Re: [PATCH] security: AppArmor allow write when os loader readonly=no

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Jun 07, 2024 at 09:39:30AM GMT, Andrea Bolognani wrote:
> On Tue, Jun 04, 2024 at 02:20:14PM GMT, Christian Ehrhardt wrote:
> > On Tue, Jun 4, 2024 at 1:17 PM Miroslav Los via Devel <devel@xxxxxxxxxxxxxxxxx> wrote:
> > > -    if (ctl->def->os.loader && ctl->def->os.loader->path)
> > > -        if (vah_add_file(&buf, ctl->def->os.loader->path, "rk") != 0)
> > > +    if (ctl->def->os.loader && ctl->def->os.loader->path) {
> > > +        bool readonly = false;
> > > +        virTristateBoolToBool(ctl->def->os.loader->readonly, &readonly);
> > > +        if (vah_add_file(&buf,
> > > +                         ctl->def->os.loader->path,
> > > +                         readonly ? "rk" : "rwk") != 0)
> >
> > Not tested, but the approach looks totally reasonable and in line with
> > the usual virt-aa-helper handling of such cases.
> >
> > Signed-off-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx>
>
> It looks reasonable to me too, but I'd like to see someone other than
> the author take it for a spin. Christian, can you please give it a
> shot? Once we have your Tested-by, I'll happily throw in my
> Reviewed-by and push the patch.

Unfortunately this has missed 10.5.0 now. Can we get it tested and
merged? Thanks!

-- 
Andrea Bolognani / Red Hat / Virtualization




[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]

  Powered by Linux