From 1fff379ff6e778ce7d235ef499858983eb411213 Mon Sep 17 00:00:00 2001 From: intrigeri Date: Sat, 9 Jun 2018 19:26:26 +0000 Subject: [PATCH] AppArmor: allow virt-aa-helper read access to Nova's qcow backing files. As reported on https://bugs.debian.org/892431, without this rule, when launching a QEMU KVM instance, an error occurs immediately upon launching the QEMU process such as: Could not open backing file: Could not open '/var/lib/nova/instances/_base/affe96668a4c64ef380ff1c71b4caec17039080e': Permission denied The other instance disk images are already covered by the existing rule: /**/disk{,.*} r Signed-off-by: intrigeri --- examples/apparmor/usr.lib.libvirt.virt-aa-helper | 1 + 1 file changed, 1 insertion(+) diff --git a/examples/apparmor/usr.lib.libvirt.virt-aa-helper b/examples/apparmor/usr.lib.libvirt.virt-aa-helper index 6869685c05..e32402a904 100644 --- a/examples/apparmor/usr.lib.libvirt.virt-aa-helper +++ b/examples/apparmor/usr.lib.libvirt.virt-aa-helper @@ -50,6 +50,7 @@ profile virt-aa-helper /usr/{lib,lib64}/libvirt/virt-aa-helper { @{HOME}/** r, /var/lib/libvirt/images/ r, /var/lib/libvirt/images/** r, + /var/lib/nova/instances/_base/* r /{media,mnt,opt,srv}/** r, # For virt-sandbox /{,var/}run/libvirt/**/[sv]d[a-z] r,