Re: [libvirt] [PATCH 1/2] Apparmor qemu abstraction fixes for SLES

On 04/09/2015 04:25 AM, Cédric Bosdonnat wrote: > SLES 11 has legacy qemu-kvm package, /usr/bin/qemu-kvm and > /usr/share/qemu-kvm need to be accessed by domains. > --- > examples/apparmor/libvirt-qemu | 9 +++++++++ > 1 file changed, 9 insertions(+) > It is ok as is, but see my comments below. Acked-By: Jamie Strandboge <jamie(a)canonical.com&gt; > diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu > index 7aad391..a3043dd 100644 > --- a/examples/apparmor/libvirt-qemu > +++ b/examples/apparmor/libvirt-qemu ... > @@ -118,12 +120,19 @@ > /bin/dd rmix, > /bin/cat rmix, > > + # for restore > + /bin/bash rmix, > + This one is curious. You have it with rmix, so it's ok though.

Acked-By: Jamie Strandboge <jamie(a)canonical.com&gt; > # for usb access > /dev/bus/usb/ r, > /etc/udev/udev.conf r, > /sys/bus/ r, > /sys/class/ r, > > + # nscd pieces > + /run/nscd/group r, > + /run/nscd/passwd r, > + These should already be in the nameservice abstraction via this rule: /{var/db,var/cache,var/run,run}/nscd/{passwd,group,services,host} r, which is already included by libvirt-qemu: #include <abstractions/nameservice> It's ok to have duplicates-- apparmor handles them, but perhaps these aren't actually needed?