[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH] apparmor: QEMU bridge helper policy updates





On 03/12/2012 05:07 PM, Corey Bryant wrote:
...
+ network inet stream,

I understood why net_admin was needed, but this one is less clear. Why
does qemu-bridge-helper need this?


Good question. I'm going to test without this and see if it's necessary.
I'm wondering if it's a subset of net_admin, and I may have added this
before I added net_admin.


I just submitted patch v2. The only change is addition of the owner keyword (see below).

I tested without 'network inet stream' and got an AVC denial so I kept it in the policy. We open an AF_INET/SOCK_STREAM socket in the helper, which I believe this maps to.

...
+ @{PROC}/*/status r,

Is it possible to use this instead:
owner @{PROC}/*/status r,


I would imagine this is ok to update with owner. I'll test it out and
submit a v2 if there aren't any issues.



--
Regards,
Corey


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]