Jim Fehlig b482925c22 apparmor: support ptrace checks ... Kernel 4.13 introduced finer-grained ptrace checks https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=v4.13.2&id=290f458a4f16f9cf6cb6562b249e69fe1c3c3a07 With kernel 4.13 and apparmor 2.11, simply starting libvirtd results in the following apparmor denial type=AVC msg=audit(1506112085.645:954): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/libvirtd" pid=6984 comm="libvirtd" requested_mask="trace" denied_mask="trace" peer="unconfined" Attempting to start an unconfined domain results in type=AVC msg=audit(1506112301.227:1112): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/libvirtd" pid=7498 comm="libvirtd" requested_mask="trace" denied_mask="trace" peer="/usr/sbin/libvirtd" And attempting to start a confined domain results in type=AVC msg=audit(1506112631.408:1312): apparmor="DENIED" operation="open" profile="virt-aa-helper" name="/etc/libnl/classid" pid=8283 comm="virt-aa-helper" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 type=AVC msg=audit(1506112631.530:1319): apparmor="DENIED" operation="open" profile="virt-aa-helper" name="/etc/libnl/classid" pid=8289 comm="virt-aa-helper" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 type=AVC msg=audit(1506112632.186:1324): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/libvirtd" pid=8342 comm="libvirtd" requested_mask="trace" denied_mask="trace" peer="libvirt-66154842-e926-4f92-92f0-1c1bf61dd1ff" Add ptrace rules to allow the trace operations. Resolves: https://bugzilla.suse.com/show_bug.cgi?id=1058847 Signed-off-by: Jim Fehlig <jfehlig@suse.com> Reviewed-by: Guido Günther <agx@sigxcpu.org>		2017-09-25 12:03:35 +02:00
..
admin	examples: Resolve sign-compare warnings	2016-12-20 13:11:25 +01:00
apparmor	apparmor: support ptrace checks	2017-09-25 12:03:35 +02:00
dominfo	examples: Use one top level makefile	2016-01-09 21:14:12 -05:00
dommigrate	examples: Use one top level makefile	2016-01-09 21:14:12 -05:00
domsuspend	examples: Resolve sign-compare warnings	2016-12-20 13:11:25 +01:00
domtop	examples: Resolve sign-compare warnings	2016-12-20 13:11:25 +01:00
hellolibvirt	examples: Resolve sign-compare warnings	2016-12-20 13:11:25 +01:00
lxcconvert	examples: Use one top level makefile	2016-01-09 21:14:12 -05:00
object-events	storage: Add new events for *PoolBuild() and *PoolDelete().	2017-09-20 11:52:56 +02:00
openauth	lib: Fix c99 style comments	2017-04-27 14:13:19 +02:00
polkit	examples: Use one top level makefile	2016-01-09 21:14:12 -05:00
rename	examples: Use one top level makefile	2016-01-09 21:14:12 -05:00
systemtap	examples: Use one top level makefile	2016-01-09 21:14:12 -05:00
xml	examples: Use one top level makefile	2016-01-09 21:14:12 -05:00
Makefile.am	admin: Add an example demonstrating how to use the logging APIs	2016-12-15 10:36:23 +01:00