On Fedora, already whitelisted paths to AAVMF and OVMF binaries
are symlinks to binaries under /usr/share/edk2/. Add that directory
to the RO whitelist so virt-aa-helper-test passes
Signed-off-by: Cole Robinson <crobinso@xxxxxxxxxx>
---
I don't know if anyone is actually using apparmor on Fedora, but
I have the libs installed now for testing. I think the better thing
to do would be to adjust virt-aa-helper-test to not touch host
state
src/security/virt-aa-helper.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index d9f6b5638b..509187ac36 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -505,6 +505,7 @@ valid_path(const char *path, const bool readonly)
"/vmlinuz",
"/initrd",
"/initrd.img",
+ "/usr/share/edk2/",
"/usr/share/OVMF/", /* for OVMF images */
"/usr/share/ovmf/", /* for OVMF images */
"/usr/share/AAVMF/", /* for AAVMF images */
--
2.23.0
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list
