apparmor profile libvirt-qemu is too permissive

[Gionatan Danti]

The apparmor dynamic profile template for qemu/kvm virtual machines is too permissive, as it allow *any* guest r/w access to *any* UEFI nvram variable file.

The file /etc/apparmor.d/abstractions/libvirt-qemu grants these accesses:
# required for QEMU accessing UEFI nvram variables
owner /var/lib/libvirt/qemu/nvram/*_VARS.fd rwk,
owner /var/lib/libvirt/qemu/nvram/*_VARS.ms.fd rwk,

This means a malicious guest escaping the virtualization layer can mess with other guests nvram files.

When launching a virtual machines with UEFI platform with default nvram file (ie: no file specified), the machines should only have access to /var/lib/libvirt/qemu/nvram/<vmname>_VARS.fd (ie: /tank/kvm/var/lib/libvirt/qemu/nvram/debian11_VARS.fd)

Interestingly, when specifying a nvram file via the <nvram> tag (ie: <nvram>/var/lib/libvirt/qemu/nvram/debian11_VARS.fd</nvram>) virt-aa-helper does specifically enable the specific file.

So, the best approach seems to:
- remove the wildcard allow from the abstraction/template;
- modify virt-aa-helper to always add the required file even if the <nvram> tag is not present in the guest definition (ie: allow the default path/file)

[Mitchell Dzurick (mitchdz)]

This bug seems to have been unfortunately lost to time, or there is discussion I am not aware of about it.

Gionatan, if there's still desire for this, I suggest making an upstream bug report[0], as these options are not changed by Ubuntu, but rather come from upstream.

I'm setting the bug to Opinion since I think it could be valuable to have a discussion, but ultimately I think these changes should be implemented upstream and then adopted by us.

[0] - https://gitlab.com/groups/libvirt/-/issues

[John Johansen (jjohansen)]

Yeah work needs to be done on this. Ideally it will go into upstream, but I expect we (Canonical/Ubuntu) will have to do the work. The issue is really just one of time, and priority. We have a huge backlog so unless this gets prioritized its not going to happen soon.

[Mitchell Dzurick (mitchdz)]

Thanks John. I'll leave this bug as is, feel free to add any tags/subscriptions to help track it.