Re: [libvirt] [PATCH 01/10] virt-aa-helper: Ask for no deny rule for readonly disk elements

On 15.05.2017 17:48, Guido Günther wrote: > On Mon, May 15, 2017 at 03:23:10PM +0200, Stefan Bader wrote: >> From: Serge Hallyn <serge.hallyn(a)ubuntu.com&gt; >> >> Just because a disk element only requests read access doesn't mean >> there may not be another readwrite request. >> >> Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/bugs/1554031 > > The URL is wrong (drop the "ubuntu" part. From the bug report this looks > like a workaround: Darn, thanks for catching this. > > https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1554031/comments/8 > > or am I misreading this? Shouldn't we only change to 'w' on blockcommit? As I understand it, the 'r' would implicitly add a write deny rule, so it is not possible to override that. With the 'R' notation only a rule allowing read is added. Which allows to change to change to 'w' on blockcommit.

-Stefan > Cheers > -- Guido > >> >> Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com&gt; >> Signed-off-by: Stefan Bader <stefan.bader(a)canonical.com&gt; >> --- >> src/security/virt-aa-helper.c | 4 ++-- >> 1 file changed, 2 insertions(+), 2 deletions(-) >> >> diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c >> index 5f5d1cd..d976a00 100644 >> --- a/src/security/virt-aa-helper.c >> +++ b/src/security/virt-aa-helper.c >> @@ -888,11 +888,11 @@ add_file_path(virDomainDiskDefPtr disk, >> >> if (depth == 0) { >> if (disk->src->readonly) >> - ret = vah_add_file(buf, path, "r"); >> + ret = vah_add_file(buf, path, "R"); >> else >> ret = vah_add_file(buf, path, "rw"); >> } else { >> - ret = vah_add_file(buf, path, "r"); >> + ret = vah_add_file(buf, path, "R"); >> } >> >> if (ret != 0) >> -- >> 2.7.4 >> > > -- > libvir-list mailing list > libvir-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/libvir-list >