Re: [libvirt] [PATCH] apparmor: differentiate between error and unconfined profiles

profile_status function was not making any difference between error cases and unconfined profiles. The problem with this approach is that dominfo was throwing an error on unconfined domains. --- src/security/security_apparmor.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 16b8f87..2cf333d 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -66,10 +66,11 @@ struct SDPDOP { }; /* - * profile_status returns '-1' on error, '0' if loaded + * profile_status returns '-2' on error, '-1' if not loaded, '0' if loaded * - * If check_enforcing is set to '1', then returns '-1' on error, '0' if - * loaded in complain mode, and '1' if loaded in enforcing mode. + * If check_enforcing is set to '1', then returns '-2' on error, '-1' if + * not loaded, '0' if loaded in complain mode, and '1' if loaded in + * enforcing mode. */ static int profile_status(const char *str, const int check_enforcing) @@ -77,7 +78,7 @@ profile_status(const char *str, const int check_enforcing) char *content = NULL; char *tmp = NULL; char *etmp = NULL; - int rc = -1; + int rc = -2;