[libvirt] [PATCH] AppArmor: allow QEMU to set_process_name.

[Christian Ehrhardt]

Acked-by: Christian Ehrhardt <christian.ehrhardt at canonical.co>

That (just FYI) is also equivalent to
https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1615550

On Mon, Dec 12, 2016 at 11:59 AM, intrigeri <intrigeri+libvirt at boum.org>
wrote:

> https://bugzilla.redhat.com/show_bug.cgi?id=1369281
> ---
>  examples/apparmor/libvirt-qemu | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-
> qemu
> index 11381d4df0..fdb5a23291 100644
> --- a/examples/apparmor/libvirt-qemu
> +++ b/examples/apparmor/libvirt-qemu
> @@ -21,6 +21,9 @@
>    /dev/ptmx rw,
>    /dev/kqemu rw,
>    @{PROC}/*/status r,
> +  # Per man(5) proc, the kernel enforces that a thread may
> +  # only modify its comm value or those in its thread group.
> +  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
>    @{PROC}/sys/kernel/cap_last_cap r,
>
>    # For hostdev access. The actual devices will be added dynamically
> --
> 2.11.0
>
> --
> libvir-list mailing list
> libvir-list at redhat.com
> https://www.redhat.com/mailman/listinfo/libvir-list
>



-- 
Christian Ehrhardt
Software Engineer, Ubuntu Server
Canonical Ltd
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20161212/8cfa7172/attachment-0001.htm>