[libvirt] [PATCH 2/5] virt-aa-helper: /etc/libvirt-sandbox/services isn't restricted

[Cedric Bosdonnat]

On Tue, 2014-11-25 at 08:05 +0100, Martin Kletzander wrote:
> On Mon, Nov 24, 2014 at 09:54:43PM +0100, Cédric Bosdonnat wrote:
> >To get virt-sandbox-service working with AppArmor, virt-aa-helper
> >needs not to choke on path in /etc/libvirt-sandbox/services.
> >---
> > src/security/virt-aa-helper.c | 8 ++++++--
> > 1 file changed, 6 insertions(+), 2 deletions(-)
> >
> >diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
> >index 81f9f40..9c9e570 100644
> >--- a/src/security/virt-aa-helper.c
> >+++ b/src/security/virt-aa-helper.c
> >@@ -608,8 +608,12 @@ valid_path(const char *path, const bool readonly)
> >
> >     npaths = sizeof(restricted)/sizeof(*(restricted));
> >     if (array_starts_with(path, restricted, npaths) == 0 &&
> >-        array_starts_with(path, override, opaths) != 0)
> >-            return 1;
> >+        array_starts_with(path, override, opaths) != 0) {
> >+
> >+            /* We want to have virt-sandbox services config allowed */
> >+            if (!STRPREFIX(path, "/etc/libvirt-sandbox/services/"))
> >+                return 1;
> >+    }
> >
> 
> Isn't this what override[] is there for?  It'd be way easier to read
> if it's just added there.

Oh indeed! I overlooked that one. I'll change that.

--
Cedric