[libvirt] [PATCH v2] apparmor: allow /usr/lib/qemu/qemu-bridge-helper

[Guido Günther]

On Thu, Mar 16, 2017 at 04:52:04PM +0000, Daniel P. Berrange wrote:
> On Thu, Mar 16, 2017 at 05:48:47PM +0100, Guido Günther wrote:
> > This is where e.g. Debian puts it.
> > ---
> > This adds lib64 as Dan suggested and also adds these two dirs to the
> > second invocations to make things actually work.
> > 
> >  examples/apparmor/usr.sbin.libvirtd | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd
> > index 8893e75fe..353b039ac 100644
> > --- a/examples/apparmor/usr.sbin.libvirtd
> > +++ b/examples/apparmor/usr.sbin.libvirtd
> > @@ -67,7 +67,7 @@
> >    # allow changing to our UUID-based named profiles
> >    change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
> >  
> > -  /usr/{lib,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
> > +  /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
> >    # child profile for bridge helper process
> >    profile qemu_bridge_helper {
> >     #include <abstractions/base>
> > @@ -83,6 +83,6 @@
> >     /etc/qemu/** r,
> >     owner @{PROC}/*/status r,
> >  
> > -   /usr/{lib,libexec}/qemu-bridge-helper rmix,
> > +   /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper rmix,
> >    }
> >  }
> 
> ACK

Pushed. Thanks
 -- Guido

> 
> Regards,
> Daniel
> -- 
> |: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
> |: http://libvirt.org              -o-             http://virt-manager.org :|
> |: http://entangle-photo.org       -o-    http://search.cpan.org/~danberr/ :|
>