[libvirt] [PATCH] apparmor: QEMU bridge helper policy updates

[Corey Bryant]

On 03/12/2012 05:07 PM, Corey Bryant wrote:
...
>>> + network inet stream,
>>
>> I understood why net_admin was needed, but this one is less clear. Why
>> does qemu-bridge-helper need this?
>>
>
> Good question. I'm going to test without this and see if it's necessary.
> I'm wondering if it's a subset of net_admin, and I may have added this
> before I added net_admin.
>

I just submitted patch v2.  The only change is addition of the owner 
keyword (see below).

I tested without 'network inet stream' and got an AVC denial so I kept 
it in the policy.  We open an AF_INET/SOCK_STREAM socket in the helper, 
which I believe this maps to.

...
>>> + @{PROC}/*/status r,
>>
>> Is it possible to use this instead:
>> owner @{PROC}/*/status r,
>>
>
> I would imagine this is ok to update with owner. I'll test it out and
> submit a v2 if there aren't any issues.
>


-- 
Regards,
Corey