From 4ec3cf9a0fc3d76058ea363a6c35df19e67e6261 Mon Sep 17 00:00:00 2001 From: Jim Fehlig Date: Fri, 1 Mar 2019 15:05:36 -0700 Subject: [PATCH] apparmor: Add ptrace and signal rules for named profile Commit a3ab6d42 changed the libvirtd profile to a named profile but neglected to accommodate the change in the qemu profile ptrace and signal rules. As a result, libvirtd is unable to signal confined qemu processes and hence unable to shutdown or destroy VMs. Add ptrace and signal rules that reference the libvirtd profile by name in addition to full binary path. Signed-off-by: Jim Fehlig Acked-by: Jamie Strandboge --- src/security/apparmor/libvirt-qemu | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu index 7d28faa163..474aaefdf8 100644 --- a/src/security/apparmor/libvirt-qemu +++ b/src/security/apparmor/libvirt-qemu @@ -16,8 +16,10 @@ network inet stream, network inet6 stream, + ptrace (readby, tracedby) peer=libvirtd, ptrace (readby, tracedby) peer=/usr/sbin/libvirtd, + signal (receive) peer=libvirtd, signal (receive) peer=/usr/sbin/libvirtd, /dev/net/tun rw,