[patch] Add support for OVMF in virt-aa-helper [Was: [apparmor] virt-aa-helper: does not support OVMF?]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

[please Cc me any reply, I'm not subscribed to libvir-list.]

it was reported [1] to Ubuntu that virt-aa-helper blocks access to the
OVMF files needed to boot UEFI virtual machines in QEMU. After I've
confirmed that on Debian sid, Jamie Strandboge suggested a fix.
I've successfully tested in my environment (applied on top of 1.2.18)
so I'm forwarding it here.

[1] https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1483071

Cheers,
-- 
intrigeri

>From 0b1f1318125a8f9d4460641b6d216d7657dc0d1e Mon Sep 17 00:00:00 2001
From: intrigeri <intrigeri@xxxxxxxxxx>
Date: Wed, 12 Aug 2015 14:48:53 +0000
Subject: [PATCH] virt-aa-helper: allow access to /usr/share/ovmf/

We forbid access to /usr/share/, but (at least on Debian-based systems) the Open
Virtual Machine Firmware files needed for booting UEFI virtual machines in QEMU
live in /usr/share/ovmf/. Therefore, we need to add that directory to the list
of overrides.

This patch was suggested by Jamie Strandboge <jamie@xxxxxxxxxxxxx>
on https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1483071.
---
 src/security/virt-aa-helper.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index 4ce1e7a..357dde4 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -572,8 +572,9 @@ valid_path(const char *path, const bool readonly)
     };
     /* override the above with these */
     const char * const override[] = {
-        "/sys/devices/pci",              /* for hostdev pci devices */
-        "/etc/libvirt-sandbox/services/" /* for virt-sandbox service config */
+        "/sys/devices/pci",               /* for hostdev pci devices */
+        "/etc/libvirt-sandbox/services/", /* for virt-sandbox service config */
+        "/usr/share/ovmf/"                /* for OVMF images */
     };
 
     if (path == NULL) {
-- 
2.5.0

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list

[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]