[libvirt] [PATCH 01/10] virt-aa-helper: Ask for no deny rule for readonly disk elements
Stefan Bader
stefan.bader at canonical.com
Mon May 15 16:07:12 UTC 2017
On 15.05.2017 17:48, Guido Günther wrote:
> On Mon, May 15, 2017 at 03:23:10PM +0200, Stefan Bader wrote:
>> From: Serge Hallyn <serge.hallyn at ubuntu.com>
>>
>> Just because a disk element only requests read access doesn't mean
>> there may not be another readwrite request.
>>
>> Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/bugs/1554031
>
> The URL is wrong (drop the "ubuntu" part. From the bug report this looks
> like a workaround:
Darn, thanks for catching this.
>
> https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1554031/comments/8
>
> or am I misreading this? Shouldn't we only change to 'w' on blockcommit?
As I understand it, the 'r' would implicitly add a write deny rule, so it is not
possible to override that. With the 'R' notation only a rule allowing read is
added. Which allows to change to change to 'w' on blockcommit.
-Stefan
> Cheers
> -- Guido
>
>>
>> Signed-off-by: Christian Ehrhardt <christian.ehrhardt at canonical.com>
>> Signed-off-by: Stefan Bader <stefan.bader at canonical.com>
>> ---
>> src/security/virt-aa-helper.c | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
>> index 5f5d1cd..d976a00 100644
>> --- a/src/security/virt-aa-helper.c
>> +++ b/src/security/virt-aa-helper.c
>> @@ -888,11 +888,11 @@ add_file_path(virDomainDiskDefPtr disk,
>>
>> if (depth == 0) {
>> if (disk->src->readonly)
>> - ret = vah_add_file(buf, path, "r");
>> + ret = vah_add_file(buf, path, "R");
>> else
>> ret = vah_add_file(buf, path, "rw");
>> } else {
>> - ret = vah_add_file(buf, path, "r");
>> + ret = vah_add_file(buf, path, "R");
>> }
>>
>> if (ret != 0)
>> --
>> 2.7.4
>>
>
> --
> libvir-list mailing list
> libvir-list at redhat.com
> https://www.redhat.com/mailman/listinfo/libvir-list
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20170515/51acbc81/attachment-0001.sig>
More information about the libvir-list
mailing list