Re: [libvirt] [PATCH 2/5] virt-aa-helper: /etc/libvirt-sandbox/services isn't restricted

On Mon, Nov 24, 2014 at 09:54:43PM +0100, Cédric Bosdonnat wrote: >To get virt-sandbox-service working with AppArmor, virt-aa-helper >needs not to choke on path in /etc/libvirt-sandbox/services. >--- > src/security/virt-aa-helper.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > >diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c >index 81f9f40..9c9e570 100644 >--- a/src/security/virt-aa-helper.c >+++ b/src/security/virt-aa-helper.c >@@ -608,8 +608,12 @@ valid_path(const char *path, const bool readonly) > > npaths = sizeof(restricted)/sizeof(*(restricted)); > if (array_starts_with(path, restricted, npaths) == 0 && >- array_starts_with(path, override, opaths) != 0) >- return 1; >+ array_starts_with(path, override, opaths) != 0) { >+ >+ /* We want to have virt-sandbox services config allowed */ >+ if (!STRPREFIX(path, "/etc/libvirt-sandbox/services/")) >+ return 1; >+ } > Isn't this what override[] is there for? It'd be way easier to read if it's just added there.