On Mon, Apr 09, 2018 at 08:34:06AM +0200, Christian Ehrhardt wrote: > Due to mediation of socket and signal activity currently qemu:///session > connections calling qemu_bridge_helper fail. > > We need the profile for libvirtd itself and the subprofile for > qemu-bridge-helper to be able to talk/notify to each other via unix socket and > signals. > > Fixes: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1754871 > > Signed-off-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx> > --- > examples/apparmor/usr.sbin.libvirtd | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd > index be4fabf..3102cab 100644 > --- a/examples/apparmor/usr.sbin.libvirtd > +++ b/examples/apparmor/usr.sbin.libvirtd > @@ -65,6 +65,10 @@ > signal (read, send) peer=libvirt-*, > signal (send) set=("kill", "term") peer=unconfined, > > + # For communication/control to qemu-bridge-helper > + unix (send, receive) type=stream addr=none peer=(label=/usr/sbin/libvirtd//qemu_bridge_helper), > + signal (send) set=("term") peer=/usr/sbin/libvirtd//qemu_bridge_helper, > + > # Very lenient profile for libvirtd since we want to first focus on confining > # the guests. Guests will have a very restricted profile. > / r, > @@ -112,6 +116,10 @@ > > network inet stream, > > + # For communication/control from libvirtd > + unix (send, receive) type=stream addr=none peer=(label=/usr/sbin/libvirtd), > + signal (receive) set=("term") peer=/usr/sbin/libvirtd, > + > /dev/net/tun rw, > /etc/qemu/** r, > owner @{PROC}/*/status r, Reviewed-by: Guido Günther <agx@xxxxxxxxxxx> > -- > 2.7.4 > -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list
