Christian Ehrhardt 8f882cf36e apparmor: allow unix stream for p2p migrations ... On live migration with --p2p like: $ virsh migrate --live --p2p kvmguest-bionic-normal \ qemu+ssh://10.6.221.80/system We hit an apparmor deny like: apparmor="DENIED" operation="file_inherit" profile="/usr/sbin/libvirtd" pid=23477 comm="ssh" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send" addr=none peer_addr=none peer="unconfined" The rule is not perfect, but can't be restricted further at the moment (new upstream kernel features needed). For now the lack of a profile on the peer as well as comm not being a conditional on rules do not allow to filter further. Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>		2018-01-03 09:45:21 +01:00
..
libvirt-lxc	Rework lxc apparmor profile	2014-07-15 12:57:05 -06:00
libvirt-qemu	apparmor: allow qemu abstraction to read /proc/pid/cmdline	2017-12-04 07:00:14 -07:00
TEMPLATE.lxc	apparmor: add attach_disconnected	2017-09-18 19:06:52 +02:00
TEMPLATE.qemu	apparmor: add attach_disconnected	2017-09-18 19:06:52 +02:00
usr.lib.libvirt.virt-aa-helper	virt-aa-helper: handle more disk images	2017-12-20 11:05:54 +01:00
usr.sbin.libvirtd	apparmor: allow unix stream for p2p migrations	2018-01-03 09:45:21 +01:00