Acked-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxx>
That (just FYI) is also equivalent to https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1615550
On Mon, Dec 12, 2016 at 11:59 AM, intrigeri <intrigeri+libvirt@xxxxxxxx> wrote:
https://bugzilla.redhat.com/show_bug.cgi?id=1369281
---
examples/apparmor/libvirt-qemu | 3 +++
1 file changed, 3 insertions(+)
diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt- qemu
index 11381d4df0..fdb5a23291 100644
--- a/examples/apparmor/libvirt-qemu
+++ b/examples/apparmor/libvirt-qemu
@@ -21,6 +21,9 @@
/dev/ptmx rw,
/dev/kqemu rw,
@{PROC}/*/status r,
+ # Per man(5) proc, the kernel enforces that a thread may
+ # only modify its comm value or those in its thread group.
+ owner @{PROC}/@{pid}/task/@{tid}/comm rw,
@{PROC}/sys/kernel/cap_last_cap r,
# For hostdev access. The actual devices will be added dynamically
--
2.11.0
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list
Christian Ehrhardt
Software Engineer, Ubuntu Server
Canonical Ltd
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list
