From 07fc5c9c06f39b516fd0219830abcb47a5dd6ee8 Mon Sep 17 00:00:00 2001 From: Christian Ehrhardt Date: Tue, 24 Oct 2017 16:54:59 +0200 Subject: [PATCH] virt-aa-helper: grant locking permission on -f Hot-adding disks does not parse the full XML to generate apparmor rules. Instead it uses -f to append a generic rule for that file path. 580cdaa7: "virt-aa-helper: locking disk files for qemu 2.10" implemented the qemu 2.10 requirement to allow locking on disks images that are part of the domain xml. But on attach-device a user will still trigger an apparmor deny by going through virt-aa-helper -f, to fix that add the lock "k" permission to the append file case of virt-aa-helper. Signed-off-by: Christian Ehrhardt --- src/security/virt-aa-helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index ef1bf0136f..ee3913d66a 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1157,7 +1157,7 @@ get_files(vahControl * ctl) } if (ctl->newfile) - if (vah_add_file(&buf, ctl->newfile, "rw") != 0) + if (vah_add_file(&buf, ctl->newfile, "rwk") != 0) goto cleanup; if (virBufferError(&buf)) { @@ -1341,7 +1341,7 @@ main(int argc, char **argv) vah_error(ctl, 1, _("profile exists")); if (ctl->append && ctl->newfile) { - if (vah_add_file(&buf, ctl->newfile, "rw") != 0) + if (vah_add_file(&buf, ctl->newfile, "rwk") != 0) goto cleanup; } else { if (ctl->def->virtType == VIR_DOMAIN_VIRT_QEMU || -- 2.47.2