[libvirt] [PATCH 1/8] virt-aa-helper: Ask for no deny rule for readonly disk elements
Stefan Bader
stefan.bader at canonical.com
Thu May 18 08:53:39 UTC 2017
From: Serge Hallyn <serge.hallyn at ubuntu.com>
Just because a disk element only requests read access doesn't mean
there may not be another readwrite request.
Using 'R' when creating the apparmor rule will prevent an implicit
write-deny rule to be created alongside. This does not mean write
is allowed but it would cause a denial message and probably more
relevant, allows to add write access later.
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1554031
Signed-off-by: Christian Ehrhardt <christian.ehrhardt at canonical.com>
Signed-off-by: Stefan Bader <stefan.bader at canonical.com>
---
src/security/virt-aa-helper.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index 5f5d1cd..d976a00 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -888,11 +888,11 @@ add_file_path(virDomainDiskDefPtr disk,
if (depth == 0) {
if (disk->src->readonly)
- ret = vah_add_file(buf, path, "r");
+ ret = vah_add_file(buf, path, "R");
else
ret = vah_add_file(buf, path, "rw");
} else {
- ret = vah_add_file(buf, path, "r");
+ ret = vah_add_file(buf, path, "R");
}
if (ret != 0)
--
2.7.4
More information about the libvir-list
mailing list