On Mon, Nov 24, 2014 at 09:54:43PM +0100, Cédric Bosdonnat wrote:
To get virt-sandbox-service working with AppArmor, virt-aa-helper needs not to choke on path in /etc/libvirt-sandbox/services. --- src/security/virt-aa-helper.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 81f9f40..9c9e570 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -608,8 +608,12 @@ valid_path(const char *path, const bool readonly) npaths = sizeof(restricted)/sizeof(*(restricted)); if (array_starts_with(path, restricted, npaths) == 0 && - array_starts_with(path, override, opaths) != 0) - return 1; + array_starts_with(path, override, opaths) != 0) { + + /* We want to have virt-sandbox services config allowed */ + if (!STRPREFIX(path, "/etc/libvirt-sandbox/services/")) + return 1; + }
Isn't this what override[] is there for? It'd be way easier to read if it's just added there.
npaths = sizeof(restricted_rw)/sizeof(*(restricted_rw));
if (!readonly) {
--
2.1.2
--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list
signature.asc
Description: Digital signature
-- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list
