Re: [libvirt] [PATCH 1/2] apparmor: Allow access to filesystem mounts

2014-03-09 Thread Felix Geyer
Hi, Sorry for the delay. On 28.02.2014 21:36, Serge Hallyn wrote: Hi, a separate patch was posted to a new launchpad bug which does a bit more sanity checking on the values passed in, so I went ahead and merged the two. I did however notice that there is no Signed-off-by for Felix.

Re: [libvirt] [PATCH 1/2] apparmor: Allow access to filesystem mounts

2014-02-28 Thread Serge Hallyn
Quoting Guido Günther (g...@godiug.net): Hi Felix, On Thu, Jan 30, 2014 at 06:22:51PM +0100, Felix Geyer wrote: On 29.01.2014 07:48, Guido Günther wrote: Hi, On Sun, Jan 26, 2014 at 10:47:34PM +0100, Felix Geyer wrote: [..snip..] ` +if (recursive) { +// allow reading

Re: [libvirt] [PATCH 1/2] apparmor: Allow access to filesystem mounts

2014-02-28 Thread Serge Hallyn
Hi, a separate patch was posted to a new launchpad bug which does a bit more sanity checking on the values passed in, so I went ahead and merged the two. I did however notice that there is no Signed-off-by for Felix. Felix, are you ok with this new version? Subject: [PATCH 1/1] virt-aa-helper:

Re: [libvirt] [PATCH 1/2] apparmor: Allow access to filesystem mounts

2014-01-30 Thread Felix Geyer
On 29.01.2014 07:48, Guido Günther wrote: Hi, On Sun, Jan 26, 2014 at 10:47:34PM +0100, Felix Geyer wrote: [..snip..] ` +if (recursive) { +// allow reading (but not creating) the dir +virBufferAsprintf(buf, \%s/\ r,\n, tmp); Just a minor nit. Libvirt prefers /* */

Re: [libvirt] [PATCH 1/2] apparmor: Allow access to filesystem mounts

2014-01-30 Thread Guido Günther
Hi Felix, On Thu, Jan 30, 2014 at 06:22:51PM +0100, Felix Geyer wrote: On 29.01.2014 07:48, Guido Günther wrote: Hi, On Sun, Jan 26, 2014 at 10:47:34PM +0100, Felix Geyer wrote: [..snip..] ` +if (recursive) { +// allow reading (but not creating) the dir +

Re: [libvirt] [PATCH 1/2] apparmor: Allow access to filesystem mounts

2014-01-28 Thread Felix Geyer
On 28.01.2014 15:04, Jamie Strandboge wrote: On 01/26/2014 03:47 PM, Felix Geyer wrote: Make virt-aa-helper create rules to allow VMs access to filesystem mounts from the host. Note that virt-aa-helper access to various parts of the filesystem is generally ok. However, can you be more

Re: [libvirt] [PATCH 1/2] apparmor: Allow access to filesystem mounts

2014-01-28 Thread Jamie Strandboge
On 01/28/2014 12:12 PM, Felix Geyer wrote: On 28.01.2014 15:04, Jamie Strandboge wrote: On 01/26/2014 03:47 PM, Felix Geyer wrote: Make virt-aa-helper create rules to allow VMs access to filesystem mounts from the host. Note that virt-aa-helper access to various parts of the filesystem is

Re: [libvirt] [PATCH 1/2] apparmor: Allow access to filesystem mounts

2014-01-28 Thread Guido Günther
Hi, On Sun, Jan 26, 2014 at 10:47:34PM +0100, Felix Geyer wrote: [..snip..] ` +if (recursive) { +// allow reading (but not creating) the dir +virBufferAsprintf(buf, \%s/\ r,\n, tmp); Just a minor nit. Libvirt prefers /* */ style comments (see HACKING). Cheers, -- Guido

[libvirt] [PATCH 1/2] apparmor: Allow access to filesystem mounts

2014-01-27 Thread Felix Geyer
Make virt-aa-helper create rules to allow VMs access to filesystem mounts from the host. --- src/security/virt-aa-helper.c | 26 -- 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index

Re: [libvirt] [PATCH 1/2] apparmor: Allow access to filesystem mounts

2014-01-27 Thread Jamie Strandboge
On 01/26/2014 03:47 PM, Felix Geyer wrote: Make virt-aa-helper create rules to allow VMs access to filesystem mounts from the host. Note that virt-aa-helper access to various parts of the filesystem is generally ok. However, can you be more specific about the problem you're trying to solve? Eg,