diff -Nru libvirt-8.0.0/debian/changelog libvirt-8.0.0/debian/changelog --- libvirt-8.0.0/debian/changelog 2022-10-17 13:51:52.000000000 +0000 +++ libvirt-8.0.0/debian/changelog 2022-10-17 15:04:02.000000000 +0000 @@ -1,3 +1,10 @@ +libvirt (8.0.0-1ubuntu7.3~cloud0ubuntu1) focal-yoga; urgency=medium + + * d/p/ubuntu-aa/lp-1988270-disable-apparmor-features-not-existing-before-3.0.patch + Patch apparmor profile for libvirt removing capabilites bpf and perfmon (LP: #1988270) + + -- Heather Lemon Mon, 17 Oct 2022 15:04:02 +0000 + libvirt (8.0.0-1ubuntu7.3~cloud0) focal-yoga; urgency=medium * New update for the Ubuntu Cloud Archive. diff -Nru libvirt-8.0.0/debian/patches/series libvirt-8.0.0/debian/patches/series --- libvirt-8.0.0/debian/patches/series 2022-10-17 13:51:54.000000000 +0000 +++ libvirt-8.0.0/debian/patches/series 2022-10-17 15:01:03.000000000 +0000 @@ -36,3 +36,4 @@ ubuntu/lp-1972075-Allow-VM-to-read-sysfs-PCI-config-revision-files.patch ubuntu/lp-1989078-apparmor-Allow-locking-AAVMF-firmware.patch ubuntu/lp-1990499-virt-aa-helper-allow-common-riscv64-loader-paths.patch +ubuntu-aa/lp-1988270-backport-disable-new-aa-features.patch diff -Nru libvirt-8.0.0/debian/patches/ubuntu-aa/lp-1988270-backport-disable-new-aa-features.patch libvirt-8.0.0/debian/patches/ubuntu-aa/lp-1988270-backport-disable-new-aa-features.patch --- libvirt-8.0.0/debian/patches/ubuntu-aa/lp-1988270-backport-disable-new-aa-features.patch 1970-01-01 00:00:00.000000000 +0000 +++ libvirt-8.0.0/debian/patches/ubuntu-aa/lp-1988270-backport-disable-new-aa-features.patch 2022-10-17 15:03:55.000000000 +0000 @@ -0,0 +1,25 @@ +Description: drop apparmor features not present + Due to the backport to the older apparmor (pre 3.0) some + features do not exist. Letting them in the profile makes + the whole thing fail to load: + line 29: Invalid capability bpf + That leaves the profile not loaded at all and makes apparmor.service + fail. Patch removes capability bpf and perfmon. + Note: added to the top to reduce churn on e.g. SRU updates to libvirt + +Bug-Ubuntu: https://launchpad.net/bugs/1988270 +Forwarded: no +X-Not-Forwarded-Reason: Needed for backport only +Author: Christian Ehrhardt +Last-Updated: 2022-10-17 +--- a/src/security/apparmor/usr.sbin.libvirtd.in ++++ b/src/security/apparmor/usr.sbin.libvirtd.in +@@ -26,8 +26,6 @@ profile libvirtd @sbindir@/libvirtd flag + capability audit_write, + capability ipc_lock, + capability sys_rawio, +- capability bpf, +- capability perfmon, + + # Needed for vfio + capability sys_resource,