aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJamie Strandboge <jamie@canonical.com>2011-07-14 12:06:20 -0500
committerEric Blake <eblake@redhat.com>2011-07-14 11:41:48 -0600
commit3d7320403b8dd8b224a0c1eb832cfb2e89818ed3 (patch)
tree856bfa1ce27f2b2b6f385550bf93c235f10e9765 /examples
parentxenapi: Improve error reporting in xenapiOpen (diff)
downloadlibvirt-3d7320403b8dd8b224a0c1eb832cfb2e89818ed3.tar.gz
libvirt-3d7320403b8dd8b224a0c1eb832cfb2e89818ed3.tar.bz2
libvirt-3d7320403b8dd8b224a0c1eb832cfb2e89818ed3.zip
update apparmor security driver for new udev paths
In the Ubuntu development release we recently got a new udev that moves /var/run to /run, /var/lock to /run/lock and /dev/shm to /run/shm. This change in udev requires updating the apparmor security driver in libvirt[1]. Attached is a patch that: * adjusts src/security/virt-aa-helper.c to allow both LOCALSTATEDIR/run/libvirt/**/%s.pid and /run/libvirt/**/%s.pid. While the profile is not as precise, LOCALSTATEDIR/run/ is typically a symlink to /run/ anyway, so there is no additional access (remember that apparmor resolves symlinks, which is why this is still required even if /var/run points to /run). * adjusts example/apparmor/libvirt-qemu paths for /dev/shm [1]https://launchpad.net/bugs/810270 -- Jamie Strandboge | http://www.canonical.com
Diffstat (limited to 'examples')
-rw-r--r--examples/apparmor/libvirt-qemu6
1 files changed, 3 insertions, 3 deletions
diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu
index 32515366c..10cdd36b5 100644
--- a/examples/apparmor/libvirt-qemu
+++ b/examples/apparmor/libvirt-qemu
@@ -27,9 +27,9 @@
# but may constitute a security risk. If your environment does not require
# the use of sound in your VMs, feel free to comment out or prepend 'deny' to
# the rules for files in /dev.
- /dev/shm/ r,
- /dev/shm/pulse-shm* r,
- /dev/shm/pulse-shm* rwk,
+ /{dev,run}/shm r,
+ /{dev,run}/shmpulse-shm* r,
+ /{dev,run}/shmpulse-shm* rwk,
/dev/snd/* rw,
capability ipc_lock,
# 'kill' is not required for sound and is a security risk. Do not enable