libvirt

mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-02-01 01:15:19 +00:00

History

Andrea Bolognani d622ca04f6 apparmor: Don't check for existence of templates upfront

Currently, if either template is missing AppArmor support is
completely disabled. This means that uninstalling the LXC
driver from a system results in QEMU domains being started
without AppArmor confinement, which obviously doesn't make any
sense.

The problematic scenario was impossible to hit in Debian until
very recently, because all AppArmor files were shipped as part
of the same package; now that the Debian package is much closer
to the Fedora one, and specifically ships the AppArmor files
together with the corresponding driver, it becomes trivial to
trigger it.

Drop the checks entirely. virt-aa-helper, which is responsible
for creating the per-domain profiles starting from the
driver-specific template, already fails if the latter is not
present, so they were always redundant.

https://bugs.debian.org/1081396

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

2024-09-16 17:57:54 +02:00

apparmor

Allow apparmor parser to be executed in /usr/bin

2024-09-12 09:44:20 +02:00

meson.build

…

security_apparmor.c

apparmor: Don't check for existence of templates upfront

2024-09-16 17:57:54 +02:00

security_apparmor.h

…

security_dac.c