Custom rom location is not allowed by aa-helper

[Andrey Korolyov]

Please find that the currently the code in the aa-helper forbids rare, though possible config type:

  <os>
...
    <loader>/usr/share/seabios/bios.bin-1.7.5</loader>
...
  </os>

internal error: Child process (/usr/lib/libvirt/virt-aa-helper -p 0 -r -u libvirt-866ba0e5-405e-442c-8544-fea8171a65c5) unexpected exit status 1: Failed to read classid file: No Access
virt-aa-helper: warning: path does not exist, skipping file type checks
virt-aa-helper: error: /usr/share/seabios/bios.bin-1.7.5

Also there is a trivial change for reading /etc/ceph/keyring.bin as the Ceph-enabled setups are flooding logs with this forbidden location as well.

[Andrey Korolyov (xdeller)]

Partially duplicated by #1015154

[Serge Hallyn (serge-hallyn)]

Interesting. The needed path is actually provided by /etc/apparmor.d/abstractions/libvirt-qemu, but virt-aa-helper sees the loader and proceeds to try to add the path. Because the path a restricted one (under /usr/share), it is automatically rejected.

A workaround is to copy the bios to another path, i.e. /opt/bios.bin, and specify that path.

Marking this low priority because of the workaround, however this really ought to be fixed upstream.

I'm not sure what a proper fix would be. Perhaps vah_add_path() should simply first check whether the policy specified this far already allows the path.

[Serge Hallyn (serge-hallyn)]

(medium, not low, priority)