Re: [PATCH] security: AppArmor allow write when os loader readonly=no

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Jun 04, 2024 at 02:20:14PM GMT, Christian Ehrhardt wrote:
> On Tue, Jun 4, 2024 at 1:17 PM Miroslav Los via Devel <devel@xxxxxxxxxxxxxxxxx> wrote:
> > -    if (ctl->def->os.loader && ctl->def->os.loader->path)
> > -        if (vah_add_file(&buf, ctl->def->os.loader->path, "rk") != 0)
> > +    if (ctl->def->os.loader && ctl->def->os.loader->path) {
> > +        bool readonly = false;
> > +        virTristateBoolToBool(ctl->def->os.loader->readonly, &readonly);
> > +        if (vah_add_file(&buf,
> > +                         ctl->def->os.loader->path,
> > +                         readonly ? "rk" : "rwk") != 0)
>
> Not tested, but the approach looks totally reasonable and in line with
> the usual virt-aa-helper handling of such cases.
>
> Signed-off-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx>

It looks reasonable to me too, but I'd like to see someone other than
the author take it for a spin. Christian, can you please give it a
shot? Once we have your Tested-by, I'll happily throw in my
Reviewed-by and push the patch.

-- 
Andrea Bolognani / Red Hat / Virtualization




[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]

  Powered by Linux