| Message ID | 4f29d3bf533c9b30482b9a7fe72e454058962434.1570645360.git.crobinso@redhat.com |
|---|---|
| State | Accepted |
| Commit | 4dfc4d525e630382cbdb98a53280a64b81782be3 |
| Headers | show |
| Series | security: apparmor: Allow RO /usr/share/edk2/ | expand |
On 10/9/19 8:24 PM, Cole Robinson wrote: > On Fedora, already whitelisted paths to AAVMF and OVMF binaries > are symlinks to binaries under /usr/share/edk2/. Add that directory > to the RO whitelist so virt-aa-helper-test passes > > Signed-off-by: Cole Robinson <crobinso@redhat.com> > --- > I don't know if anyone is actually using apparmor on Fedora, but > I have the libs installed now for testing. I think the better thing > to do would be to adjust virt-aa-helper-test to not touch host > state Oh yeah, definitely. But since majority of libvirt contributors come from distros that don't use AppArmor, it doesn't get as many attention. > > src/security/virt-aa-helper.c | 1 + > 1 file changed, 1 insertion(+) Reviewed-by: Michal Privoznik <mprivozn@redhat.com> Michal -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index d9f6b5638b..509187ac36 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -505,6 +505,7 @@ valid_path(const char *path, const bool readonly) "/vmlinuz", "/initrd", "/initrd.img", + "/usr/share/edk2/", "/usr/share/OVMF/", /* for OVMF images */ "/usr/share/ovmf/", /* for OVMF images */ "/usr/share/AAVMF/", /* for AAVMF images */
On Fedora, already whitelisted paths to AAVMF and OVMF binaries are symlinks to binaries under /usr/share/edk2/. Add that directory to the RO whitelist so virt-aa-helper-test passes Signed-off-by: Cole Robinson <crobinso@redhat.com> --- I don't know if anyone is actually using apparmor on Fedora, but I have the libs installed now for testing. I think the better thing to do would be to adjust virt-aa-helper-test to not touch host state src/security/virt-aa-helper.c | 1 + 1 file changed, 1 insertion(+) -- 2.23.0 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list