Re: [libvirt] [PATCH 03/10] apparmor, virt-aa-helper: Allow aarch64 UEFI.

2017-06-16 Thread Guido Günther 
On Tue, May 23, 2017 at 06:22:41PM +0200, Stefan Bader wrote:
> From: William Grant 
> 
> Allow access to aarch64 UEFI images.
> 
> Signed-off-by: Christian Ehrhardt 
> Signed-off-by: Stefan Bader 
> Acked-by: Guido Günther 

Pushed. Thanks.
 -- Guido

> ---
>  examples/apparmor/libvirt-qemu | 2 ++
>  src/security/virt-aa-helper.c  | 4 +++-
>  tests/virt-aa-helper-test  | 2 ++
>  3 files changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu
> index e0988bb..89466c9 100644
> --- a/examples/apparmor/libvirt-qemu
> +++ b/examples/apparmor/libvirt-qemu
> @@ -71,6 +71,8 @@
>/usr/share/seabios/** r,
>/usr/share/ovmf/** r,
>/usr/share/OVMF/** r,
> +  /usr/share/AAVMF/** r,
> +  /usr/share/qemu-efi/** r,
>  
># access PKI infrastructure
>/etc/pki/libvirt-vnc/** r,
> diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
> index 6c5fc28..69e797c 100644
> --- a/src/security/virt-aa-helper.c
> +++ b/src/security/virt-aa-helper.c
> @@ -513,7 +513,9 @@ valid_path(const char *path, const bool readonly)
>  "/initrd",
>  "/initrd.img",
>  "/usr/share/OVMF/",  /* for OVMF images */
> -"/usr/share/ovmf/"   /* for OVMF images */
> +"/usr/share/ovmf/",  /* for OVMF images */
> +"/usr/share/AAVMF/", /* for AAVMF images */
> +"/usr/share/qemu-efi/"   /* for AAVMF images */
>  };
>  /* override the above with these */
>  const char * const override[] = {
> diff --git a/tests/virt-aa-helper-test b/tests/virt-aa-helper-test
> index 73f3080..51072f6 100755
> --- a/tests/virt-aa-helper-test
> +++ b/tests/virt-aa-helper-test
> @@ -307,6 +307,8 @@ testme "0" "kernel" "-r -u $valid_uuid" "$test_xml"
>  
>  testfw "ovmf (old path)" "/usr/share/ovmf/OVMF.fd"
>  testfw "OVMF (new path)" "/usr/share/OVMF/OVMF_CODE.fd"
> +testfw "AAVMF" "/usr/share/AAVMF/AAVMF_CODE.fd"
> +testfw "qemu-efi" "/usr/share/qemu-efi/QEMU_EFI.fd"
>  
>  sed -e "s,###UUID###,$uuid,g" -e "s,###DISK###,$disk1,g" -e 
> "s,,$tmpdir/initrd,g" "$template_xml" > "$test_xml"
>  touch "$tmpdir/initrd"
> -- 
> 2.7.4
> 
> --
> libvir-list mailing list
> libvir-list@redhat.com
> https://www.redhat.com/mailman/listinfo/libvir-list

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

[libvirt] [PATCH 03/10] apparmor, virt-aa-helper: Allow aarch64 UEFI.

2017-05-23 Thread Stefan Bader 
From: William Grant 

Allow access to aarch64 UEFI images.

Signed-off-by: Christian Ehrhardt 
Signed-off-by: Stefan Bader 
Acked-by: Guido Günther 
---
 examples/apparmor/libvirt-qemu | 2 ++
 src/security/virt-aa-helper.c  | 4 +++-
 tests/virt-aa-helper-test  | 2 ++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu
index e0988bb..89466c9 100644
--- a/examples/apparmor/libvirt-qemu
+++ b/examples/apparmor/libvirt-qemu
@@ -71,6 +71,8 @@
   /usr/share/seabios/** r,
   /usr/share/ovmf/** r,
   /usr/share/OVMF/** r,
+  /usr/share/AAVMF/** r,
+  /usr/share/qemu-efi/** r,
 
   # access PKI infrastructure
   /etc/pki/libvirt-vnc/** r,
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index 6c5fc28..69e797c 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -513,7 +513,9 @@ valid_path(const char *path, const bool readonly)
 "/initrd",
 "/initrd.img",
 "/usr/share/OVMF/",  /* for OVMF images */
-"/usr/share/ovmf/"   /* for OVMF images */
+"/usr/share/ovmf/",  /* for OVMF images */
+"/usr/share/AAVMF/", /* for AAVMF images */
+"/usr/share/qemu-efi/"   /* for AAVMF images */
 };
 /* override the above with these */
 const char * const override[] = {
diff --git a/tests/virt-aa-helper-test b/tests/virt-aa-helper-test
index 73f3080..51072f6 100755
--- a/tests/virt-aa-helper-test
+++ b/tests/virt-aa-helper-test
@@ -307,6 +307,8 @@ testme "0" "kernel" "-r -u $valid_uuid" "$test_xml"
 
 testfw "ovmf (old path)" "/usr/share/ovmf/OVMF.fd"
 testfw "OVMF (new path)" "/usr/share/OVMF/OVMF_CODE.fd"
+testfw "AAVMF" "/usr/share/AAVMF/AAVMF_CODE.fd"
+testfw "qemu-efi" "/usr/share/qemu-efi/QEMU_EFI.fd"
 
 sed -e "s,###UUID###,$uuid,g" -e "s,###DISK###,$disk1,g" -e 
"s,,$tmpdir/initrd,g" "$template_xml" > "$test_xml"
 touch "$tmpdir/initrd"
-- 
2.7.4

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Re: [libvirt] [PATCH 03/10] apparmor, virt-aa-helper: Allow aarch64 UEFI.

2017-05-15 Thread Guido Günther 
On Mon, May 15, 2017 at 03:23:12PM +0200, Stefan Bader wrote:
> From: William Grant 
> 
> Allow access to aarch64 UEFI images.
> 
> Signed-off-by: Christian Ehrhardt 
> Signed-off-by: Stefan Bader 
> ---
>  examples/apparmor/libvirt-qemu | 2 ++
>  src/security/virt-aa-helper.c  | 4 +++-
>  tests/virt-aa-helper-test  | 2 ++
>  3 files changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu
> index e0988bb..89466c9 100644
> --- a/examples/apparmor/libvirt-qemu
> +++ b/examples/apparmor/libvirt-qemu
> @@ -71,6 +71,8 @@
>/usr/share/seabios/** r,
>/usr/share/ovmf/** r,
>/usr/share/OVMF/** r,
> +  /usr/share/AAVMF/** r,
> +  /usr/share/qemu-efi/** r,
>  
># access PKI infrastructure
>/etc/pki/libvirt-vnc/** r,
> diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
> index dd166c2..a2d5c21 100644
> --- a/src/security/virt-aa-helper.c
> +++ b/src/security/virt-aa-helper.c
> @@ -513,7 +513,9 @@ valid_path(const char *path, const bool readonly)
>  "/initrd",
>  "/initrd.img",
>  "/usr/share/OVMF/",  /* for OVMF images */
> -"/usr/share/ovmf/"   /* for OVMF images */
> +"/usr/share/ovmf/",  /* for OVMF images */
> +"/usr/share/AAVMF/", /* for AAVMF images */
> +"/usr/share/qemu-efi/"   /* for AAVMF images */
>  };
>  /* override the above with these */
>  const char * const override[] = {
> diff --git a/tests/virt-aa-helper-test b/tests/virt-aa-helper-test
> index 73f3080..51072f6 100755
> --- a/tests/virt-aa-helper-test
> +++ b/tests/virt-aa-helper-test
> @@ -307,6 +307,8 @@ testme "0" "kernel" "-r -u $valid_uuid" "$test_xml"
>  
>  testfw "ovmf (old path)" "/usr/share/ovmf/OVMF.fd"
>  testfw "OVMF (new path)" "/usr/share/OVMF/OVMF_CODE.fd"
> +testfw "AAVMF" "/usr/share/AAVMF/AAVMF_CODE.fd"
> +testfw "qemu-efi" "/usr/share/qemu-efi/QEMU_EFI.fd"
>  
>  sed -e "s,###UUID###,$uuid,g" -e "s,###DISK###,$disk1,g" -e 
> "s,,$tmpdir/initrd,g" "$template_xml" > "$test_xml"
>  touch "$tmpdir/initrd"
> -- 
> 2.7.4
> 
ACK.
 -- Guido

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

[libvirt] [PATCH 03/10] apparmor, virt-aa-helper: Allow aarch64 UEFI.

2017-05-15 Thread Stefan Bader 
From: William Grant 

Allow access to aarch64 UEFI images.

Signed-off-by: Christian Ehrhardt 
Signed-off-by: Stefan Bader 
---
 examples/apparmor/libvirt-qemu | 2 ++
 src/security/virt-aa-helper.c  | 4 +++-
 tests/virt-aa-helper-test  | 2 ++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu
index e0988bb..89466c9 100644
--- a/examples/apparmor/libvirt-qemu
+++ b/examples/apparmor/libvirt-qemu
@@ -71,6 +71,8 @@
   /usr/share/seabios/** r,
   /usr/share/ovmf/** r,
   /usr/share/OVMF/** r,
+  /usr/share/AAVMF/** r,
+  /usr/share/qemu-efi/** r,
 
   # access PKI infrastructure
   /etc/pki/libvirt-vnc/** r,
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index dd166c2..a2d5c21 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -513,7 +513,9 @@ valid_path(const char *path, const bool readonly)
 "/initrd",
 "/initrd.img",
 "/usr/share/OVMF/",  /* for OVMF images */
-"/usr/share/ovmf/"   /* for OVMF images */
+"/usr/share/ovmf/",  /* for OVMF images */
+"/usr/share/AAVMF/", /* for AAVMF images */
+"/usr/share/qemu-efi/"   /* for AAVMF images */
 };
 /* override the above with these */
 const char * const override[] = {
diff --git a/tests/virt-aa-helper-test b/tests/virt-aa-helper-test
index 73f3080..51072f6 100755
--- a/tests/virt-aa-helper-test
+++ b/tests/virt-aa-helper-test
@@ -307,6 +307,8 @@ testme "0" "kernel" "-r -u $valid_uuid" "$test_xml"
 
 testfw "ovmf (old path)" "/usr/share/ovmf/OVMF.fd"
 testfw "OVMF (new path)" "/usr/share/OVMF/OVMF_CODE.fd"
+testfw "AAVMF" "/usr/share/AAVMF/AAVMF_CODE.fd"
+testfw "qemu-efi" "/usr/share/qemu-efi/QEMU_EFI.fd"
 
 sed -e "s,###UUID###,$uuid,g" -e "s,###DISK###,$disk1,g" -e 
"s,,$tmpdir/initrd,g" "$template_xml" > "$test_xml"
 touch "$tmpdir/initrd"
-- 
2.7.4

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list