On Mon, May 15, 2017 at 06:07:12PM +0200, Stefan Bader wrote: > On 15.05.2017 17:48, Guido Günther wrote: > > On Mon, May 15, 2017 at 03:23:10PM +0200, Stefan Bader wrote: > >> From: Serge Hallyn <serge.hallyn@xxxxxxxxxx> > >> > >> Just because a disk element only requests read access doesn't mean > >> there may not be another readwrite request. > >> > >> Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/bugs/1554031 > > > > The URL is wrong (drop the "ubuntu" part. From the bug report this looks > > like a workaround: > > Darn, thanks for catching this. > > > > > https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1554031/comments/8 > > > > or am I misreading this? Shouldn't we only change to 'w' on blockcommit? > > As I understand it, the 'r' would implicitly add a write deny rule, so it is not > possible to override that. With the 'R' notation only a rule allowing read is > added. Which allows to change to change to 'w' on blockcommit. But if we aim for a profile replace on blockcommit [1] the would't matter since the whole profile would get replaced, wouldn't it? Cheers, -- Guido [1] I have not checked that that profile replace currenlty happens with libvirt I'm trying to figure out how we want it to work and then fix the right place. > > -Stefan > > > Cheers > > -- Guido > > > >> > >> Signed-off-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx> > >> Signed-off-by: Stefan Bader <stefan.bader@xxxxxxxxxxxxx> > >> --- > >> src/security/virt-aa-helper.c | 4 ++-- > >> 1 file changed, 2 insertions(+), 2 deletions(-) > >> > >> diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c > >> index 5f5d1cd..d976a00 100644 > >> --- a/src/security/virt-aa-helper.c > >> +++ b/src/security/virt-aa-helper.c > >> @@ -888,11 +888,11 @@ add_file_path(virDomainDiskDefPtr disk, > >> > >> if (depth == 0) { > >> if (disk->src->readonly) > >> - ret = vah_add_file(buf, path, "r"); > >> + ret = vah_add_file(buf, path, "R"); > >> else > >> ret = vah_add_file(buf, path, "rw"); > >> } else { > >> - ret = vah_add_file(buf, path, "r"); > >> + ret = vah_add_file(buf, path, "R"); > >> } > >> > >> if (ret != 0) > >> -- > >> 2.7.4 > >> > > > > -- > > libvir-list mailing list > > libvir-list@xxxxxxxxxx > > https://www.redhat.com/mailman/listinfo/libvir-list > > > > -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list
