[libvirt] [PATCH] virt-aa-helper: Actually fix AppArmor profile
Tried previously in commit b1eb8b3e8fd1d4cb1da8e5e2b16f2c10837fd823 Author: Andrea Bolognani <abologna@redhat.com> Date: Mon Aug 19 10:23:42 2019 +0200 virt-aa-helper: Fix AppArmor profile v5.6.0-243-gb1eb8b3e8f with somewhat disappointing results. Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/security/apparmor/usr.lib.libvirt.virt-aa-helper | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper index d81dddef30..64772f0756 100644 --- a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper +++ b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper @@ -18,8 +18,8 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper { @{PROC}/filesystems r, # Used when internally running another command (namely apparmor_parser) - @{PROC}/self/fd r, - @{PROC}/@{pid}/fd r, + @{PROC}/self/fd/ r, + @{PROC}/@{pid}/fd/ r, /etc/libnl-3/classid r, -- 2.21.0
On Tue, Aug 20, 2019 at 09:56:26AM +0200, Andrea Bolognani wrote:
Tried previously in
commit b1eb8b3e8fd1d4cb1da8e5e2b16f2c10837fd823 Author: Andrea Bolognani <abologna@redhat.com> Date: Mon Aug 19 10:23:42 2019 +0200
virt-aa-helper: Fix AppArmor profile
v5.6.0-243-gb1eb8b3e8f
with somewhat disappointing results.
Third time's the charm!
Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/security/apparmor/usr.lib.libvirt.virt-aa-helper | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Reviewed-by: Ján Tomko <jtomko@redhat.com> Jano
On Tue, 20 Aug 2019, Andrea Bolognani wrote:
--- a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper +++ b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper @@ -18,8 +18,8 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper { @{PROC}/filesystems r,
# Used when internally running another command (namely apparmor_parser) - @{PROC}/self/fd r, - @{PROC}/@{pid}/fd r, + @{PROC}/self/fd/ r,
/proc/self is a 'magic symlink' and apparmor will resolve symlinks before performing checks. As such, @{PROC}/self/fd/ is redundant with the next rule.
+ @{PROC}/@{pid}/fd/ r,
This access LGTM. +1 to apply. -- Jamie Strandboge | http://www.canonical.com
On Tue, 2019-08-20 at 12:09 -0500, Jamie Strandboge wrote:
On Tue, 20 Aug 2019, Andrea Bolognani wrote:
# Used when internally running another command (namely apparmor_parser) + @{PROC}/self/fd/ r,
/proc/self is a 'magic symlink' and apparmor will resolve symlinks before performing checks. As such, @{PROC}/self/fd/ is redundant with the next rule.
+ @{PROC}/@{pid}/fd/ r,
This access LGTM. +1 to apply.
Well, it's already been merged: https://libvirt.org/git/?p=libvirt.git;a=commit;h=9c2446ed4a81450f6482f259f9... I'll post a patch removing the unnecessary rule. -- Andrea Bolognani / Red Hat / Virtualization
participants (3)
-
Andrea Bolognani -
Jamie Strandboge -
Ján Tomko