[PATCH v2 6/7] apparmor: Allow some more BIOS/UEFI paths

Michal Privoznik mprivozn at redhat.com
Wed Feb 12 17:02:57 UTC 2020


On 2/12/20 11:38 AM, Christian Ehrhardt wrote:
> 
> 
> On Thu, Jan 30, 2020 at 8:05 AM Michal Privoznik <mprivozn at redhat.com 
> <mailto:mprivozn at redhat.com>> wrote:
> 
>     There are two more paths that we are missing in the default
>     domain profile: /usr/share/edk2-ovmf/ and /usr/share/sgabios/.
>     These exist on my Gentoo box and contain UEFI and BIOS images
>     respectively.
> 
>     Signed-off-by: Michal Privoznik <mprivozn at redhat.com
>     <mailto:mprivozn at redhat.com>>
>     ---
>       src/security/apparmor/libvirt-qemu | 2 ++
>       1 file changed, 2 insertions(+)
> 
> 
> Hi Michal,
> You might already have abandoned this as I've seen other parts of the 
> series land (thanks for the dynamic paths now).But revisiting this I 
> found that they seem not needed.
> 
>     diff --git a/src/security/apparmor/libvirt-qemu
>     b/src/security/apparmor/libvirt-qemu
>     index 2291829270..6942b83969 100644
>     --- a/src/security/apparmor/libvirt-qemu
>     +++ b/src/security/apparmor/libvirt-qemu
>     @@ -75,6 +75,7 @@
>         # access to firmware's etc
>         /usr/share/AAVMF/** r,
>         /usr/share/bochs/** r,
>     +  /usr/share/edk2-ovmf/** r,
> 
> 
> At least on Debian/Ubuntu the multiple edk2 related cases are already 
> covered by
> 
> 85342a3771b (Guido Günther    2014-04-07 12:15:02 +0200)
>    /usr/share/ovmf/** r,
> f9803f59148 (Guido Günther    2017-07-06 11:04:21 +0200)
>    /usr/share/OVMF/** r,
> f9803f59148 (Guido Günther    2017-07-06 11:04:21 +0200)
>     /usr/share/AAVMF/** r,
> f9803f59148 (Guido Günther    2017-07-06 11:04:21 +0200)
>     /usr/share/qemu-efi/** r,
> 
>         /usr/share/kvm/** r,
>         /usr/share/misc/sgabios.bin r,
>         /usr/share/openbios/** r,
>     @@ -86,6 +87,7 @@
>         /usr/share/qemu-kvm/** r,
>         /usr/share/qemu/** r,
>         /usr/share/seabios/** r,
>     +  /usr/share/sgabios/** r,
> 
> 
> Again for Debian/Ubuntu this is already covered by:
> 987d1fdc535 (Guido Günther    2018-01-15 09:44:37 +0100)
>    /usr/share/misc/sgabios.bin r,
> 
> I guess Suse would have mentioned if the paths would not have worked for 
> them.
> Did you have another Distro which uses the paths that try to add here?


I'm not sure what you mean. The commit message says that Gentoo uses 
these paths. And indeed it does:

# qlist sys-firmware/edk2-ovmf | grep OVMF_CODE.fd
/usr/share/edk2-ovmf/OVMF_CODE.fd

# qlist sys-firmware/sgabios
/usr/share/sgabios/sgabios.bin

Are you saying that we should remove some other, pre-existing paths from 
the file?

Michal




More information about the libvir-list mailing list