From: Wolfgang Bumiller <w.bumiller@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH container] fix #6538: apparmor: allow mqueue access
Date: Mon, 21 Jul 2025 17:06:55 +0200 [thread overview]
Message-ID: <20250721150656.291365-1-w.bumiller@proxmox.com> (raw)
With apparmor's 4.0 abi, access to posix message queues (/dev/mqueue)
does not happen just via the path anymore, there's a separate `mqueue`
class. With debian trixie we now have a 4.0 userspace, so we need to
allow this explicitly to get back to the pve-8 state.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
---
src/PVE/LXC.pm | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index ffedcb9..741bb33 100644
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -592,6 +592,11 @@ sub make_apparmor_config {
# code to figure out whether we should warn the user:
my $raw = "lxc.apparmor.profile = generated\n";
+
+ # We use abi/4.0 which has its own mqueue class which governs access to /dev/mqueue now.
+ # This is currently not default in lxc's profile, so we enable it explicitly.
+ $raw .= "lxc.apparmor.raw = allow mqueue,\n";
+
my @profile_uses;
if ($features->{fuse}) {
--
2.47.2
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
next reply other threads:[~2025-07-21 15:05 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-21 15:06 Wolfgang Bumiller [this message]
2025-07-21 15:39 ` [pve-devel] applied: " Thomas Lamprecht
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250721150656.291365-1-w.bumiller@proxmox.com \
--to=w.bumiller@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.