Hot-adding disks does not parse the full XML to generate apparmor rules.
Instead it uses -f <PATH> to append a generic rule for that file path.

580cdaa7: "virt-aa-helper: locking disk files for qemu 2.10" implemented
the qemu 2.10 requirement to allow locking on disks images that are part of
the domain xml.

But on attach-device a user will still trigger an apparmor deny by going
through virt-aa-helper -f, to fix that add the lock "k" permission to the
append file case of virt-aa-helper.

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
---
 src/security/virt-aa-helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index ef1bf01..ee3913d 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -1157,7 +1157,7 @@ get_files(vahControl * ctl)
     }
 
     if (ctl->newfile)
-        if (vah_add_file(&buf, ctl->newfile, "rw") != 0)
+        if (vah_add_file(&buf, ctl->newfile, "rwk") != 0)
             goto cleanup;
 
     if (virBufferError(&buf)) {
@@ -1341,7 +1341,7 @@ main(int argc, char **argv)
             vah_error(ctl, 1, _("profile exists"));
 
         if (ctl->append && ctl->newfile) {
-            if (vah_add_file(&buf, ctl->newfile, "rw") != 0)
+            if (vah_add_file(&buf, ctl->newfile, "rwk") != 0)
                 goto cleanup;
         } else {
             if (ctl->def->virtType == VIR_DOMAIN_VIRT_QEMU ||
-- 
2.7.4

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

On Tue, 2017-10-24 at 16:54 +0200, Christian Ehrhardt wrote:
> Hot-adding disks does not parse the full XML to generate apparmor
> rules.
> Instead it uses -f <PATH> to append a generic rule for that file
> path.
> 
> 580cdaa7: "virt-aa-helper: locking disk files for qemu 2.10"
> implemented
> the qemu 2.10 requirement to allow locking on disks images that are
> part of
> the domain xml.
> 
> But on attach-device a user will still trigger an apparmor deny by
> going
> through virt-aa-helper -f, to fix that add the lock "k" permission to
> the
> append file case of virt-aa-helper.
> 
> Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
> ---
>  src/security/virt-aa-helper.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-
> helper.c
> index ef1bf01..ee3913d 100644
> --- a/src/security/virt-aa-helper.c
> +++ b/src/security/virt-aa-helper.c
> @@ -1157,7 +1157,7 @@ get_files(vahControl * ctl)
>      }
>  
>      if (ctl->newfile)
> -        if (vah_add_file(&buf, ctl->newfile, "rw") != 0)
> +        if (vah_add_file(&buf, ctl->newfile, "rwk") != 0)
>              goto cleanup;
>  
>      if (virBufferError(&buf)) {
> @@ -1341,7 +1341,7 @@ main(int argc, char **argv)
>              vah_error(ctl, 1, _("profile exists"));
>  
>          if (ctl->append && ctl->newfile) {
> -            if (vah_add_file(&buf, ctl->newfile, "rw") != 0)
> +            if (vah_add_file(&buf, ctl->newfile, "rwk") != 0)
>                  goto cleanup;
>          } else {
>              if (ctl->def->virtType == VIR_DOMAIN_VIRT_QEMU ||

This looks good to me. +1

-- 
Jamie Strandboge             | http://www.canonical.com--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

On 10/24/2017 04:54 PM, Christian Ehrhardt wrote:
> Hot-adding disks does not parse the full XML to generate apparmor rules.
> Instead it uses -f <PATH> to append a generic rule for that file path.
> 
> 580cdaa7: "virt-aa-helper: locking disk files for qemu 2.10" implemented
> the qemu 2.10 requirement to allow locking on disks images that are part of
> the domain xml.
> 
> But on attach-device a user will still trigger an apparmor deny by going
> through virt-aa-helper -f, to fix that add the lock "k" permission to the
> append file case of virt-aa-helper.
> 
> Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
> ---
>  src/security/virt-aa-helper.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 

ACKed and pushed.

Michal

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list