Thanks Jelle for the details,
And since it used to work for me and you, but now seems to be not working the assumption is that this regressed in 22.10.
Working theory (based on the denials and other details):
Some change in libusb makes (we had a similar case in the past) it no more just iterate over, but read the actual files in /sys/bus/usb/devices/*. Since they are symlinks that was never meant to be needed but it is a getattr which might happen on the symllinks itself, so we'd need to probably just add:
/sys/bus/usb/devices/* r,
@Jelle
1. could you check if just adding `/sys/bus/usb/devices/* r,` (and nothing else to any apparmor file) to /etc/apparmor.d/local/abstractions/libvirt-qemu is enough for your case?
2. I'd want to know if any dynamic rules got added before.
In the above case (please adapt uuid accordingly) can you compare 22.10 to 22.04?
The /etc/apparmor.d/libvirt/libvirt-b14c0d3c-1c39-4d8e-ab57-6434b4efa59b actually includes the .files (it always does) so the question is if you have any *usb* rules that got rendered into /etc/apparmor.d/libvirt/libvirt-b14c0d3c-1c39-4d8e-ab57-6434b4efa59b.files in either release?
@Team - I'll be on travel the next two weeks, could someone please continue working on this once the further info was provided?
Thanks Jelle for the details,
And since it used to work for me and you, but now seems to be not working the assumption is that this regressed in 22.10.
Working theory (based on the denials and other details): usb/devices/ *. Since they are symlinks that was never meant to be needed but it is a getattr which might happen on the symllinks itself, so we'd need to probably just add:
Some change in libusb makes (we had a similar case in the past) it no more just iterate over, but read the actual files in /sys/bus/
/sys/ bus/usb/ devices/ * r,
@Jelle usb/devices/ * r,` (and nothing else to any apparmor file) to /etc/apparmor. d/local/ abstractions/ libvirt- qemu is enough for your case? d/libvirt/ libvirt- b14c0d3c- 1c39-4d8e- ab57-6434b4efa5 9b actually includes the .files (it always does) so the question is if you have any *usb* rules that got rendered into /etc/apparmor. d/libvirt/ libvirt- b14c0d3c- 1c39-4d8e- ab57-6434b4efa5 9b.files in either release?
1. could you check if just adding `/sys/bus/
2. I'd want to know if any dynamic rules got added before.
In the above case (please adapt uuid accordingly) can you compare 22.10 to 22.04?
The /etc/apparmor.
@Team - I'll be on travel the next two weeks, could someone please continue working on this once the further info was provided?