On Mon, 2015-01-19 at 18:25 -0700, Mike Latimer wrote: > The network and nwfilter tests contained in the libvirt-TCK testkit can fail > unless access to raw network packets is granted. Without this access, the > following apparmor error can be seen while running the tests: > > apparmor="DENIED" operation="create" parent=1 profile="/usr/sbin/libvirtd" > pid=94731 comm="libvirtd" family="packet" sock_type="raw" protocol=768 > > --- > examples/apparmor/usr.sbin.libvirtd | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd > index ab6572a..3cd6b58 100644 > --- a/examples/apparmor/usr.sbin.libvirtd > +++ b/examples/apparmor/usr.sbin.libvirtd > @@ -35,6 +35,7 @@ > network inet6 stream, > network inet6 dgram, > network packet dgram, > + network packet raw, > > # Very lenient profile for libvirtd since we want to first focus on confining > # the guests. Guests will have a very restricted profile. ACK -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list