[libvirt] [PATCH] virt-aa-helper: fix rules for paths with trailing slash

[Martin Kletzander]

On Wed, Jun 24, 2015 at 09:58:45AM +0200, Cédric Bosdonnat wrote:
>Rules generated for a path like '/' were having '//' which isn't

That applies only for those that were recursive, right?  Looks good to
me, ACK.

>correct for apparmor. Make virt-aa-helper smarter to avoid these.
>---
> src/security/virt-aa-helper.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
>diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
>index 35423b5..9f1c570 100644
>--- a/src/security/virt-aa-helper.c
>+++ b/src/security/virt-aa-helper.c
>@@ -773,6 +773,7 @@ vah_add_path(virBufferPtr buf, const char *path, const char *perms, bool recursi
>     char *tmp = NULL;
>     int rc = -1;
>     bool readonly = true;
>+    bool trailingSlash;
>
>     if (path == NULL)
>         return rc;
>@@ -809,14 +810,18 @@ vah_add_path(virBufferPtr buf, const char *path, const char *perms, bool recursi
>         goto cleanup;
>     }
>
>-    virBufferAsprintf(buf, "  \"%s%s\" %s,\n", tmp, recursive ? "/**" : "", perms);
>+    trailingSlash = (tmp[strlen(tmp) - 1] == '/');
>+
>+    virBufferAsprintf(buf, "  \"%s%s%s\" %s,\n", tmp, trailingSlash ? "" : "/",
>+                      recursive ? "**" : "", perms);
>     if (readonly) {
>         virBufferAddLit(buf, "  # don't audit writes to readonly files\n");
>-        virBufferAsprintf(buf, "  deny \"%s%s\" w,\n", tmp, recursive ? "/**" : "");
>+        virBufferAsprintf(buf, "  deny \"%s%s%s\" w,\n", tmp,
>+                          trailingSlash ? "" : "/", recursive ? "**" : "");
>     }
>     if (recursive) {
>         /* allow reading (but not creating) the dir */
>-        virBufferAsprintf(buf, "  \"%s/\" r,\n", tmp);
>+        virBufferAsprintf(buf, "  \"%s%s\" r,\n", tmp, trailingSlash ? "" : "/");
>     }
>
>  cleanup:
>--
>2.1.4
>
>--
>libvir-list mailing list
>libvir-list at redhat.com
>https://www.redhat.com/mailman/listinfo/libvir-list
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20150624/7a69b380/attachment-0001.sig>