[libvirt] [PATCH] apparmor: delete profile on VM shutdown
Jim Fehlig
jfehlig at suse.com
Wed Sep 20 04:36:03 UTC 2017
On 09/18/2017 01:24 PM, Guido Günther wrote:
> instead of only unloading it. This makes sure old profiles don't pile up
> in /etc/apparmor.d/libvirt and we get updates to modified templates on
> VM restart.
Makes sense.
> ---
> src/security/security_apparmor.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c
> index 5afe0c5c85..1db94c632f 100644
> --- a/src/security/security_apparmor.c
> +++ b/src/security/security_apparmor.c
> @@ -220,7 +220,7 @@ remove_profile(const char *profile)
> {
> int rc = -1;
> const char * const argv[] = {
> - VIRT_AA_HELPER, "-R", "-u", profile, NULL
> + VIRT_AA_HELPER, "-D", "-u", profile, NULL
I included this patch in my libvirt+apparmor testing and noticed that the
profiles are not deleted when a VM start fails. But that's no fault of your change.
Reviewed-by: Jim Fehlig <jfehlig at suse.com>
More information about the libvir-list
mailing list