From a2455fd53dbab9b15dc7b6b3e0ff11bfe19dec5c Mon Sep 17 00:00:00 2001 From: Georgia Garcia Date: Tue, 4 Jun 2024 14:34:56 -0300 Subject: [PATCH] virt-aa-helper: use 'include if exists' on .files Change the 'include' in the AppArmor policy to use 'include if exists' when including .files. Note that 'if exists' is only available after AppArmor 3.0, therefore a #ifdef check must be added. When the .files is not present, there are some failures in the AppArmor tools like the following, since they expect the file to exist when using 'include': ERROR: Include file /etc/apparmor.d/libvirt/libvirt-8534a409-a460-4fab-a2dd-0e1dce4ff273.files not found Signed-off-by: Georgia Garcia Reviewed-by: Michal Privoznik --- src/security/virt-aa-helper.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 0374581f07..402cbd9602 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1564,7 +1564,12 @@ main(int argc, char **argv) /* create the profile from TEMPLATE */ if (ctl->cmd == 'c' || purged) { char *tmp = NULL; - tmp = g_strdup_printf(" #include \n", ctl->uuid); +#if defined(WITH_APPARMOR_3) + const char *ifexists = "if exists "; +#else + const char *ifexists = ""; +#endif + tmp = g_strdup_printf(" #include %s\n", ifexists, ctl->uuid); if (ctl->dryrun) { vah_info(profile);