Re: [PATCH] security: Add support for SUSE edk2 firmware paths

On Thu, Feb 23, 2023 at 11:13:28AM -0700, Jim Fehlig wrote: > +++ b/src/security/apparmor/libvirt-qemu > @@ -91,7 +91,7 @@ > /usr/share/proll/** r, > /usr/share/qemu-efi/** r, > /usr/share/qemu-kvm/** r, > - /usr/share/qemu/** r, > + /usr/share/qemu/** rk, > /usr/share/seabios/** r, > /usr/share/sgabios/** r, > /usr/share/slof/** r, > +++ b/src/security/virt-aa-helper.c > @@ -481,6 +481,7 @@ valid_path(const char *path, const bool readonly) > "/usr/share/AAVMF/", /* for AAVMF images */ > "/usr/share/qemu-efi/", /* for AAVMF images */ > "/usr/share/qemu-efi-aarch64/", /* for AAVMF images */ > + "/usr/share/qemu/", /* SUSE path for OVMF and AAVMF images */ > "/usr/lib/u-boot/", /* u-boot loaders for qemu */ > "/usr/lib/riscv64-linux-gnu/opensbi" /* RISC-V SBI implementation */ Having these files in /usr/share/qemu directly looks... Kinda sketchy? That directory should belong to the QEMU package. Compare with how all the other paths listed here point to directories that are specific to the firmware at hand. I don't think this really opens up any attack vectors, so

Reviewed-by: Andrea Bolognani <abologna(a)redhat.com&gt; but perhaps it would be a good idea to consider migrating edk2 images to their own directory long term?