Re: [libvirt] [PATCH 1/4] apparmor: Fix parthelper, iohelper and virt-aa-helper paths in profiles

On Tue, Jan 22, 2019 at 03:09:17PM +0100, Christian Ehrhardt wrote: > On Tue, Jan 22, 2019 at 2:40 PM Michal Privoznik <mprivozn(a)redhat.com&gt; wrote: >> >> These helper binaries are installed under libexec dir not lib >> dir. >> >> Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com&gt; >> --- >> src/security/apparmor/usr.lib.libvirt.virt-aa-helper | 2 +- >> src/security/apparmor/usr.sbin.libvirtd | 4 ++-- >> 2 files changed, 3 insertions(+), 3 deletions(-) >> >> diff --git a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper >> index de9436872c..e2c336fca0 100644 >> --- a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper >> +++ b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper >> @@ -33,7 +33,7 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper { >> deny /dev/mapper/ r, >> deny /dev/mapper/* r, >> >> - /usr/{lib,lib64}/libvirt/virt-aa-helper mr, >> + /usr/libexec/virt-aa-helper mr, > > In a common Debian/Ubuntu installation those are in fact in /usr/lib/libvirt/ > So this change would break us. > To me it seems the current content matches the distro's with apparmor in place. > Not sure about Suse here atm. > > But if we are changing that we should consider making this dependent > on --libexecdir as this is where this path really comes from. > And Debian/Ubuntu are setting --libexecdir=\${prefix}/lib/libvirt at > config time. Agreed any path in the apparmour profile that is related to libvirt should be a variable that is substited in at build time to take account of possible distro differences.