[libvirt] [PATCH 1/2] Apparmor qemu abstraction fixes for SLES

[Jamie Strandboge]

On 04/09/2015 04:25 AM, Cédric Bosdonnat wrote:
> SLES 11 has legacy qemu-kvm package, /usr/bin/qemu-kvm and
> /usr/share/qemu-kvm need to be accessed by domains.
> ---
>  examples/apparmor/libvirt-qemu | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 

It is ok as is, but see my comments below.

Acked-By: Jamie Strandboge <jamie at canonical.com>

> diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu
> index 7aad391..a3043dd 100644
> --- a/examples/apparmor/libvirt-qemu
> +++ b/examples/apparmor/libvirt-qemu

...

> @@ -118,12 +120,19 @@
>    /bin/dd rmix,
>    /bin/cat rmix,
>  
> +  # for restore
> +  /bin/bash rmix,
> +

This one is curious. You have it with rmix, so it's ok though.

Acked-By: Jamie Strandboge <jamie at canonical.com>

>    # for usb access
>    /dev/bus/usb/ r,
>    /etc/udev/udev.conf r,
>    /sys/bus/ r,
>    /sys/class/ r,
>  
> +  # nscd pieces
> +  /run/nscd/group r,
> +  /run/nscd/passwd r,
> +

These should already be in the nameservice abstraction via this rule:
/{var/db,var/cache,var/run,run}/nscd/{passwd,group,services,host}    r,

which is already included by libvirt-qemu:
  #include <abstractions/nameservice>

It's ok to have duplicates-- apparmor handles them, but perhaps these aren't
actually needed?

-- 
Jamie Strandboge                 http://www.ubuntu.com/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20150409/a3a890dc/attachment-0001.sig>