Re: [PATCH] security: AppArmor allow write when os loader readonly=no

On Tue, Jun 04, 2024 at 02:20:14PM GMT, Christian Ehrhardt wrote: > On Tue, Jun 4, 2024 at 1:17 PM Miroslav Los via Devel <devel(a)lists.libvirt.org&gt; wrote: > > - if (ctl->def->os.loader && ctl->def->os.loader->path) > > - if (vah_add_file(&buf, ctl->def->os.loader->path, "rk") != 0) > > + if (ctl->def->os.loader && ctl->def->os.loader->path) { > > + bool readonly = false; > > + virTristateBoolToBool(ctl->def->os.loader->readonly, &readonly); > > + if (vah_add_file(&buf, > > + ctl->def->os.loader->path, > > + readonly ? "rk" : "rwk") != 0) > > Not tested, but the approach looks totally reasonable and in line with > the usual virt-aa-helper handling of such cases. > > Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com&gt; It looks reasonable to me too, but I'd like to see someone other than the author take it for a spin. Christian, can you please give it a shot? Once we have your Tested-by, I'll happily throw in my Reviewed-by and push the patch.