On 6/29/23 07:21, Andrea Bolognani wrote:
> On Wed, Jun 28, 2023 at 05:15:26PM -0600, Jim Fehlig wrote:
>> This is a stab at a V2 of
>>
>> https://listman.redhat.com/archives/libvir-list/2023-June/240219.html
>>
>> That patch was ACKed and committed, but reverted before the 9.5.0 release
>> since it could be problematic with older apparmor 2.x versions still
>> supported by libvirt.
>>
>> Andrea suggested copies of the profiles for apparmor 2.x and 3.x. This
>> series takes that approach, with patch 1 making an identical copy of the
>> src/security/apparmor directory. Patches 2 and 3 then adjust the profiles
>> accordingly.
>>
>> My approach to copying the existing directory does introduce some duplicate
>> files in the tree, but otherwise it's minimally disruptive and will be easy
>> to rip out when upstream libvirt no longer needs to support apparmor 2.x.
>>
>> FYI, so far I've only tested with apparmor 3.x, but I did push the changes
>> to my fork with CI enabled
>>
>> https://gitlab.com/jfehlig/libvirt/-/pipelines/915347878
>>
>> Thanks for comments/suggestions!
>>
>> Jim Fehlig (3):
>> apparmor: Create version specific apparmor profiles
>> apparmor: Remove support for passt from apparmor 2.x
>> apparmor: Add support for local profile customizations
>
> I'm not a fan of this approach. It introduces a lot of duplication
> for what are ultimately just a dozen or so lines that need to be
> different between the 2.x and 3.x profiles; most importantly, I'm
> very concerned about the two copies accidentally drifting apart over
> the ~2 years that separate us from the joyous day when we can finally
> stop caring about 2.x.
>
> Please have a look at my attempt:
>
> https://listman.redhat.com/archives/libvir-list/2023-June/240544.html
>
I was going down the same path until I thought of the more brute force approach,
which I admit to be fond of due to ease of ripping out the 2.x stuff when no
longer needed. But yeah, two copies of the profiles is not nice.
I'll take a closer look at your patches now.
Regards,
Jim