[libvirt] [PATCH 2/3] virt-aa-helper: don't deny writes to readonly mounts

[Cedric Bosdonnat]

Hi all,

Has that patch been skipped in the review process?

--
Cedric

On Tue, 2015-11-17 at 15:14 +0100, Cédric Bosdonnat wrote:
> There is no need to deny writes on a readonly mount: write still
> won't be accepted, even if the user remounts the folder as RW in
> the guest as qemu sets the 9p mount as ro.
> 
> This deny rule was leading to problems for example with readonly /:
> The qemu process had to write to a bunch of files in / like logs,
> sockets, etc. This deny rule was also preventing auditing of these
> denials, making it harder to debug.
> ---
>  src/security/virt-aa-helper.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
> index 5de56e5..a2d7226 100644
> --- a/src/security/virt-aa-helper.c
> +++ b/src/security/virt-aa-helper.c
> @@ -1127,7 +1127,10 @@ get_files(vahControl * ctl)
>                  ctl->def->fss[i]->src) {
>              virDomainFSDefPtr fs = ctl->def->fss[i];
>  
> -            if (vah_add_path(&buf, fs->src, fs->readonly ? "r" : "rw", true) != 0)
> +            /* We don't need to add deny rw rules for readonly mounts,
> +             * this can only lead to troubles when mounting / readonly.
> +             */
> +            if (vah_add_path(&buf, fs->src, "rw", true) != 0)
>                  goto cleanup;
>          }
>      }