[libvirt] [PATCH 1/1] virt-aa-helper: support OVMF
As suggested by Jamie Strandboge in https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1483071 Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> --- src/security/virt-aa-helper.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 5de56e5..bddcbdc 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -575,7 +575,8 @@ valid_path(const char *path, const bool readonly) /* override the above with these */ const char * const override[] = { "/sys/devices/pci", /* for hostdev pci devices */ - "/etc/libvirt-sandbox/services/" /* for virt-sandbox service config */ + "/etc/libvirt-sandbox/services/", /* for virt-sandbox service config */ + "/usr/share/ovmf/" /* for OVMF images */ }; const int nropaths = ARRAY_CARDINALITY(restricted); -- 2.5.0
On Mon, Nov 16, 2015 at 05:59:08PM +0000, Serge Hallyn wrote:
As suggested by Jamie Strandboge in
https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1483071
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> --- src/security/virt-aa-helper.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 5de56e5..bddcbdc 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -575,7 +575,8 @@ valid_path(const char *path, const bool readonly) /* override the above with these */ const char * const override[] = { "/sys/devices/pci", /* for hostdev pci devices */ - "/etc/libvirt-sandbox/services/" /* for virt-sandbox service config */ + "/etc/libvirt-sandbox/services/", /* for virt-sandbox service config */ + "/usr/share/ovmf/" /* for OVMF images */ };
const int nropaths = ARRAY_CARDINALITY(restricted);
We have this in restriced_rw already, isn't this sufficient? Among other things to fix https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1483071 Cheers, -- Guido
Quoting Guido Günther (agx@sigxcpu.org):
On Mon, Nov 16, 2015 at 05:59:08PM +0000, Serge Hallyn wrote:
As suggested by Jamie Strandboge in
https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1483071
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> --- src/security/virt-aa-helper.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 5de56e5..bddcbdc 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -575,7 +575,8 @@ valid_path(const char *path, const bool readonly) /* override the above with these */ const char * const override[] = { "/sys/devices/pci", /* for hostdev pci devices */ - "/etc/libvirt-sandbox/services/" /* for virt-sandbox service config */ + "/etc/libvirt-sandbox/services/", /* for virt-sandbox service config */ + "/usr/share/ovmf/" /* for OVMF images */ };
const int nropaths = ARRAY_CARDINALITY(restricted);
We have this in restriced_rw already, isn't this sufficient? Among other
Hm, yeah, how did i miss that - yes that suffices, thanks.
participants (2)
-
Guido Günther -
Serge Hallyn