[libvirt] [PATCH] virt-aa-helper: fix rules for paths with trailing slash

Ján Tomko jtomko at redhat.com
Wed Jun 24 11:17:43 UTC 2015


On Wed, Jun 24, 2015 at 09:58:45AM +0200, Cédric Bosdonnat wrote:
> Rules generated for a path like '/' were having '//' which isn't
> correct for apparmor. Make virt-aa-helper smarter to avoid these.
> ---
>  src/security/virt-aa-helper.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
> 
> diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
> index 35423b5..9f1c570 100644
> --- a/src/security/virt-aa-helper.c
> +++ b/src/security/virt-aa-helper.c
> @@ -773,6 +773,7 @@ vah_add_path(virBufferPtr buf, const char *path, const char *perms, bool recursi
>      char *tmp = NULL;
>      int rc = -1;
>      bool readonly = true;
> +    bool trailingSlash;
>  
>      if (path == NULL)
>          return rc;
> @@ -809,14 +810,18 @@ vah_add_path(virBufferPtr buf, const char *path, const char *perms, bool recursi
>          goto cleanup;
>      }
>  
> -    virBufferAsprintf(buf, "  \"%s%s\" %s,\n", tmp, recursive ? "/**" : "", perms);
> +    trailingSlash = (tmp[strlen(tmp) - 1] == '/');

Removing the trailing slash here and adding it unconditionally to the
virBufferAsprintf formatting strings would be more readable.

Jan

> +
> +    virBufferAsprintf(buf, "  \"%s%s%s\" %s,\n", tmp, trailingSlash ? "" : "/",
> +                      recursive ? "**" : "", perms);
>      if (readonly) {
>          virBufferAddLit(buf, "  # don't audit writes to readonly files\n");
> -        virBufferAsprintf(buf, "  deny \"%s%s\" w,\n", tmp, recursive ? "/**" : "");
> +        virBufferAsprintf(buf, "  deny \"%s%s%s\" w,\n", tmp,
> +                          trailingSlash ? "" : "/", recursive ? "**" : "");
>      }
>      if (recursive) {
>          /* allow reading (but not creating) the dir */
> -        virBufferAsprintf(buf, "  \"%s/\" r,\n", tmp);
> +        virBufferAsprintf(buf, "  \"%s%s\" r,\n", tmp, trailingSlash ? "" : "/");
>      }
>  
>   cleanup:
> -- 
> 2.1.4
> 
> --
> libvir-list mailing list
> libvir-list at redhat.com
> https://www.redhat.com/mailman/listinfo/libvir-list
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20150624/341b1974/attachment-0001.sig>


More information about the libvir-list mailing list