Re: [libvirt] [PATCH] security: apparmor: make vhost-net access a static rule

2019-04-10 Thread Jamie Strandboge
On Wed, 20 Mar 2019, Christian Ehrhardt wrote: > On Wed, Mar 20, 2019 at 8:45 AM Christian Ehrhardt > wrote: > > > > On Mon, Mar 4, 2019 at 11:42 AM Christian Ehrhardt > > wrote: > > > > > > On Fri, Mar 1, 2019 at 5:56 PM Jamie Strandboge > > > wrote: > > > > > > > > On Mon, 18 Feb 2019, Chris

Re: [libvirt] [PATCH] security: apparmor: make vhost-net access a static rule

2019-03-20 Thread Christian Ehrhardt
On Wed, Mar 20, 2019 at 8:45 AM Christian Ehrhardt wrote: > > On Mon, Mar 4, 2019 at 11:42 AM Christian Ehrhardt > wrote: > > > > On Fri, Mar 1, 2019 at 5:56 PM Jamie Strandboge wrote: > > > > > > On Mon, 18 Feb 2019, Christian Ehrhardt wrote: > > > > > > > So far we were detecting at guest star

Re: [libvirt] [PATCH] security: apparmor: make vhost-net access a static rule

2019-03-20 Thread Christian Ehrhardt
On Mon, Mar 4, 2019 at 11:42 AM Christian Ehrhardt wrote: > > On Fri, Mar 1, 2019 at 5:56 PM Jamie Strandboge wrote: > > > > On Mon, 18 Feb 2019, Christian Ehrhardt wrote: > > > > > So far we were detecting at guest start if any devices needed vhost net > > > and only if that was true added a rul

Re: [libvirt] [PATCH] security: apparmor: make vhost-net access a static rule

2019-03-04 Thread Christian Ehrhardt
On Fri, Mar 1, 2019 at 5:56 PM Jamie Strandboge wrote: > > On Mon, 18 Feb 2019, Christian Ehrhardt wrote: > > > So far we were detecting at guest start if any devices needed vhost net > > and only if that was true added a rule for /dev/vhost-net. > > > > It turns out that it is an absolutely valid

Re: [libvirt] [PATCH] security: apparmor: make vhost-net access a static rule

2019-03-01 Thread Jamie Strandboge
On Mon, 18 Feb 2019, Christian Ehrhardt wrote: > So far we were detecting at guest start if any devices needed vhost net > and only if that was true added a rule for /dev/vhost-net. > > It turns out that it is an absolutely valid case to start a guest > without any vhost-net networking but later

[libvirt] [PATCH] security: apparmor: make vhost-net access a static rule

2019-02-18 Thread Christian Ehrhardt
So far we were detecting at guest start if any devices needed vhost net and only if that was true added a rule for /dev/vhost-net. It turns out that it is an absolutely valid case to start a guest without any vhost-net networking but later on wanting to hotplug such a device which then would be de