[PATCH v2 6/7] apparmor: Allow some more BIOS/UEFI paths

Christian Ehrhardt christian.ehrhardt at canonical.com
Wed Feb 12 10:38:51 UTC 2020


On Thu, Jan 30, 2020 at 8:05 AM Michal Privoznik <mprivozn at redhat.com>
wrote:

> There are two more paths that we are missing in the default
> domain profile: /usr/share/edk2-ovmf/ and /usr/share/sgabios/.
> These exist on my Gentoo box and contain UEFI and BIOS images
> respectively.
>
> Signed-off-by: Michal Privoznik <mprivozn at redhat.com>
> ---
>  src/security/apparmor/libvirt-qemu | 2 ++
>  1 file changed, 2 insertions(+)
>
>
Hi Michal,
You might already have abandoned this as I've seen other parts of the
series land (thanks for the dynamic paths now).But revisiting this I found
that they seem not needed.


> diff --git a/src/security/apparmor/libvirt-qemu
> b/src/security/apparmor/libvirt-qemu
> index 2291829270..6942b83969 100644
> --- a/src/security/apparmor/libvirt-qemu
> +++ b/src/security/apparmor/libvirt-qemu
> @@ -75,6 +75,7 @@
>    # access to firmware's etc
>    /usr/share/AAVMF/** r,
>    /usr/share/bochs/** r,
> +  /usr/share/edk2-ovmf/** r,
>

At least on Debian/Ubuntu the multiple edk2 related cases are already
covered by

85342a3771b (Guido Günther    2014-04-07 12:15:02 +0200)
  /usr/share/ovmf/** r,
f9803f59148 (Guido Günther    2017-07-06 11:04:21 +0200)
  /usr/share/OVMF/** r,
f9803f59148 (Guido Günther    2017-07-06 11:04:21 +0200)
   /usr/share/AAVMF/** r,
f9803f59148 (Guido Günther    2017-07-06 11:04:21 +0200)
   /usr/share/qemu-efi/** r,


>    /usr/share/kvm/** r,
>    /usr/share/misc/sgabios.bin r,
>    /usr/share/openbios/** r,
> @@ -86,6 +87,7 @@
>    /usr/share/qemu-kvm/** r,
>    /usr/share/qemu/** r,
>    /usr/share/seabios/** r,
> +  /usr/share/sgabios/** r,
>

Again for Debian/Ubuntu this is already covered by:
987d1fdc535 (Guido Günther    2018-01-15 09:44:37 +0100)
  /usr/share/misc/sgabios.bin r,

I guess Suse would have mentioned if the paths would not have worked for
them.
Did you have another Distro which uses the paths that try to add here?


>    /usr/share/slof/** r,
>    /usr/share/vgabios/** r,
>


-- 
> 2.24.1
>
>

-- 
Christian Ehrhardt
Staff Engineer, Ubuntu Server
Canonical Ltd
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20200212/17292ed7/attachment-0001.htm>


More information about the libvir-list mailing list