Merge pull request #5375 from jandubois/apparmor-allow-lima-mount-points

cidata: allow apparmor mounts on every Lima mount point

hack/test-templates.sh

@@ -64,9 +64,6 @@ declare -A CHECKS=(
 
 case "$NAME" in
 "default")
-	# CI failure:
-	# "[hostagent] failed to confirm whether /c/Users/runneradmin [remote] is successfully mounted"
-	[ "${OS_HOST}" = "Msys" ] && CHECKS["mount-home"]=
 	[ "${OS_HOST}" = "Darwin" ] && CHECKS["ssh-over-vsock"]="1"
 	;;
 "alpine"*)

pkg/cidata/cidata.TEMPLATE.d/boot.Linux/35-setup-packages.sh

@@ -19,13 +19,22 @@ update_fuse_conf() {
 
 	# Some distribution (since Ubuntu-25.04) has an apparmor rule for fusermount3. It causes SSHFS mount failed.
 	# Related Issue: https://github.com/lima-vm/lima/issues/4908
-	# Therefore, define a custom rule to loosen the apparmor rule.
-	if [ -e "/etc/apparmor.d/fusermount3" ] && [ ! -e "/etc/apparmor.d/local/fusermount3" ]; then
-		cat >"/etc/apparmor.d/local/fusermount3" <<EOF
-# The following two lines allow VM to be mounted to / unmounted from home directly.
-mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,noexec,sync) -> @{HOME},
-umount @{HOME},
-EOF
+	# The profile only allows mounting under home, /mnt, /tmp and /media, but a mount point mirrors
+	# the host path, so it can be anywhere, such as /Users/USER from a macOS host or /c/Users/USER
+	# from a Windows one.
+	# Therefore, define a custom rule for each mount point to loosen the apparmor rule.
+	if [ -e "/etc/apparmor.d/fusermount3" ] && [ "${LIMA_CIDATA_MOUNTS}" -gt 0 ]; then
+		{
+			echo "# Lima overwrites this file on every boot."
+			# NOTE: Busybox sh does not support `for ((i=0;i<$N;i++))` form
+			for f in $(seq 0 $((LIMA_CIDATA_MOUNTS - 1))); do
+				mountpointvar="LIMA_CIDATA_MOUNTS_${f}_MOUNTPOINT"
+				mountpoint="$(eval echo \$"$mountpointvar")"
+				# The trailing slash matters because apparmor matches the mount point as a directory.
+				echo "mount fstype=@{fuse_types} options=(nosuid,nodev) options in (ro,rw,noatime,dirsync,nodiratime,noexec,sync) -> \"${mountpoint}/\","
+				echo "umount \"${mountpoint}/\","
+			done
+		} >"/etc/apparmor.d/local/fusermount3"
 		apparmor_parser -r /etc/apparmor.d/fusermount3
 	fi
 }