[libvirt] [PATCH] apparmor: allow /usr/lib/qemu/qemu-bridge-helper
This is where e.g. Debian puts it. --- examples/apparmor/usr.sbin.libvirtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd index 8893e75fe..03a80b7e6 100644 --- a/examples/apparmor/usr.sbin.libvirtd +++ b/examples/apparmor/usr.sbin.libvirtd @@ -67,7 +67,7 @@ # allow changing to our UUID-based named profiles change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*, - /usr/{lib,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper, + /usr/{lib,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper, # child profile for bridge helper process profile qemu_bridge_helper { #include <abstractions/base> -- 2.11.0
On Thu, Mar 16, 2017 at 04:53:28PM +0100, Guido Günther wrote:
This is where e.g. Debian puts it. --- examples/apparmor/usr.sbin.libvirtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd index 8893e75fe..03a80b7e6 100644 --- a/examples/apparmor/usr.sbin.libvirtd +++ b/examples/apparmor/usr.sbin.libvirtd @@ -67,7 +67,7 @@ # allow changing to our UUID-based named profiles change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
- /usr/{lib,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper, + /usr/{lib,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper, # child profile for bridge helper process profile qemu_bridge_helper { #include <abstractions/base>
ACK Arguably we could add lib64 too, since its concievable that apparmor is used on distros which do multilib too. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://entangle-photo.org -o- http://search.cpan.org/~danberr/ :|
This is where e.g. Debian puts it. --- This adds lib64 as Dan suggested and also adds these two dirs to the second invocations to make things actually work. examples/apparmor/usr.sbin.libvirtd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd index 8893e75fe..353b039ac 100644 --- a/examples/apparmor/usr.sbin.libvirtd +++ b/examples/apparmor/usr.sbin.libvirtd @@ -67,7 +67,7 @@ # allow changing to our UUID-based named profiles change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*, - /usr/{lib,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper, + /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper, # child profile for bridge helper process profile qemu_bridge_helper { #include <abstractions/base> @@ -83,6 +83,6 @@ /etc/qemu/** r, owner @{PROC}/*/status r, - /usr/{lib,libexec}/qemu-bridge-helper rmix, + /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper rmix, } } -- 2.11.0
On Thu, Mar 16, 2017 at 05:48:47PM +0100, Guido Günther wrote:
This is where e.g. Debian puts it. --- This adds lib64 as Dan suggested and also adds these two dirs to the second invocations to make things actually work.
examples/apparmor/usr.sbin.libvirtd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd index 8893e75fe..353b039ac 100644 --- a/examples/apparmor/usr.sbin.libvirtd +++ b/examples/apparmor/usr.sbin.libvirtd @@ -67,7 +67,7 @@ # allow changing to our UUID-based named profiles change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
- /usr/{lib,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper, + /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper, # child profile for bridge helper process profile qemu_bridge_helper { #include <abstractions/base> @@ -83,6 +83,6 @@ /etc/qemu/** r, owner @{PROC}/*/status r,
- /usr/{lib,libexec}/qemu-bridge-helper rmix, + /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper rmix, } }
ACK Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://entangle-photo.org -o- http://search.cpan.org/~danberr/ :|
On Thu, Mar 16, 2017 at 04:52:04PM +0000, Daniel P. Berrange wrote:
On Thu, Mar 16, 2017 at 05:48:47PM +0100, Guido Günther wrote:
This is where e.g. Debian puts it. --- This adds lib64 as Dan suggested and also adds these two dirs to the second invocations to make things actually work.
examples/apparmor/usr.sbin.libvirtd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd index 8893e75fe..353b039ac 100644 --- a/examples/apparmor/usr.sbin.libvirtd +++ b/examples/apparmor/usr.sbin.libvirtd @@ -67,7 +67,7 @@ # allow changing to our UUID-based named profiles change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
- /usr/{lib,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper, + /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper, # child profile for bridge helper process profile qemu_bridge_helper { #include <abstractions/base> @@ -83,6 +83,6 @@ /etc/qemu/** r, owner @{PROC}/*/status r,
- /usr/{lib,libexec}/qemu-bridge-helper rmix, + /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper rmix, } }
ACK
Pushed. Thanks -- Guido
Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://entangle-photo.org -o- http://search.cpan.org/~danberr/ :|
participants (2)
-
Daniel P. Berrange -
Guido Günther