1. Patchew
  2. Libvirt
  3. View series

[libvirt] [PATCH] apparmor: allow /usr/lib/qemu/qemu-bridge-helper

Guido Günther posted 1 patch 7 years, 1 month ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/libvirt tags/patchew/20170316155328.4ae6f4omk4n4umpa@bogon.m.sigxcpu.org
There is a newer version of this series
examples/apparmor/usr.sbin.libvirtd | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
[libvirt] [PATCH] apparmor: allow /usr/lib/qemu/qemu-bridge-helper
Posted by Guido Günther 7 years, 1 month ago 
This is where e.g. Debian puts it.
---
 examples/apparmor/usr.sbin.libvirtd | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd
index 8893e75fe..03a80b7e6 100644
--- a/examples/apparmor/usr.sbin.libvirtd
+++ b/examples/apparmor/usr.sbin.libvirtd
@@ -67,7 +67,7 @@
   # allow changing to our UUID-based named profiles
   change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
 
-  /usr/{lib,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
+  /usr/{lib,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
   # child profile for bridge helper process
   profile qemu_bridge_helper {
    #include <abstractions/base>
-- 
2.11.0

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list
Re: [libvirt] [PATCH] apparmor: allow /usr/lib/qemu/qemu-bridge-helper
Posted by Daniel P. Berrange 7 years, 1 month ago 
On Thu, Mar 16, 2017 at 04:53:28PM +0100, Guido Günther wrote:
> This is where e.g. Debian puts it.
> ---
>  examples/apparmor/usr.sbin.libvirtd | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd
> index 8893e75fe..03a80b7e6 100644
> --- a/examples/apparmor/usr.sbin.libvirtd
> +++ b/examples/apparmor/usr.sbin.libvirtd
> @@ -67,7 +67,7 @@
>    # allow changing to our UUID-based named profiles
>    change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
>  
> -  /usr/{lib,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
> +  /usr/{lib,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
>    # child profile for bridge helper process
>    profile qemu_bridge_helper {
>     #include <abstractions/base>

ACK

Arguably we could add  lib64 too, since its concievable that apparmor
is used on distros which do multilib too.

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://entangle-photo.org       -o-    http://search.cpan.org/~danberr/ :|

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list
[libvirt] [PATCH v2] apparmor: allow /usr/lib/qemu/qemu-bridge-helper
Posted by Guido Günther 7 years, 1 month ago 
This is where e.g. Debian puts it.
---
This adds lib64 as Dan suggested and also adds these two dirs to the
second invocations to make things actually work.

 examples/apparmor/usr.sbin.libvirtd | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd
index 8893e75fe..353b039ac 100644
--- a/examples/apparmor/usr.sbin.libvirtd
+++ b/examples/apparmor/usr.sbin.libvirtd
@@ -67,7 +67,7 @@
   # allow changing to our UUID-based named profiles
   change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
 
-  /usr/{lib,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
+  /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
   # child profile for bridge helper process
   profile qemu_bridge_helper {
    #include <abstractions/base>
@@ -83,6 +83,6 @@
    /etc/qemu/** r,
    owner @{PROC}/*/status r,
 
-   /usr/{lib,libexec}/qemu-bridge-helper rmix,
+   /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper rmix,
   }
 }
-- 
2.11.0

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list
Re: [libvirt] [PATCH v2] apparmor: allow /usr/lib/qemu/qemu-bridge-helper
Posted by Daniel P. Berrange 7 years, 1 month ago 
On Thu, Mar 16, 2017 at 05:48:47PM +0100, Guido Günther wrote:
> This is where e.g. Debian puts it.
> ---
> This adds lib64 as Dan suggested and also adds these two dirs to the
> second invocations to make things actually work.
> 
>  examples/apparmor/usr.sbin.libvirtd | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd
> index 8893e75fe..353b039ac 100644
> --- a/examples/apparmor/usr.sbin.libvirtd
> +++ b/examples/apparmor/usr.sbin.libvirtd
> @@ -67,7 +67,7 @@
>    # allow changing to our UUID-based named profiles
>    change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
>  
> -  /usr/{lib,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
> +  /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
>    # child profile for bridge helper process
>    profile qemu_bridge_helper {
>     #include <abstractions/base>
> @@ -83,6 +83,6 @@
>     /etc/qemu/** r,
>     owner @{PROC}/*/status r,
>  
> -   /usr/{lib,libexec}/qemu-bridge-helper rmix,
> +   /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper rmix,
>    }
>  }

ACK

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://entangle-photo.org       -o-    http://search.cpan.org/~danberr/ :|

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list
Re: [libvirt] [PATCH v2] apparmor: allow /usr/lib/qemu/qemu-bridge-helper
Posted by Guido Günther 7 years, 1 month ago 
On Thu, Mar 16, 2017 at 04:52:04PM +0000, Daniel P. Berrange wrote:
> On Thu, Mar 16, 2017 at 05:48:47PM +0100, Guido Günther wrote:
> > This is where e.g. Debian puts it.
> > ---
> > This adds lib64 as Dan suggested and also adds these two dirs to the
> > second invocations to make things actually work.
> > 
> >  examples/apparmor/usr.sbin.libvirtd | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd
> > index 8893e75fe..353b039ac 100644
> > --- a/examples/apparmor/usr.sbin.libvirtd
> > +++ b/examples/apparmor/usr.sbin.libvirtd
> > @@ -67,7 +67,7 @@
> >    # allow changing to our UUID-based named profiles
> >    change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
> >  
> > -  /usr/{lib,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
> > +  /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
> >    # child profile for bridge helper process
> >    profile qemu_bridge_helper {
> >     #include <abstractions/base>
> > @@ -83,6 +83,6 @@
> >     /etc/qemu/** r,
> >     owner @{PROC}/*/status r,
> >  
> > -   /usr/{lib,libexec}/qemu-bridge-helper rmix,
> > +   /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper rmix,
> >    }
> >  }
> 
> ACK

Pushed. Thanks
 -- Guido

> 
> Regards,
> Daniel
> -- 
> |: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
> |: http://libvirt.org              -o-             http://virt-manager.org :|
> |: http://entangle-photo.org       -o-    http://search.cpan.org/~danberr/ :|
> 

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Patchew 2.1-devel-0870f84

© 2016 - 2024 Red Hat, Inc.