From: Serge Hallyn Date: Mon, 5 Jan 2026 20:27:21 +0000 (-0600) Subject: virt-aa-helper: Ask for no deny rule for readonly disk elements X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7b889af2d235d3fadfc172f371f02df0b74e40f2;p=thirdparty%2Flibvirt.git virt-aa-helper: Ask for no deny rule for readonly disk elements Just because a disk element only requests read access doesn't mean there may not be another readwrite request. Using 'R' when creating the apparmor rule will prevent an implicit write-deny rule to be created alongside. This does not mean write is allowed but it would cause a denial message and probably more relevant, allows to add write access later. Resolves: https://gitlab.com/libvirt/libvirt/-/issues/622 Resolves: https://gitlab.com/libvirt/libvirt/-/issues/806 Bug-Ubuntu: https://bugs.launchpad.net/bugs/1554031 Bug-Ubuntu: https://bugs.launchpad.net/bugs/1692441 Signed-off-by: Christian Ehrhardt Signed-off-by: Stefan Bader Signed-off-by: Wesley Hershberger Reviewed-by: Michal Privoznik --- diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index e365d02af4..211c34f926 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -835,11 +835,11 @@ add_file_path(virStorageSource *src, if (depth == 0) { if (src->readonly) - ret = vah_add_file(buf, src->path, "rk"); + ret = vah_add_file(buf, src->path, "Rk"); else ret = vah_add_file(buf, src->path, "rwk"); } else { - ret = vah_add_file(buf, src->path, "rk"); + ret = vah_add_file(buf, src->path, "Rk"); } if (ret != 0)