Re: [PATCH v2 6/7] apparmor: Allow some more BIOS/UEFI paths

On Thu, Jan 30, 2020 at 8:05 AM Michal Privoznik <mprivozn(a)redhat.com <mailto:mprivozn@redhat.com>> wrote: There are two more paths that we are missing in the default domain profile: /usr/share/edk2-ovmf/ and /usr/share/sgabios/. These exist on my Gentoo box and contain UEFI and BIOS images respectively. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com <mailto:mprivozn@redhat.com>> ---  src/security/apparmor/libvirt-qemu | 2 ++  1 file changed, 2 insertions(+) Hi Michal, You might already have abandoned this as I've seen other parts of the series land (thanks for the dynamic paths now).But revisiting this I found that they seem not needed. diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu index 2291829270..6942b83969 100644 --- a/src/security/apparmor/libvirt-qemu +++ b/src/security/apparmor/libvirt-qemu @@ -75,6 +75,7 @@    # access to firmware's etc    /usr/share/AAVMF/** r,    /usr/share/bochs/** r, +  /usr/share/edk2-ovmf/** r, At least on Debian/Ubuntu the multiple edk2 related cases are already covered by 85342a3771b (Guido Günther    2014-04-07 12:15:02 +0200)   /usr/share/ovmf/** r, f9803f59148 (Guido Günther    2017-07-06 11:04:21 +0200)   /usr/share/OVMF/** r, f9803f59148 (Guido Günther    2017-07-06 11:04:21 +0200)    /usr/share/AAVMF/** r, f9803f59148 (Guido Günther    2017-07-06 11:04:21 +0200)    /usr/share/qemu-efi/** r,    /usr/share/kvm/** r,    /usr/share/misc/sgabios.bin r,    /usr/share/openbios/** r, @@ -86,6 +87,7 @@    /usr/share/qemu-kvm/** r,    /usr/share/qemu/** r,    /usr/share/seabios/** r, +  /usr/share/sgabios/** r, Again for Debian/Ubuntu this is already covered by: 987d1fdc535 (Guido Günther    2018-01-15 09:44:37 +0100)   /usr/share/misc/sgabios.bin r, I guess Suse would have mentioned if the paths would not have worked for them. Did you have another Distro which uses the paths that try to add here?