External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-02-22 19:32:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: add debug traces when changing profile.

Browse Source 
The reason for these is that aa-status doesn't show the process using
the profile as they are in another namespace.
This commit is contained in:
Cédric Bosdonnat 2014-03-03 11:26:44 +01:00 committed by Daniel P. Berrange
parent a3e4eeff52
commit 500b2e9655
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/security/security_apparmor.c
View File

@ -593,6 +593,7 @@ AppArmorSetSecurityProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
goto cleanup; goto cleanup;
} }
VIR_DEBUG("Changing AppArmor profile to %s", profile_name);
if (aa_change_profile(profile_name) < 0) { if (aa_change_profile(profile_name) < 0) {
virReportError(VIR_ERR_INTERNAL_ERROR, "%s", virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
_("error calling aa_change_profile()")); _("error calling aa_change_profile()"));
@ -618,6 +619,7 @@ AppArmorSetSecurityChildProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
{ {
int rc = -1; int rc = -1;
char *profile_name = NULL; char *profile_name = NULL;
char *cmd_str = NULL;
virSecurityLabelDefPtr secdef = virSecurityLabelDefPtr secdef =
virDomainDefGetSecurityLabelDef(def, SECURITY_APPARMOR_NAME); virDomainDefGetSecurityLabelDef(def, SECURITY_APPARMOR_NAME);
@ -637,11 +639,14 @@ AppArmorSetSecurityChildProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
if ((profile_name = get_profile_name(def)) == NULL) if ((profile_name = get_profile_name(def)) == NULL)
goto cleanup; goto cleanup;
cmd_str = virCommandToString(cmd);
VIR_DEBUG("Changing AppArmor profile to %s on %s", profile_name, cmd_str);
virCommandSetAppArmorProfile(cmd, profile_name); virCommandSetAppArmorProfile(cmd, profile_name);
rc = 0; rc = 0;
cleanup: cleanup:
VIR_FREE(profile_name); VIR_FREE(profile_name);
VIR_FREE(cmd_str);
return rc; return rc;
} }