[libvirt] [PATCH 01/10] virt-aa-helper: Ask for no deny rule for readonly disk elements

[Guido Günther]

On Mon, May 15, 2017 at 03:23:10PM +0200, Stefan Bader wrote:
> From: Serge Hallyn <serge.hallyn at ubuntu.com>
> 
> Just because a disk element only requests read access doesn't mean
> there may not be another readwrite request.
> 
> Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/bugs/1554031

The URL is wrong (drop the "ubuntu" part. From the bug report this looks
like a workaround:

     https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1554031/comments/8

or am I misreading this? Shouldn't we only change to 'w' on blockcommit?
Cheers
 -- Guido

> 
> Signed-off-by: Christian Ehrhardt <christian.ehrhardt at canonical.com>
> Signed-off-by: Stefan Bader <stefan.bader at canonical.com>
> ---
>  src/security/virt-aa-helper.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
> index 5f5d1cd..d976a00 100644
> --- a/src/security/virt-aa-helper.c
> +++ b/src/security/virt-aa-helper.c
> @@ -888,11 +888,11 @@ add_file_path(virDomainDiskDefPtr disk,
>  
>      if (depth == 0) {
>          if (disk->src->readonly)
> -            ret = vah_add_file(buf, path, "r");
> +            ret = vah_add_file(buf, path, "R");
>          else
>              ret = vah_add_file(buf, path, "rw");
>      } else {
> -        ret = vah_add_file(buf, path, "r");
> +        ret = vah_add_file(buf, path, "R");
>      }
>  
>      if (ret != 0)
> -- 
> 2.7.4
>