[libvirt] [PATCH] AppArmor: allow QEMU to set_process_name.
Daniel P. Berrange
berrange at redhat.com
Mon Dec 12 14:09:52 UTC 2016
On Mon, Dec 12, 2016 at 02:53:02PM +0100, Christian Ehrhardt wrote:
> Acked-by: Christian Ehrhardt <christian.ehrhardt at canonical.co>
>
> That (just FYI) is also equivalent to
> https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1615550
>
> On Mon, Dec 12, 2016 at 11:59 AM, intrigeri <intrigeri+libvirt at boum.org>
> wrote:
>
> > https://bugzilla.redhat.com/show_bug.cgi?id=1369281
> > ---
> > examples/apparmor/libvirt-qemu | 3 +++
> > 1 file changed, 3 insertions(+)
> >
> > diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-
> > qemu
> > index 11381d4df0..fdb5a23291 100644
> > --- a/examples/apparmor/libvirt-qemu
> > +++ b/examples/apparmor/libvirt-qemu
> > @@ -21,6 +21,9 @@
> > /dev/ptmx rw,
> > /dev/kqemu rw,
> > @{PROC}/*/status r,
> > + # Per man(5) proc, the kernel enforces that a thread may
> > + # only modify its comm value or those in its thread group.
> > + owner @{PROC}/@{pid}/task/@{tid}/comm rw,
> > @{PROC}/sys/kernel/cap_last_cap r,
> >
> > # For hostdev access. The actual devices will be added dynamically
Thanks, I'll push this patch.
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://entangle-photo.org -o- http://search.cpan.org/~danberr/ :|
More information about the libvir-list
mailing list