[libvirt] [PATCH 01/10] virt-aa-helper, apparmor: allow /usr/share/OVMF/ too
Guido Günther
agx at sigxcpu.org
Fri Jun 16 08:40:14 UTC 2017
On Fri, Jun 02, 2017 at 08:46:26PM +0200, Guido Günther wrote:
> On Tue, May 23, 2017 at 06:22:39PM +0200, Stefan Bader wrote:
> > From: Simon McVittie <smcv at debian.org>
> >
> > The split firmware and variables files introduced by
> > https://bugs.debian.org/764918 are in a different directory for
> > some reason. Let the virtual machine read both.
> >
> > Signed-off-by: Christian Ehrhardt <christian.ehrhardt at canonical.com>
> > Signed-off-by: Stefan Bader <stefan.bader at canonical.com>
> > ---
> > examples/apparmor/libvirt-qemu | 1 +
> > src/security/virt-aa-helper.c | 1 +
> > tests/virt-aa-helper-test | 7 ++++++-
> > 3 files changed, 8 insertions(+), 1 deletion(-)
> >
> > diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu
> > index a9020aa..e0988bb 100644
> > --- a/examples/apparmor/libvirt-qemu
> > +++ b/examples/apparmor/libvirt-qemu
> > @@ -70,6 +70,7 @@
> > /usr/share/vgabios/** r,
> > /usr/share/seabios/** r,
> > /usr/share/ovmf/** r,
> > + /usr/share/OVMF/** r,
> >
> > # access PKI infrastructure
> > /etc/pki/libvirt-vnc/** r,
> > diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
> > index 5f5d1cd..6c5fc28 100644
> > --- a/src/security/virt-aa-helper.c
> > +++ b/src/security/virt-aa-helper.c
> > @@ -512,6 +512,7 @@ valid_path(const char *path, const bool readonly)
> > "/vmlinuz",
> > "/initrd",
> > "/initrd.img",
> > + "/usr/share/OVMF/", /* for OVMF images */
> > "/usr/share/ovmf/" /* for OVMF images */
> > };
> > /* override the above with these */
> > diff --git a/tests/virt-aa-helper-test b/tests/virt-aa-helper-test
> > index 68e9399..c05afc1 100755
> > --- a/tests/virt-aa-helper-test
> > +++ b/tests/virt-aa-helper-test
> > @@ -296,8 +296,13 @@ if [ -f /usr/share/ovmf/OVMF.fd ]; then
> > -e "s,###DISK###,$disk1,g" \
> > -e "s,</os>,<loader readonly='yes' type='pflash'>/usr/share/ovmf/OVMF.fd</loader></os>,g" "$template_xml" > "$test_xml"
> > testme "0" "ovmf" "-r -u $valid_uuid" "$test_xml"
> > +elif [ -f /usr/share/OVMF/OVMF.fd ]; then
> > + sed -e "s,###UUID###,$uuid,g" \
> > + -e "s,###DISK###,$disk1,g" \
> > + -e "s,</os>,<loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF.fd</loader></os>,g" "$template_xml" > "$test_xml"
> > + testme "0" "ovmf" "-r -u $valid_uuid" "$test_xml"
> > else
> > - echo "Skipping OVMF test. Could not find /usr/share/ovmf/OVMF.fd"
> > + echo "Skipping OVMF test. Could not find /usr/share/ovmf/OVMF.fd or /usr/share/OVMF/OVMF.fd"
> > fi
> >
> > sed -e "s,###UUID###,$uuid,g" -e "s,###DISK###,$disk1,g" -e "s,</os>,<initrd>$tmpdir/initrd</initrd></os>,g" "$template_xml" > "$test_xml"
> > --
> > 2.7.4
> >
> > --
> > libvir-list mailing list
> > libvir-list at redhat.com
> > https://www.redhat.com/mailman/listinfo/libvir-list
> >
> ACK
Pushed. Thanks
-- Guido
.
> -- Guido
>
> --
> libvir-list mailing list
> libvir-list at redhat.com
> https://www.redhat.com/mailman/listinfo/libvir-list
>
More information about the libvir-list
mailing list