Re: [libvirt] [PATCH] AppArmor: Allow libvirtd to kill unconfined processes
Christian Ehrhardt:
I recently had spotted this issue and discussed on IRC but
couldn't
recreate after a while when I wanted to debug.
I've seen it the last few times I've started libvirtd.service on two
different Debian sid ("unstable") systems.
But the reason and the rule totally make sense.
It is a bit unfortunate as it allows random kills essentially, so if
anyone is up to we might be better up to spawn those capability
probers with a named profile that we can refer to here.
Yes, this would be ideal. Sadly, this requires C programming skills so
it's out of my league.
But until then the rule here is required to not get into awkward
situations.
+1 from me, thanks intrigeri
Thanks :)