On Thu, Jan 30, 2020 at 8:05 AM Michal Privoznik <[email protected]> wrote:
> These helper binaries are installed under libexec dir not lib > dir. > > Signed-off-by: Michal Privoznik <[email protected]> > --- > src/security/apparmor/usr.lib.libvirt.virt-aa-helper | 2 +- > src/security/apparmor/usr.sbin.libvirtd | 4 ++-- > 2 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper > b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper > index 11e9c039ca..ca1f6ca083 100644 > --- a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper > +++ b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper > @@ -39,7 +39,7 @@ profile virt-aa-helper > /usr/{lib,lib64}/libvirt/virt-aa-helper { > deny /dev/mapper/ r, > deny /dev/mapper/* r, > > - /usr/{lib,lib64}/libvirt/virt-aa-helper mr, > + /usr/{lib,lib64,libexec}/libvirt/virt-aa-helper mr, > /{usr/,}sbin/apparmor_parser Ux, > > /etc/apparmor.d/libvirt/* r, > diff --git a/src/security/apparmor/usr.sbin.libvirtd > b/src/security/apparmor/usr.sbin.libvirtd > index 29f9936ad9..2089ba1b3e 100644 > --- a/src/security/apparmor/usr.sbin.libvirtd > +++ b/src/security/apparmor/usr.sbin.libvirtd > @@ -100,8 +100,8 @@ profile libvirtd /usr/sbin/libvirtd > flags=(attach_disconnected) { > audit deny /sys/kernel/security/apparmor/.* rwxl, > /sys/kernel/security/apparmor/profiles r, > /usr/{lib,lib64}/libvirt/* PUxr, > - /usr/{lib,lib64}/libvirt/libvirt_parthelper ix, > - /usr/{lib,lib64}/libvirt/libvirt_iohelper ix, > + /usr/libexec/libvirt_parthelper ix, > + /usr/libexec/libvirt_iohelper ix, > This needs the same {lib,lib64,libexec} treatment. E.g. on Debian/Ubuntu this is in: /usr/lib/libvirt/libvirt_parthelper Suse most likely again has lib64 here. As I suggested in one of the patches I think we either want full dir listings for all common cases here or make it dependent to the --libexecdir configure option. > /etc/libvirt/hooks/** rmix, > /etc/xen/scripts/** rmix, > > -- > 2.24.1 > > -- Christian Ehrhardt Staff Engineer, Ubuntu Server Canonical Ltd
