Missing entries in libvirt-qemu AppArmor profile

[Louis Bouchard]

Description: Ubuntu 11.10
Release : 11.10

When setting up VncTLS according to the official Libvirt documentation, only one certificate for libvirt/libvirt-vnc is used. The document indicates to use the following directories :

 /etc/pki/CA
 /etc/pki/libvirt
 /etc/pki/libvirt/private

in order to manage the certificates used by libvirt-vnc.

This is the document that talks about it : http://wiki.libvirt.org/page/VNCTLSSetup

These directories should be added to the libvirt AppArmor profile provided by Ubuntu.

Reproducible: 100%

Workaround:

Manually modify the /etc/apparmor.d/abstractions/libvirt-qemu profile

Business concern:

This would affect anybody trying to use the official documentation to enable qemu-vnc

Request:

Modify the libvirt-qemu profile

ProblemType: Bug
DistroRelease: Ubuntu 11.10
Package: libvirt-bin-0.9.2-4ubuntu15.1
Uname: Linux 3.0.0-13-server x86_64
Architecture: N/A

[Jamie Strandboge (jdstrand)]

Thanks for your report. Does adding the following to /etc/apparmor.d/abstractions/libvirt-qemu fix the issue for you:
  /etc/pki/CA/ r,
  /etc/pki/CA/* r,
  /etc/pki/libvirt/ r,
  /etc/pki/libvirt/* r
  /etc/pki/libvirt/private/ r,
  /etc/pki/libvirt/private/* r,

[Jamie Strandboge (jdstrand)]

Actually, this might be simpler:
  /etc/pki/CA/ r,
  /etc/pki/CA/* r,
  /etc/pki/libvirt/ r,
  /etc/pki/libvirt/** r,

[Jamie Strandboge (jdstrand)]

/etc/pki/libvirt/** r, # this assumes there is nothing else in /etc/pki/libvirt besides the files needed by qemu

[Poil (poil)]

Adding "/etc/pki/CA/* r, /etc/pki/libvirt/** r," is OK for me.

best regards

[Jamie Strandboge (jdstrand)]

Thanks. It is not ideal that we have /etc/pki/libvirt/** since all VMs have read access to each other's pki files, but unless we have svirt support for the different pki files, this is good enough.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libvirt - 0.9.7-2ubuntu8

---------------
libvirt (0.9.7-2ubuntu8) precise; urgency=low

  * debian/apparmor/libvirt-qemu: add /etc/pki/CA/* and /etc/pki/libvirt/**
    (LP: #901272)
 -- Serge Hallyn <email address hidden> Wed, 04 Jan 2012 13:18:50 -0600