[libvirt] [PATCH 4/5] apparmor: add debug traces when changing profile.
The reason for these is that aa-status doesn't show the process using
the profile as they are in another namespace.
---
src/security/security_apparmor.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c
index 14dc707..1c1b128 100644
--- a/src/security/security_apparmor.c
+++ b/src/security/security_apparmor.c
@@ -593,6 +593,7 @@ AppArmorSetSecurityProcessLabel(virSecurityManagerPtr mgr
ATTRIBUTE_UNUSED,
goto cleanup;
}
+ VIR_DEBUG("Changing AppArmor profile to %s", profile_name);
if (aa_change_profile(profile_name) < 0) {
virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
_("error calling aa_change_profile()"));
@@ -618,6 +619,7 @@ AppArmorSetSecurityChildProcessLabel(virSecurityManagerPtr mgr
ATTRIBUTE_UNUSED,
{
int rc = -1;
char *profile_name = NULL;
+ char *cmd_str = NULL;
virSecurityLabelDefPtr secdef =
virDomainDefGetSecurityLabelDef(def, SECURITY_APPARMOR_NAME);
@@ -637,11 +639,14 @@ AppArmorSetSecurityChildProcessLabel(virSecurityManagerPtr mgr
ATTRIBUTE_UNUSED,
if ((profile_name = get_profile_name(def)) == NULL)
goto cleanup;
+ cmd_str = virCommandToString(cmd);
+ VIR_DEBUG("Changing AppArmor profile to %s on %s", profile_name, cmd_str);
virCommandSetAppArmorProfile(cmd, profile_name);
rc = 0;
cleanup:
VIR_FREE(profile_name);
+ VIR_FREE(cmd_str);
return rc;
}
--
1.8.5.2