[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH] 1/10 AppArmor driver updates



On Mon, 2010-04-05 at 16:15 -0500, Jamie Strandboge wrote:
> 1_apparmor-dont-clear-caps.patch: originally submitted on 2010/02/08
> with no feedback. The calls to virExec() in security_apparmor.c when
> invoking virt-aa-helper use VIR_EXEC_CLEAR_CAPS. When compiled without
> libcap-ng, this is not a problem (it's effectively a no-op) but with
> libcap-ng this causes MAC_ADMIN to be cleared. MAC_ADMIN is needed by
> virt-aa-helper to manipulate apparmor profiles and without it VMs will
> not start[1]. This patch calls virExec with the default VIR_EXEC_NONE
> instead.


-- 
Jamie Strandboge             | http://www.canonical.com
Author: Jamie Strandboge <jamie ubuntu com>
Description: Don't clear capabilities when calling virt-aa-helper. When built
 with libcap-ng, clearing caps makes virt-aa-helper lose MAC_ADMIN, which is
 (obviously) needed by apparmor_parser. This restores libcap-ng behavior to
 what it was when not built with libcap-ng.

diff -Nur libvirt-0.7.7/src/security/security_apparmor.c libvirt-0.7.7.new/src/security/security_apparmor.c
--- libvirt-0.7.7/src/security/security_apparmor.c	2010-02-12 08:50:47.000000000 -0600
+++ libvirt-0.7.7.new/src/security/security_apparmor.c	2010-03-24 13:07:08.286419492 -0500
@@ -174,19 +174,19 @@
             VIRT_AA_HELPER, "-c", "-u", profile, NULL
         };
         ret = virExec(argv, NULL, NULL, &child,
-                      pipefd[0], NULL, NULL, VIR_EXEC_CLEAR_CAPS);
+                      pipefd[0], NULL, NULL, VIR_EXEC_NONE);
     } else if (disk && disk->src) {
         const char *const argv[] = {
             VIRT_AA_HELPER, "-r", "-u", profile, "-f", disk->src, NULL
         };
         ret = virExec(argv, NULL, NULL, &child,
-                      pipefd[0], NULL, NULL, VIR_EXEC_CLEAR_CAPS);
+                      pipefd[0], NULL, NULL, VIR_EXEC_NONE);
     } else {
         const char *const argv[] = {
             VIRT_AA_HELPER, "-r", "-u", profile, NULL
         };
         ret = virExec(argv, NULL, NULL, &child,
-                      pipefd[0], NULL, NULL, VIR_EXEC_CLEAR_CAPS);
+                      pipefd[0], NULL, NULL, VIR_EXEC_NONE);
     }
     if (ret < 0)
         goto clean;

Attachment: signature.asc
Description: This is a digitally signed message part


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]