[apparmor] [libvirt] [patch] Add support for OVMF in virt-aa-helper [Was: virt-aa-helper: does not support OVMF?]

[Jamie Strandboge]

On 08/12/2015 10:59 AM, intrigeri at debian.org wrote:
> Hi,
> 
> [please Cc me any reply, I'm not subscribed to libvir-list.]
> 
> it was reported [1] to Ubuntu that virt-aa-helper blocks access to the
> OVMF files needed to boot UEFI virtual machines in QEMU. After I've
> confirmed that on Debian sid, Jamie Strandboge suggested a fix.
> I've successfully tested in my environment (applied on top of 1.2.18)
> so I'm forwarding it here.
> 
> [1] https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1483071
> 

diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index 4ce1e7a..357dde4 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -572,8 +572,9 @@ valid_path(const char *path, const bool readonly)
     };
     /* override the above with these */
     const char * const override[] = {
-        "/sys/devices/pci",              /* for hostdev pci devices */
-        "/etc/libvirt-sandbox/services/" /* for virt-sandbox service config */
+        "/sys/devices/pci",               /* for hostdev pci devices */
+        "/etc/libvirt-sandbox/services/", /* for virt-sandbox service config */
+        "/usr/share/ovmf/"                /* for OVMF images */
     };
 
     if (path == NULL) {


Unsurprisingly, this looks good to me.

ACK

-- 
Jamie Strandboge                 http://www.ubuntu.com/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20150812/8e55c3fb/attachment.pgp>