On 11/17/20 7:11 PM, Neal Gompa wrote:
On Tue, Nov 17, 2020 at 11:49 AM Christian Ehrhardt
<christian.ehrhardt@xxxxxxxxxxxxx> wrote:
On Mon, Nov 16, 2020 at 3:28 PM Michal Privoznik <mprivozn@xxxxxxxxxx> wrote:
On 11/16/20 1:26 PM, Christian Ehrhardt wrote:
'kvm-spice' is a binary name used to call 'kvm' which actually is a wrapper
around qemu-system-x86_64 enabling kvm acceleration. This isn't in use
for quite a while anymore, but required to work for compatibility e.g.
when migrating in old guests.
For years this was a symlink kvm-spice->kvm and therefore covered
apparmor-wise by the existing entry:
/usr/bin/kvm rmix,
But due to a recent change [1] in qemu packaging this now is no symlink,
but a wrapper on its own and therefore needs an own entry that allows it
to be executed.
[1]: https://salsa.debian.org/qemu-team/qemu/-/commit/9944836d3
Signed-off-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx>
---
src/security/apparmor/libvirt-qemu | 1 +
1 file changed, 1 insertion(+)
Reviewed-by: Michal Privoznik <mprivozn@xxxxxxxxxx>
Thank you Michal,
it also passed fine through my tests (as backport to 6.8 and 6.9).
We are not in any freeze, review has happened, tests LGTM - pushed to git.
Hold up, why was this merged? Did anyone validate whether this would
break the other AppArmor user (SUSE)?
Michal already mentioned it, but the change wouldn't break SUSE since it just
allows execution of a qemu binary by yet another name. And AFAIK, SUSE never had
a 'kvm-spice' qemu binary :-).
Regards,
Jim
