Re: [libvirt] PATCH 3/4: AppArmor updates

On Mon, 2010-08-16 at 17:15 +0100, Daniel P. Berrange wrote: > On Fri, Aug 13, 2010 at 05:00:06PM -0500, Jamie Strandboge wrote: > > Attached is 0003-apparmor-examples.patch > > Can you include full commit messages with each patch, > since it makes it easier to review & understand, and > will be needed when the patches are applied to GIT. Certainly, and I apologize. Attached is an updated patch with messages. -- Jamie Strandboge | http://www.canonical.com

Author: Jamie Strandboge <jamie(a)canonical.com&gt; Description: AppArmor example profile adjustments: - libvirt-qemu: allow guests setgid and setuid so qemu can drop privileges - virt-aa-helper: + allow access to @{PROC}/[0-9]*/net/psched + allow searching /sys/bus/usb/devices/ + deny access to /dev to suppress confusing, non-fatal profile denials + allow access to user-tmp abstraction Bug-Ubuntu: LP: #579584, LP: #565691 diff -Naurp libvirt.orig/examples/apparmor/libvirt-qemu libvirt/examples/apparmor/libvirt-qemu --- libvirt.orig/examples/apparmor/libvirt-qemu 2010-04-06 16:14:52.000000000 -0500 +++ libvirt/examples/apparmor/libvirt-qemu 2010-08-13 16:46:34.000000000 -0500 @@ -1,4 +1,4 @@ -# Last Modified: Mon Apr 5 15:11:27 2010 +# Last Modified: Fri Aug 13 16:38:32 2010 #include <abstractions/base> #include <abstractions/consoles> @@ -9,6 +9,10 @@ capability dac_read_search, capability chown, + # needed to drop privileges + capability setgid, + capability setuid, + network inet stream, network inet6 stream,