 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3035bbd...f2d30ee. Read the comment docs.

codecov · 2019-08-27T11:31:11Z

Codecov Report

Merging #995 into master will increase coverage by 0.2%.
The diff coverage is 81.29%.

@@            Coverage Diff            @@
##           master     #995     +/-   ##
=========================================
+ Coverage   69.43%   69.64%   +0.2%     
=========================================
  Files         191      193      +2     
  Lines        6992     7116    +124     
=========================================
+ Hits         4855     4956    +101     
- Misses       2137     2160     +23

Impacted Files	Coverage Δ
src/platform/backends/qemu/qemu_vm_process_spec.h	`50% <ø> (ø)`	⬆️
include/multipass/process.h	`0% <ø> (ø)`	⬆️
...tform/backends/shared/linux/qemuimg_process_spec.h	`0% <ø> (ø)`	⬆️
src/platform/backends/shared/linux/process_spec.h	`0% <ø> (-50%)`	⬇️
src/platform/backends/qemu/dnsmasq_process_spec.h	`0% <ø> (-100%)`	⬇️
...c/platform/backends/shared/linux/process_factory.h	`0% <ø> (ø)`	⬆️
...rc/platform/backends/qemu/qemu_vm_process_spec.cpp	`98.63% <100%> (+0.35%)`	⬆️
src/platform/backends/shared/linux/apparmor.h	`100% <100%> (ø)`
...rc/platform/backends/qemu/dnsmasq_process_spec.cpp	`93.54% <100%> (+2.63%)`	⬆️
...orm/backends/qemu/qemu_virtual_machine_factory.cpp	`86.62% <100%> (+0.08%)`	⬆️
... and 12 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 31e7307...6c60c3e. Read the comment docs.

gerboland · 2019-08-27T15:35:25Z

CI unhappy I believe due to #995

ricab · 2019-08-27T15:38:25Z

CI unhappy I believe due to #995

#995 is this pull :)

gerboland · 2019-08-27T15:39:42Z

D'oh, darn autocomplete. I meant #998 Thanks @ricab

gerboland · 2019-08-28T15:32:17Z

Good to review, only Mac failing in CI due to conflict

townsend2010

Looks really good. Just a few minor inline comments and/or questions.

snap/snapcraft.yaml

src/platform/backends/qemu/qemu_virtual_machine.cpp

src/platform/backends/qemu/dnsmasq_process_spec.cpp

src/platform/backends/shared/linux/linux_process.cpp

townsend2010

Ok, I'm good with this. I would like another set of eyes on this since it's a large-ish change.

@ricab, do you have any spare cycles to review? If not, then we'll just merge it as-is.

townsend2010

Now that I think about it, I had one question below pertaining to the libvirt backend.

src/platform/backends/shared/linux/process_factory.cpp

ricab · 2019-08-29T14:46:17Z

@townsend2010 I'd have to allocate a whole chunk of time to parse this, so I'd leave this one up to you if that is ok...

townsend2010 · 2019-08-29T14:52:17Z

@ricab, ack, will just approve then.

townsend2010 · 2019-08-29T14:52:32Z

Let's do it!

bors r+

995: Add AppArmor confinement for Qemu, Qemu-img and DNSMasq r=townsend2010 a=gerboland - ProcessFactory will return AppArmor-wrapped Processes if using qemu backend or DISABLE_APPARMOR env var set. - On creation these Processes install the AppArmor profile defined in the ProcessSpec, and executes the binary within this confinement. On Process deletion, the AppArmor profile is uninstalled. - Add AppArmor profiles for Qemu, Qemu-img and DNSMasq For testing, I needed to add mpt::ResetProcessFactory to ensure the ProcessFactory is reset before & after the test suite runs. Co-authored-by: Gerry Boland <[email protected]>

bors · 2019-08-29T15:13:56Z

Build failed

continuous-integration/travis-ci/push

gerboland added 3 commits August 26, 2019 15:04

Merge master - core->core18 transition required AppArmor rule alterat…

4ae004a

…ions

Reduce delta

5702c72

Merge master, resolve conflicts and adjust DNSMasq to suit

f2d30ee

gerboland force-pushed the introduce-apparmor branch from 702f202 to f2d30ee Compare August 27, 2019 15:34

Merge branch 'master' into introduce-apparmor, should fix racey test

01903b0

townsend2010 self-assigned this Aug 28, 2019

townsend2010 reviewed Aug 28, 2019

View reviewed changes

snap/snapcraft.yaml Show resolved Hide resolved

src/platform/backends/qemu/qemu_virtual_machine.cpp Show resolved Hide resolved

src/platform/backends/qemu/dnsmasq_process_spec.cpp Show resolved Hide resolved

src/platform/backends/shared/linux/linux_process.cpp Outdated Show resolved Hide resolved

gerboland added 2 commits August 29, 2019 12:29

snapcraft: can use $SNAPCRAFT_ARCH_TRIPLET in layout

4036419

Remove superfluous include

6c60c3e

townsend2010 approved these changes Aug 29, 2019

View reviewed changes

townsend2010 reviewed Aug 29, 2019

View reviewed changes

src/platform/backends/shared/linux/process_factory.cpp Show resolved Hide resolved

gerboland merged commit 6c60c3e into master Aug 29, 2019

bors bot deleted the introduce-apparmor branch August 29, 2019 15:59

Add AppArmor confinement for Qemu, Qemu-img and DNSMasq #995

Add AppArmor confinement for Qemu, Qemu-img and DNSMasq #995

Uh oh!

Conversation

gerboland commented Aug 26, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Saviq commented Aug 26, 2019

Uh oh!

codecov bot commented Aug 27, 2019

Codecov Report

Uh oh!

codecov bot commented Aug 27, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

gerboland commented Aug 27, 2019

Uh oh!

ricab commented Aug 27, 2019

Uh oh!

gerboland commented Aug 27, 2019

Uh oh!

gerboland commented Aug 28, 2019

Uh oh!

townsend2010 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

townsend2010 left a comment

Choose a reason for hiding this comment

Uh oh!

townsend2010 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ricab commented Aug 29, 2019

Uh oh!

townsend2010 commented Aug 29, 2019

Uh oh!

townsend2010 commented Aug 29, 2019

Uh oh!

bors bot commented Aug 29, 2019

Build failed

Uh oh!

Uh oh!

gerboland commented Aug 26, 2019 •

edited

Loading

codecov bot commented Aug 27, 2019 •

edited

Loading