shaba/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-23 21:34:54 +03:00
Code Releases Activity

apparmor: Check libvirtd profile status by name

Browse Source 
Commit a3ab6d42 changed the libvirtd profile to a named profile,
breaking the apparmor driver's ability to detect if the profile is
active. When the apparmor driver loads it checks the status of the
libvirtd profile using the full binary path, which fails since the
profile is now referenced by name. If the apparmor driver is
explicitly requested in /etc/libvirt/qemu.conf, then libvirtd fails
to load too.

Instead of only checking the profile status by full binary path,
also check by profile name. The full path check is retained in case
users have a customized libvirtd profile with full path.

Signed-off-by: Jim Fehlig <jfehlig@suse.com>
Acked-by: Jamie Strandboge <jamie@canonical.com>
This commit is contained in:
Jim Fehlig 2019-03-01 14:34:17 -07:00
parent 612c0d4bb8
commit 411cdaf884
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/security/security_apparmor.c
View File

@ -257,10 +257,16 @@ use_apparmor(void)
if (access(APPARMOR_PROFILES_PATH, R_OK) != 0)
goto cleanup;
/* First check profile status using full binary path. If that fails
* check using profile name.
*/
rc = profile_status(libvirt_daemon, 1);
/* Error or unconfined should all result in -1*/
if (rc < 0)
rc = -1;
if (rc < 0) {
rc = profile_status("libvirtd", 1);
/* Error or unconfined should all result in -1*/
if (rc < 0)
rc = -1;
}
cleanup:
VIR_FREE(libvirt_daemon);