forked from pool/libvirt
604f62151f
- apparmor: add support for named profiles and convert libvirtd profile to a named profile 70c2933d-apparmor-named-profiles.patch, a3ab6d42-apparmor-conv-libvirtd-named-profile.patch boo#1118952 - libxl: save current memory value after successful balloon 11c8aca9-libxl-set-mem-after-balloon.patch bsc#1120813 OBS-URL: https://build.opensuse.org/request/show/668190 OBS-URL: https://build.opensuse.org/package/show/Virtualization/libvirt?expand=0&rev=726
39 lines
1.4 KiB
Diff
39 lines
1.4 KiB
Diff
commit 70c2933da24dc4b004118afe2f9acaeabc42c0ad
|
|
Author: Jim Fehlig <jfehlig@suse.com>
|
|
Date: Fri Jan 11 17:26:03 2019 -0700
|
|
|
|
apparmor: Add support for named profiles
|
|
|
|
Upstream apparmor is switching to named profiles. In short,
|
|
|
|
/usr/sbin/dnsmasq {
|
|
|
|
becomes
|
|
|
|
profile dnsmasq /usr/sbin/dnsmasq {
|
|
|
|
Consequently, any profiles that reference profiles in a peer= condition
|
|
need to be updated if the referenced profile switches to a named profile.
|
|
Apparmor commit 9ab45d81 switched dnsmasq to a named profile. ATM it is
|
|
the only named profile switch that has affected libvirt. Add rules to the
|
|
libvirtd profile to reference dnsmasq in peer= conditions by profile name.
|
|
|
|
Signed-off-by: Jim Fehlig <jfehlig@suse.com>
|
|
|
|
Index: libvirt-5.0.0/src/security/apparmor/usr.sbin.libvirtd
|
|
===================================================================
|
|
--- libvirt-5.0.0.orig/src/security/apparmor/usr.sbin.libvirtd
|
|
+++ libvirt-5.0.0/src/security/apparmor/usr.sbin.libvirtd
|
|
@@ -52,9 +52,11 @@
|
|
|
|
ptrace (read,trace) peer=unconfined,
|
|
ptrace (read,trace) peer=/usr/sbin/libvirtd,
|
|
+ ptrace (read,trace) peer=dnsmasq,
|
|
ptrace (read,trace) peer=/usr/sbin/dnsmasq,
|
|
ptrace (read,trace) peer=libvirt-*,
|
|
|
|
+ signal (send) peer=dnsmasq,
|
|
signal (send) peer=/usr/sbin/dnsmasq,
|
|
signal (read, send) peer=libvirt-*,
|
|
signal (send) set=("kill", "term") peer=unconfined,
|