On 2/12/20 11:38 AM, Christian Ehrhardt wrote:
On Thu, Jan 30, 2020 at 8:05 AM Michal Privoznik <mprivozn@xxxxxxxxxx
<mailto:mprivozn@xxxxxxxxxx>> wrote:
There are two more paths that we are missing in the default
domain profile: /usr/share/edk2-ovmf/ and /usr/share/sgabios/.
These exist on my Gentoo box and contain UEFI and BIOS images
respectively.
Signed-off-by: Michal Privoznik <mprivozn@xxxxxxxxxx
<mailto:mprivozn@xxxxxxxxxx>>
---
src/security/apparmor/libvirt-qemu | 2 ++
1 file changed, 2 insertions(+)
Hi Michal,
You might already have abandoned this as I've seen other parts of the
series land (thanks for the dynamic paths now).But revisiting this I
found that they seem not needed.
diff --git a/src/security/apparmor/libvirt-qemu
b/src/security/apparmor/libvirt-qemu
index 2291829270..6942b83969 100644
--- a/src/security/apparmor/libvirt-qemu
+++ b/src/security/apparmor/libvirt-qemu
@@ -75,6 +75,7 @@
# access to firmware's etc
/usr/share/AAVMF/** r,
/usr/share/bochs/** r,
+ /usr/share/edk2-ovmf/** r,
At least on Debian/Ubuntu the multiple edk2 related cases are already
covered by
85342a3771b (Guido Günther 2014-04-07 12:15:02 +0200)
/usr/share/ovmf/** r,
f9803f59148 (Guido Günther 2017-07-06 11:04:21 +0200)
/usr/share/OVMF/** r,
f9803f59148 (Guido Günther 2017-07-06 11:04:21 +0200)
/usr/share/AAVMF/** r,
f9803f59148 (Guido Günther 2017-07-06 11:04:21 +0200)
/usr/share/qemu-efi/** r,
/usr/share/kvm/** r,
/usr/share/misc/sgabios.bin r,
/usr/share/openbios/** r,
@@ -86,6 +87,7 @@
/usr/share/qemu-kvm/** r,
/usr/share/qemu/** r,
/usr/share/seabios/** r,
+ /usr/share/sgabios/** r,
Again for Debian/Ubuntu this is already covered by:
987d1fdc535 (Guido Günther 2018-01-15 09:44:37 +0100)
/usr/share/misc/sgabios.bin r,
I guess Suse would have mentioned if the paths would not have worked for
them.
Did you have another Distro which uses the paths that try to add here?
I'm not sure what you mean. The commit message says that Gentoo uses
these paths. And indeed it does:
# qlist sys-firmware/edk2-ovmf | grep OVMF_CODE.fd
/usr/share/edk2-ovmf/OVMF_CODE.fd
# qlist sys-firmware/sgabios
/usr/share/sgabios/sgabios.bin
Are you saying that we should remove some other, pre-existing paths from
the file?
Michal
