External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-23 14:15:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: Add support for named profiles

Browse Source 
Upstream apparmor is switching to named profiles. In short,

/usr/sbin/dnsmasq {

becomes

profile dnsmasq /usr/sbin/dnsmasq {

Consequently, any profiles that reference profiles in a peer= condition
need to be updated if the referenced profile switches to a named profile.
Apparmor commit 9ab45d81 switched dnsmasq to a named profile. ATM it is
the only named profile switch that has affected libvirt. Add rules to the
libvirtd profile to reference dnsmasq in peer= conditions by profile name.

Signed-off-by: Jim Fehlig <jfehlig@suse.com>
This commit is contained in:
Jim Fehlig 2019-01-11 17:26:03 -07:00
parent 11c8aca938
commit 70c2933da2
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/security/apparmor/usr.sbin.libvirtd
View File

@ -52,9 +52,11 @@
ptrace (read,trace) peer=unconfined, ptrace (read,trace) peer=unconfined,
ptrace (read,trace) peer=/usr/sbin/libvirtd, ptrace (read,trace) peer=/usr/sbin/libvirtd,
ptrace (read,trace) peer=dnsmasq,
ptrace (read,trace) peer=/usr/sbin/dnsmasq, ptrace (read,trace) peer=/usr/sbin/dnsmasq,
ptrace (read,trace) peer=libvirt-*, ptrace (read,trace) peer=libvirt-*,
signal (send) peer=dnsmasq,
signal (send) peer=/usr/sbin/dnsmasq, signal (send) peer=/usr/sbin/dnsmasq,
signal (read, send) peer=libvirt-*, signal (read, send) peer=libvirt-*,
signal (send) set=("kill", "term") peer=unconfined, signal (send) set=("kill", "term") peer=unconfined,