openkylin
/
libvirt
mirror of https://gitee.com/openkylin/libvirt.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

apparmor: add ro rule for sasl GSSAPI plugin on /etc/gss/mech.d/ 

If a system has sasl GSSAPI plugin available qemu with sasl support will
try to read /etc/gss/mech.d/.

It is required to allow that to let the modules fully work and it should
be safe to do so as it only registers/configures plugins but has no secrets.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Jamie Strandboge <jamie@canonical.com>
Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
This commit is contained in:
Christian Ehrhardt 2018-03-07 11:02:23 +01:00
parent 39a6df5334
commit dadfba923a
No known key found for this signature in database
GPG Key ID: BA3E29338280B242
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
examples/apparmor/libvirt-qemu
View File

@ -192,3 +192,7 @@
# silence refusals to open lttng files (see LP: #1432644)
deny /dev/shm/lttng-ust-wait-* r,
deny /run/shm/lttng-ust-wait-* r,
# required for sasl GSSAPI plugin
/etc/gss/mech.d/ r,
/etc/gss/mech.d/* r,