From: Andrea Bolognani <abologna@redhat.com>
Date: Wed, 21 Aug 2019 07:42:39 +0000 (+0200)
Subject: virt-aa-helper: Drop unnecessary AppArmor rule
X-Git-Tag: v5.7.0-rc1~124
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=60dfe7699059b32672a9c98702e04d60d8974ab2;p=thirdparty%2Flibvirt.git

virt-aa-helper: Drop unnecessary AppArmor rule

Apparently /proc/self is automatically converted to /proc/@{pid}
before checking rules, which makes spelling it out explicitly
redundant.

Suggested-by: Jamie Strandboge <jamie@canonical.com>
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
---

diff --git a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper
index 64772f0756..11e9c039ca 100644
--- a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper
+++ b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper
@@ -18,7 +18,6 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper {
   @{PROC}/filesystems r,
 
   # Used when internally running another command (namely apparmor_parser)
-  @{PROC}/self/fd/ r,
   @{PROC}/@{pid}/fd/ r,
 
   /etc/libnl-3/classid r,