From: intrigeri <intrigeri+libvirt@boum.org>
Date: Sat, 9 Jun 2018 19:26:26 +0000 (+0000)
Subject: AppArmor: allow virt-aa-helper read access to Nova's qcow backing files.
X-Git-Tag: v4.5.0-rc1~137
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1fff379ff6e778ce7d235ef499858983eb411213;p=thirdparty%2Flibvirt.git

AppArmor: allow virt-aa-helper read access to Nova's qcow backing files.

As reported on https://bugs.debian.org/892431, without this rule, when launching
a QEMU KVM instance, an error occurs immediately upon launching the QEMU
process such as:

  Could not open backing file: Could not open
  '/var/lib/nova/instances/_base/affe96668a4c64ef380ff1c71b4caec17039080e':
  Permission denied

The other instance disk images are already covered by the existing rule:

  /**/disk{,.*} r

Signed-off-by: intrigeri <intrigeri@boum.org>
---

diff --git a/examples/apparmor/usr.lib.libvirt.virt-aa-helper b/examples/apparmor/usr.lib.libvirt.virt-aa-helper
index 6869685c05..e32402a904 100644
--- a/examples/apparmor/usr.lib.libvirt.virt-aa-helper
+++ b/examples/apparmor/usr.lib.libvirt.virt-aa-helper
@@ -50,6 +50,7 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper {
   @{HOME}/** r,
   /var/lib/libvirt/images/ r,
   /var/lib/libvirt/images/** r,
+  /var/lib/nova/instances/_base/* r
   /{media,mnt,opt,srv}/** r,
   # For virt-sandbox
   /{,var/}run/libvirt/**/[sv]d[a-z] r,