Re: [PATCH] security: AppArmor allow write when os loader readonly=no

On Tue, Jun 4, 2024 at 1:17 PM Miroslav Los via Devel <devel(a)lists.libvirt.org&gt; wrote: > - if (ctl->def->os.loader && ctl->def->os.loader->path) > - if (vah_add_file(&buf, ctl->def->os.loader->path, "rk") != 0) > + if (ctl->def->os.loader && ctl->def->os.loader->path) { > + bool readonly = false; > + virTristateBoolToBool(ctl->def->os.loader->readonly, &readonly); > + if (vah_add_file(&buf, > + ctl->def->os.loader->path, > + readonly ? "rk" : "rwk") != 0) Not tested, but the approach looks totally reasonable and in line with the usual virt-aa-helper handling of such cases. Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com&gt;