Ubuntu
libvirt package

  1. Bug #656173
  2. Comment #6

Comment 6 for bug 656173

Revision history for this message
Jamie Strandboge (jdstrand) wrote : Re: virt-aa-helper generate incomplete apparmor profiles with chained backing files

This behavior changed in libvirt 0.8.3 and the pending lucid-security libvirt update and is part of the fix for CVE-2010-2237, CVE-2010-2238 and CVE-2010-2239. From /etc/libvirt/qemu.conf:
# If allow_disk_format_probing is enabled, libvirt will probe disk
# images to attempt to identify their format, when not otherwise
# specified in the XML. This is disabled by default.
#
# WARNING: Enabling probing is a security hole in almost all
# deployments. It is strongly recommended that users update their
# guest XML <disk> elements to include <driver type='XXXX'/>
# elements instead of enabling this option.
# allow_disk_format_probing = 1

So people can either:
1. adjust /etc/apparmor.d/libvirt/libvirt-<uuid> to have the extra files
2. adjust /etc/libvirt/qemu.conf for the above

The former is preferred for security reasons, but has to be done for each virtual machine.