cidata: allow apparmor mounts on every Lima mount point - #5375
Conversation
Ubuntu 25.04 added an apparmor profile for fusermount3 that only permits fuse mounts under home, /mnt, /tmp and /media. A Lima mount point mirrors the host path, so it is /Users/USER from a macOS host and /c/Users/USER from a Windows one, and reverse-sshfs mounts fail there with "fusermount3: mount failed: Permission denied". The override added in lima-vm#4968 covered @{HOME} alone, which only ever helped a Linux host. Derive the rules from the cidata mount points instead. Lima rewrites the file only when it recognizes its own header, so a hand-written rule survives and the file never grows. It also recognizes the header lima-vm#4968 wrote, so an instance created by an older Lima picks up the new rules on restart. The Windows QEMU job has had its mount-home check disabled since the job was added, citing this exact failure, which is why it stayed hidden. Re-enable it. Signed-off-by: Jan Dubois <jan.dubois@suse.com>
|
Windows CI failed 4 times |
Expected:
You need to rebase once #5300 is merged (or close and reopen). #5343 exists to show that all tests pass (including the new ones) once the PRs have been merged in sequence. There is also a merge conflict between #5299 and #5337 that needs to be resolved manually when #5337 is to be merged. These are the consequences of splitting the big PR into smaller chunks. I've tried to make things free-standing and non-overlapping as good as I can. The alternative would have been to push all branches to the upstream repo and stack them on top of each other. GitHub doesn't yet support stacked PRs from a fork (github/gh-stack#46 (comment)). |
2 participants
Ubuntu 25.04 added an apparmor profile for fusermount3 permitting fuse mounts only under home,
/mnt,/tmpand/media. A mount point mirrors the host path, which on macOS and Windows falls outside those, so reverse-sshfs mounts fail withfusermount3: mount failed: Permission denied. The #4968 override covered@{HOME}alone, so it only helped Linux hosts.Derive the rules from the cidata mount points instead. Lima rewrites the file only when it recognizes its own header, so a hand-written rule survives and the file never grows, as the #4968 review asked.
The Windows
mount-homecheck has been disabled since that job was added, citing this failure, so re-enable it.The Windows check needs #5300 to pass, so this merges after it. Related: #4810, #4908.
Assisted-by: Claude Opus 5