[libvirt] [PATCH] security: apparmor: Allow RO /usr/share/edk2/

Cole Robinson posted 1 patch 6 days ago
Test syntax-check passed
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/libvirt tags/patchew/4f29d3bf533c9b30482b9a7fe72e454058962434.1570645360.git.crobinso@redhat.com
src/security/virt-aa-helper.c | 1 +
1 file changed, 1 insertion(+)

[libvirt] [PATCH] security: apparmor: Allow RO /usr/share/edk2/

Posted by Cole Robinson 6 days ago
On Fedora, already whitelisted paths to AAVMF and OVMF binaries
are symlinks to binaries under /usr/share/edk2/. Add that directory
to the RO whitelist so virt-aa-helper-test passes

Signed-off-by: Cole Robinson <crobinso@redhat.com>
---
I don't know if anyone is actually using apparmor on Fedora, but
I have the libs installed now for testing. I think the better thing
to do would be to adjust virt-aa-helper-test to not touch host
state

 src/security/virt-aa-helper.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index d9f6b5638b..509187ac36 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -505,6 +505,7 @@ valid_path(const char *path, const bool readonly)
         "/vmlinuz",
         "/initrd",
         "/initrd.img",
+        "/usr/share/edk2/",
         "/usr/share/OVMF/",              /* for OVMF images */
         "/usr/share/ovmf/",              /* for OVMF images */
         "/usr/share/AAVMF/",             /* for AAVMF images */
-- 
2.23.0

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Re: [libvirt] [PATCH] security: apparmor: Allow RO /usr/share/edk2/

Posted by Michal Privoznik 5 days ago
On 10/9/19 8:24 PM, Cole Robinson wrote:
> On Fedora, already whitelisted paths to AAVMF and OVMF binaries
> are symlinks to binaries under /usr/share/edk2/. Add that directory
> to the RO whitelist so virt-aa-helper-test passes
> 
> Signed-off-by: Cole Robinson <crobinso@redhat.com>
> ---
> I don't know if anyone is actually using apparmor on Fedora, but
> I have the libs installed now for testing. I think the better thing
> to do would be to adjust virt-aa-helper-test to not touch host
> state

Oh yeah, definitely. But since majority of libvirt contributors come 
from distros that don't use AppArmor, it doesn't get as many attention.

> 
>   src/security/virt-aa-helper.c | 1 +
>   1 file changed, 1 insertion(+)

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>

Michal

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list