]> git.ipfire.org Git - thirdparty/libvirt.git/commit
apparmor: Don't check for existence of templates upfront
authorAndrea Bolognani <abologna@redhat.com>
Mon, 16 Sep 2024 14:39:11 +0000 (16:39 +0200)
committerAndrea Bolognani <abologna@redhat.com>
Mon, 16 Sep 2024 15:57:54 +0000 (17:57 +0200)
commitd622ca04f6525b90cfe6d8274efaf4bee043d8ba
treeb5a3cf2b3072a76be22de6eb81147dfcea6b7351
parent4b68c7e55beb7a5151481293472769c798d3ada8
apparmor: Don't check for existence of templates upfront

Currently, if either template is missing AppArmor support is
completely disabled. This means that uninstalling the LXC
driver from a system results in QEMU domains being started
without AppArmor confinement, which obviously doesn't make any
sense.

The problematic scenario was impossible to hit in Debian until
very recently, because all AppArmor files were shipped as part
of the same package; now that the Debian package is much closer
to the Fedora one, and specifically ships the AppArmor files
together with the corresponding driver, it becomes trivial to
trigger it.

Drop the checks entirely. virt-aa-helper, which is responsible
for creating the per-domain profiles starting from the
driver-specific template, already fails if the latter is not
present, so they were always redundant.

https://bugs.debian.org/1081396

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
src/security/security_apparmor.c