From: Michal Privoznik <mprivozn@redhat.com>
Date: Sat, 25 Jan 2020 08:38:53 +0000 (+0100)
Subject: apparmor: Allow some more BIOS/UEFI paths
X-Git-Tag: v6.1.0-rc1~312
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8f204fb4dac97b39c92e650b4daca1c49ffc60c6;p=thirdparty%2Flibvirt.git

apparmor: Allow some more BIOS/UEFI paths

There are two more paths that we are missing in the default
domain profile: /usr/share/edk2-ovmf/ and /usr/share/sgabios/.
These exist on my Gentoo box and contain UEFI and BIOS images
respectively.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Acked-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
---

diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu
index 2291829270..6942b83969 100644
--- a/src/security/apparmor/libvirt-qemu
+++ b/src/security/apparmor/libvirt-qemu
@@ -75,6 +75,7 @@
   # access to firmware's etc
   /usr/share/AAVMF/** r,
   /usr/share/bochs/** r,
+  /usr/share/edk2-ovmf/** r,
   /usr/share/kvm/** r,
   /usr/share/misc/sgabios.bin r,
   /usr/share/openbios/** r,
@@ -86,6 +87,7 @@
   /usr/share/qemu-kvm/** r,
   /usr/share/qemu/** r,
   /usr/share/seabios/** r,
+  /usr/share/sgabios/** r,
   /usr/share/slof/** r,
   /usr/share/vgabios/** r,