virt-aa-helper: Ask for no deny rule for readonly disk elements

Just because a disk element only requests read access doesn't mean
there may not be another readwrite request.

Using 'R' when creating the apparmor rule will prevent an implicit
write-deny rule to be created alongside. This does not mean write
is allowed but it would cause a denial message and probably more
relevant, allows to add write access later.

Resolves: https://gitlab.com/libvirt/libvirt/-/issues/622
Resolves: https://gitlab.com/libvirt/libvirt/-/issues/806
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1554031
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1692441
Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Wesley Hershberger <wesley.hershberger@canonical.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>

diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index e365d02af4848b4b3283d0782bb972ba3c6d50df..211c34f92637e17e876be91566af7e9821d5f601 100644 (file)
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -835,11 +835,11 @@ add_file_path(virStorageSource *src,
 
     if (depth == 0) {
         if (src->readonly)
-            ret = vah_add_file(buf, src->path, "rk");
+            ret = vah_add_file(buf, src->path, "Rk");
         else
             ret = vah_add_file(buf, src->path, "rwk");
     } else {
-        ret = vah_add_file(buf, src->path, "rk");
+        ret = vah_add_file(buf, src->path, "Rk");
     }
 
     if (ret != 0)