On Tue, 2017-10-24 at 16:54 +0200, Christian Ehrhardt wrote:
Hot-adding disks does not parse the full XML to generate apparmor
rules.
Instead it uses -f <PATH> to append a generic rule for that file
path.
580cdaa7: "virt-aa-helper: locking disk files for qemu 2.10"
implemented
the qemu 2.10 requirement to allow locking on disks images that are
part of
the domain xml.
But on attach-device a user will still trigger an apparmor deny by
going
through virt-aa-helper -f, to fix that add the lock "k" permission to
the
append file case of virt-aa-helper.
Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com>
---
src/security/virt-aa-helper.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-
helper.c
index ef1bf01..ee3913d 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -1157,7 +1157,7 @@ get_files(vahControl * ctl)
}
if (ctl->newfile)
- if (vah_add_file(&buf, ctl->newfile, "rw") != 0)
+ if (vah_add_file(&buf, ctl->newfile, "rwk") != 0)
goto cleanup;
if (virBufferError(&buf)) {
@@ -1341,7 +1341,7 @@ main(int argc, char **argv)
vah_error(ctl, 1, _("profile exists"));
if (ctl->append && ctl->newfile) {
- if (vah_add_file(&buf, ctl->newfile, "rw") != 0)
+ if (vah_add_file(&buf, ctl->newfile, "rwk") != 0)
goto cleanup;
} else {
if (ctl->def->virtType == VIR_DOMAIN_VIRT_QEMU ||
This looks good to me. +1
--
Jamie Strandboge |
http://www.canonical.com