On 15.05.2017 17:48, Guido Günther wrote:
On Mon, May 15, 2017 at 03:23:10PM +0200, Stefan Bader wrote:
From: Serge Hallyn <serge.hallyn@ubuntu.com>
Just because a disk element only requests read access doesn't mean there may not be another readwrite request.
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/bugs/1554031
The URL is wrong (drop the "ubuntu" part. From the bug report this looks like a workaround:
Darn, thanks for catching this.
https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1554031/comments/8
or am I misreading this? Shouldn't we only change to 'w' on blockcommit?
As I understand it, the 'r' would implicitly add a write deny rule, so it is not possible to override that. With the 'R' notation only a rule allowing read is added. Which allows to change to change to 'w' on blockcommit. -Stefan
Cheers -- Guido
Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com> Signed-off-by: Stefan Bader <stefan.bader@canonical.com> --- src/security/virt-aa-helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 5f5d1cd..d976a00 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -888,11 +888,11 @@ add_file_path(virDomainDiskDefPtr disk,
if (depth == 0) { if (disk->src->readonly) - ret = vah_add_file(buf, path, "r"); + ret = vah_add_file(buf, path, "R"); else ret = vah_add_file(buf, path, "rw"); } else { - ret = vah_add_file(buf, path, "r"); + ret = vah_add_file(buf, path, "R"); }
if (ret != 0) -- 2.7.4
-- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list