From 3ef2af8ed30f224f953aec63ba1e4be512b2fd7b Mon Sep 17 00:00:00 2001 From: Christian Ehrhardt Date: Mon, 3 Aug 2020 14:03:19 +0200 Subject: [PATCH] apparmor: let qemu load old shared objects after upgrades MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Since [1] qemu can after upgrade fall back to pre-upgrade modules to still be able to dynamically load qemu-module based features. The paths for these modules are pre-defined by the code and should be allowed to be mapped and loaded from which will allow packagers avoiding the inability of late feature load [2] after package upgrades. [1]: https://github.com/qemu/qemu/commit/bd83c861 [2]: https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/1847361 Signed-off-by: Christian Ehrhardt Acked-by: Jamie Strandboge Reviewed-by: Andrea Bolognani Reviewed-by: Daniel P. Berrangé --- src/security/apparmor/libvirt-qemu | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu index ae3db68f82..a03e9e2c94 100644 --- a/src/security/apparmor/libvirt-qemu +++ b/src/security/apparmor/libvirt-qemu @@ -169,6 +169,11 @@ /usr/{lib,lib64}/qemu/*.so mr, /usr/lib/@{multiarch}/qemu/*.so mr, + # let qemu load old shared objects after upgrades (LP: #1847361) + /{var/,}run/qemu/*/*.so mr, + # but explicitly deny writing to these files + audit deny /{var/,}run/qemu/*/*.so w, + # swtpm /{usr/,}bin/swtpm rmix, /usr/{lib,lib64}/libswtpm_libtpms.so mr, -- 2.47.2