Re: [libvirt] [PATCH] AppArmor: Allow libvirtd to kill unconfined processes

Christian Ehrhardt: > I recently had spotted this issue and discussed on IRC but couldn't > recreate after a while when I wanted to debug. I've seen it the last few times I've started libvirtd.service on two different Debian sid ("unstable") systems. > But the reason and the rule totally make sense. > It is a bit unfortunate as it allows random kills essentially, so if > anyone is up to we might be better up to spawn those capability > probers with a named profile that we can refer to here. Yes, this would be ideal. Sadly, this requires C programming skills so it's out of my league. > But until then the rule here is required to not get into awkward situations. > +1 from me, thanks intrigeri Thanks :)