mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-12-23 21:34:54 +03:00
virt-aa-helper: grant locking permission on -f
Hot-adding disks does not parse the full XML to generate apparmor rules.
Instead it uses -f <PATH> to append a generic rule for that file path.
580cdaa7
: "virt-aa-helper: locking disk files for qemu 2.10" implemented
the qemu 2.10 requirement to allow locking on disks images that are part of
the domain xml.
But on attach-device a user will still trigger an apparmor deny by going
through virt-aa-helper -f, to fix that add the lock "k" permission to the
append file case of virt-aa-helper.
Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
This commit is contained in:
parent
8def32157a
commit
07fc5c9c06
@ -1157,7 +1157,7 @@ get_files(vahControl * ctl)
|
||||
}
|
||||
|
||||
if (ctl->newfile)
|
||||
if (vah_add_file(&buf, ctl->newfile, "rw") != 0)
|
||||
if (vah_add_file(&buf, ctl->newfile, "rwk") != 0)
|
||||
goto cleanup;
|
||||
|
||||
if (virBufferError(&buf)) {
|
||||
@ -1341,7 +1341,7 @@ main(int argc, char **argv)
|
||||
vah_error(ctl, 1, _("profile exists"));
|
||||
|
||||
if (ctl->append && ctl->newfile) {
|
||||
if (vah_add_file(&buf, ctl->newfile, "rw") != 0)
|
||||
if (vah_add_file(&buf, ctl->newfile, "rwk") != 0)
|
||||
goto cleanup;
|
||||
} else {
|
||||
if (ctl->def->virtType == VIR_DOMAIN_VIRT_QEMU ||
|
||||
|
Loading…
Reference in New Issue
Block a user