Re: [libvirt] [PATCH] AppArmor: allow QEMU to set_process_name.

On Mon, Dec 12, 2016 at 02:53:02PM +0100, Christian Ehrhardt wrote: > Acked-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.co&gt; > > That (just FYI) is also equivalent to > https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1615550 > > On Mon, Dec 12, 2016 at 11:59 AM, intrigeri <intrigeri+libvirt(a)boum.org&gt; > wrote: > > > https://bugzilla.redhat.com/show_bug.cgi?id=1369281 > > --- > > examples/apparmor/libvirt-qemu | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt- > > qemu > > index 11381d4df0..fdb5a23291 100644 > > --- a/examples/apparmor/libvirt-qemu > > +++ b/examples/apparmor/libvirt-qemu > > @@ -21,6 +21,9 @@ > > /dev/ptmx rw, > > /dev/kqemu rw, > > @{PROC}/*/status r, > > + # Per man(5) proc, the kernel enforces that a thread may > > + # only modify its comm value or those in its thread group. > > + owner @{PROC}/@{pid}/task/@{tid}/comm rw, > > @{PROC}/sys/kernel/cap_last_cap r, > > > > # For hostdev access. The actual devices will be added dynamically Thanks, I'll push this patch.

Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://entangle-photo.org -o- http://search.cpan.org/~danberr/ :| -- libvir-list mailing list libvir-list(a)redhat.com https://www.redhat.com/mailman/listinfo/libvir-list