Re: [libvirt] [patch] Add support for OVMF in virt-aa-helper [Was: [apparmor] virt-aa-helper: does not support OVMF?]
Hi,
Martin Kletzander wrote (13 Aug 2015 07:55:54 GMT) :
Good catch, this makes sense, but to be strictly precise about this,
I
would say this makes the directory accessible for R/W, but readonly
would be enough, wouldn't it?
Yes.
There could be a small code adjustment,
I'd even dare calling it a clean-up, that would make it possible for
this direcotry to be put in the 'restricted_rw'. It would change the
semantic a bit, but since there is no path that could start with
string from both 'restricted' and 'restricted_rw' currently, I don't
see a problem there.
Great idea, the proposed logic looks fine to me. I'm not skilled
enough at C to review the actual patch, though.
Cheers,
--
intrigeri