Quoting Guido Günther (agx@xxxxxxxxxxx): > On Mon, Nov 16, 2015 at 05:59:08PM +0000, Serge Hallyn wrote: > > > > As suggested by Jamie Strandboge in > > > > https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1483071 > > > > Signed-off-by: Serge Hallyn <serge.hallyn@xxxxxxxxxx> > > --- > > src/security/virt-aa-helper.c | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c > > index 5de56e5..bddcbdc 100644 > > --- a/src/security/virt-aa-helper.c > > +++ b/src/security/virt-aa-helper.c > > @@ -575,7 +575,8 @@ valid_path(const char *path, const bool readonly) > > /* override the above with these */ > > const char * const override[] = { > > "/sys/devices/pci", /* for hostdev pci devices */ > > - "/etc/libvirt-sandbox/services/" /* for virt-sandbox service config */ > > + "/etc/libvirt-sandbox/services/", /* for virt-sandbox service config */ > > + "/usr/share/ovmf/" /* for OVMF images */ > > }; > > > > const int nropaths = ARRAY_CARDINALITY(restricted); > > We have this in restriced_rw already, isn't this sufficient? Among other Hm, yeah, how did i miss that - yes that suffices, thanks. -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list