when a device is dynamically attached to a VM, and it needs a special system access for apparmor, libvirt calls virt-aa-helper (with argument -F) to append a new rule to the apparmor profile of the VM. virt-aa-helper does not check for duplicate and blindly appends the rule to the profile. since there is no rule removal when a device is detached, this can make the profile grow in size if a big number of attach/detach operations are done and the profile might hit the size limit and futur attach operations might dysfunction because no rule can be added into the apparmor profile.
this patch tries to mitigate this issue by doing a duplicate check when rules are appended into the profile. this fix does not guarantee the absence of duplicates but should be enough to prevent the profile to grow significantly in size and reach its size limit. This v2 takes into account the feedback from Michal Prívozník for the original submission: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/2HIZC2EK72NBLMCNGT54XIVGJEGG7YNN/ v2: - early exit if duplicate is detected - improve the check condition for existing profile data Hector Cao (1): virt-aa-helper: Avoid duplicate when append rule src/security/virt-aa-helper.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) -- 2.34.1
