[libvirt] [PATCH] virt-aa-helper: Actually fix AppArmor profile

[Jamie Strandboge]

On Tue, 20 Aug 2019, Andrea Bolognani wrote:

> --- a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper
> +++ b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper
> @@ -18,8 +18,8 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper {
>    @{PROC}/filesystems r,
>  
>    # Used when internally running another command (namely apparmor_parser)
> -  @{PROC}/self/fd r,
> -  @{PROC}/@{pid}/fd r,
> +  @{PROC}/self/fd/ r,

/proc/self is a 'magic symlink' and apparmor will resolve symlinks
before performing checks. As such, @{PROC}/self/fd/ is redundant with
the next rule.

> +  @{PROC}/@{pid}/fd/ r,

This access LGTM. +1 to apply.

-- 
Jamie Strandboge             | http://www.canonical.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20190820/c2b029ba/attachment-0001.sig>