[libvirt] [PATCH 01/10] virt-aa-helper: Ask for no deny rule for readonly disk elements

[Guido Günther]

On Mon, May 15, 2017 at 06:07:12PM +0200, Stefan Bader wrote:
> On 15.05.2017 17:48, Guido Günther wrote:
> > On Mon, May 15, 2017 at 03:23:10PM +0200, Stefan Bader wrote:
> >> From: Serge Hallyn <serge.hallyn at ubuntu.com>
> >>
> >> Just because a disk element only requests read access doesn't mean
> >> there may not be another readwrite request.
> >>
> >> Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/bugs/1554031
> > 
> > The URL is wrong (drop the "ubuntu" part. From the bug report this looks
> > like a workaround:
> 
> Darn, thanks for catching this.
> 
> > 
> >      https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1554031/comments/8
> > 
> > or am I misreading this? Shouldn't we only change to 'w' on blockcommit?
> 
> As I understand it, the 'r' would implicitly add a write deny rule, so it is not
> possible to override that. With the 'R' notation only a rule allowing read is
> added. Which allows to change to change to 'w' on blockcommit.

But if we aim for a profile replace on blockcommit [1] the would't matter
since the whole profile would get replaced, wouldn't it?

Cheers,
 -- Guido

[1] I have not checked that that profile replace currenlty happens with
libvirt I'm trying to figure out how we want it to work and then fix the
right place.

> 
> -Stefan
> 
> > Cheers
> >  -- Guido
> > 
> >>
> >> Signed-off-by: Christian Ehrhardt <christian.ehrhardt at canonical.com>
> >> Signed-off-by: Stefan Bader <stefan.bader at canonical.com>
> >> ---
> >>  src/security/virt-aa-helper.c | 4 ++--
> >>  1 file changed, 2 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
> >> index 5f5d1cd..d976a00 100644
> >> --- a/src/security/virt-aa-helper.c
> >> +++ b/src/security/virt-aa-helper.c
> >> @@ -888,11 +888,11 @@ add_file_path(virDomainDiskDefPtr disk,
> >>  
> >>      if (depth == 0) {
> >>          if (disk->src->readonly)
> >> -            ret = vah_add_file(buf, path, "r");
> >> +            ret = vah_add_file(buf, path, "R");
> >>          else
> >>              ret = vah_add_file(buf, path, "rw");
> >>      } else {
> >> -        ret = vah_add_file(buf, path, "r");
> >> +        ret = vah_add_file(buf, path, "R");
> >>      }
> >>  
> >>      if (ret != 0)
> >> -- 
> >> 2.7.4
> >>
> > 
> > --
> > libvir-list mailing list
> > libvir-list at redhat.com
> > https://www.redhat.com/mailman/listinfo/libvir-list
> > 
> 
>