Re: [libvirt] [PATCH 2/3] Grant access to helpers

On Mon, 2015-01-19 at 18:25 -0700, Mike Latimer wrote: > Apparmor must not prevent access to required helper programs. The > following > > helpers should be allowed to run in unconfined execution mode: > - libvirt_parthelper > - libvirt_iohelper > > --- > > examples/apparmor/usr.sbin.libvirtd | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/examples/apparmor/usr.sbin.libvirtd > b/examples/apparmor/usr.sbin.libvirtd index 9917836..ab6572a 100644 > --- a/examples/apparmor/usr.sbin.libvirtd > +++ b/examples/apparmor/usr.sbin.libvirtd > @@ -57,6 +57,8 @@ > > audit deny /sys/kernel/security/apparmor/.* rwxl, > /sys/kernel/security/apparmor/profiles r, > /usr/{lib,lib64}/libvirt/* PUxr, > > + /usr/{lib,lib64}/libvirt/libvirt_parthelper Ux, > + /usr/{lib,lib64}/libvirt/libvirt_iohelper Ux, > > /etc/libvirt/hooks/** rmix, > /etc/xen/scripts/** rmix, Can't we find a way to have them run with inherited profile (ix)? Letting them run completely unprofiled may not be the best solution.