[PATCH v2 6/7] apparmor: Allow some more BIOS/UEFI paths
Michal Privoznik
mprivozn at redhat.com
Wed Feb 12 17:02:57 UTC 2020
On 2/12/20 11:38 AM, Christian Ehrhardt wrote:
>
>
> On Thu, Jan 30, 2020 at 8:05 AM Michal Privoznik <mprivozn at redhat.com
> <mailto:mprivozn at redhat.com>> wrote:
>
> There are two more paths that we are missing in the default
> domain profile: /usr/share/edk2-ovmf/ and /usr/share/sgabios/.
> These exist on my Gentoo box and contain UEFI and BIOS images
> respectively.
>
> Signed-off-by: Michal Privoznik <mprivozn at redhat.com
> <mailto:mprivozn at redhat.com>>
> ---
> src/security/apparmor/libvirt-qemu | 2 ++
> 1 file changed, 2 insertions(+)
>
>
> Hi Michal,
> You might already have abandoned this as I've seen other parts of the
> series land (thanks for the dynamic paths now).But revisiting this I
> found that they seem not needed.
>
> diff --git a/src/security/apparmor/libvirt-qemu
> b/src/security/apparmor/libvirt-qemu
> index 2291829270..6942b83969 100644
> --- a/src/security/apparmor/libvirt-qemu
> +++ b/src/security/apparmor/libvirt-qemu
> @@ -75,6 +75,7 @@
> # access to firmware's etc
> /usr/share/AAVMF/** r,
> /usr/share/bochs/** r,
> + /usr/share/edk2-ovmf/** r,
>
>
> At least on Debian/Ubuntu the multiple edk2 related cases are already
> covered by
>
> 85342a3771b (Guido Günther 2014-04-07 12:15:02 +0200)
> /usr/share/ovmf/** r,
> f9803f59148 (Guido Günther 2017-07-06 11:04:21 +0200)
> /usr/share/OVMF/** r,
> f9803f59148 (Guido Günther 2017-07-06 11:04:21 +0200)
> /usr/share/AAVMF/** r,
> f9803f59148 (Guido Günther 2017-07-06 11:04:21 +0200)
> /usr/share/qemu-efi/** r,
>
> /usr/share/kvm/** r,
> /usr/share/misc/sgabios.bin r,
> /usr/share/openbios/** r,
> @@ -86,6 +87,7 @@
> /usr/share/qemu-kvm/** r,
> /usr/share/qemu/** r,
> /usr/share/seabios/** r,
> + /usr/share/sgabios/** r,
>
>
> Again for Debian/Ubuntu this is already covered by:
> 987d1fdc535 (Guido Günther 2018-01-15 09:44:37 +0100)
> /usr/share/misc/sgabios.bin r,
>
> I guess Suse would have mentioned if the paths would not have worked for
> them.
> Did you have another Distro which uses the paths that try to add here?
I'm not sure what you mean. The commit message says that Gentoo uses
these paths. And indeed it does:
# qlist sys-firmware/edk2-ovmf | grep OVMF_CODE.fd
/usr/share/edk2-ovmf/OVMF_CODE.fd
# qlist sys-firmware/sgabios
/usr/share/sgabios/sgabios.bin
Are you saying that we should remove some other, pre-existing paths from
the file?
Michal
More information about the libvir-list
mailing list