NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

virt-aa-helper: handle more disk images

Browse Source 
virt-aa-helper needs read access to the disk image to resolve symlinks
and add the proper rules to the profile. Its profile whitelists a few
common paths, but users can place their images anywhere.

This commit helps users allowing access to their images by adding their
own rules in apparmor.d/local/usr.lib.libvirt.virt-aa-helper.

This commit also adds rules to allow reading files named:
  - *.raw as this is a rather common disk image extension
  - /run/libvirt/**[vd]d[a-z] as these are used by virt-sandbox
This commit is contained in:
Cédric Bosdonnat
2017-12-11 11:09:31 +01:00
parent 291f68b5da
commit 0f33025a43
2 changed files with 27 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
examples/apparmor/usr.lib.libvirt.virt-aa-helper
View File

@@ -50,11 +50,16 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper {
/var/lib/libvirt/images/ r,
/var/lib/libvirt/images/** r,
/{media,mnt,opt,srv}/** r,
# For virt-sandbox
/run/libvirt/**/[sv]d[a-z] r
/**.img r,
/**.raw r,
/**.qcow{,2} r,
/**.qed r,
/**.vmdk r,
/**.[iI][sS][oO] r,
/**/disk{,.*} r,
#include <local/usr.lib.libvirt.virt-aa-helper>
}