External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-07-07 18:35:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: Improve virt-aa-helper include

Browse Source 
For AppArmor 3.x we can use 'include if exists', which frees us
from having to create a dummy override. For AppArmor 2.x we keep
things as they are to avoid introducing regressions.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Jim Fehlig <jfehlig@suse.com>
This commit is contained in:
Andrea Bolognani 2023-06-29 11:40:16 +02:00
parent b6092de883
commit 21a84ec994
2 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/security/apparmor/meson.build
View File

@ -77,8 +77,13 @@ install_data(
install_dir: apparmor_dir / 'libvirt',
)
install_data(
'usr.lib.libvirt.virt-aa-helper.local',
install_dir: apparmor_dir / 'local',
rename: 'usr.lib.libvirt.virt-aa-helper',
)
if not conf.has('WITH_APPARMOR_3')
# We only install the empty local override for AppArmor 2.x. For
# AppArmor 3.x, upstream's preference is to avoid creating these
# files in order to limit the amount of filesystem clutter.
install_data(
'usr.lib.libvirt.virt-aa-helper.local',
install_dir: apparmor_dir / 'local',
rename: 'usr.lib.libvirt.virt-aa-helper',
)
endif

5
src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in
View File

@ -71,5 +71,10 @@ profile virt-aa-helper @libexecdir@/virt-aa-helper {
/**.[iI][sS][oO] r,
/**/disk{,.*} r,
@BEGIN_APPARMOR_3@
include if exists <local/usr.lib.libvirt.virt-aa-helper>
@END_APPARMOR_3@
@BEGIN_APPARMOR_2@
#include <local/usr.lib.libvirt.virt-aa-helper>
@END_APPARMOR_2@
}