From d0d4b8ad76d3e8a859ee90701a21a3f003a22c1f Mon Sep 17 00:00:00 2001 From: Jamie Strandboge Date: Fri, 13 Nov 2009 15:25:30 +0100 Subject: [PATCH] AppArmor handling of accesses to readonly files Fixes https://launchpad.net/bugs/453335 * src/security/virt-aa-helper.c: suppress confusing and misleading apparmor denied message when kvm/qemu tries to open a libvirt specified readonly file (such as a cdrom) with write permissions. libvirt uses the readonly attribute for the security driver only, and has no way of telling kvm/qemu that the device should be opened readonly --- src/security/virt-aa-helper.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 4989798734..62f0977f5d 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -755,6 +755,10 @@ vah_add_file(virBufferPtr buf, const char *path, const char *perms) } virBufferVSprintf(buf, " \"%s\" %s,\n", tmp, perms); + if (readonly) { + virBufferVSprintf(buf, " # don't audit writes to readonly media\n"); + virBufferVSprintf(buf, " deny \"%s\" w,\n", tmp); + } clean: free(tmp);