Re: [libvirt] [PATCH] AppArmor: Allow libvirtd to kill unconfined processes

Christian Ehrhardt:

I recently had spotted this issue and discussed on IRC but couldn't recreate after a while when I wanted to debug.

I've seen it the last few times I've started libvirtd.service on two different Debian sid ("unstable") systems.

But the reason and the rule totally make sense.

It is a bit unfortunate as it allows random kills essentially, so if anyone is up to we might be better up to spawn those capability probers with a named profile that we can refer to here.

Yes, this would be ideal. Sadly, this requires C programming skills so it's out of my league.

But until then the rule here is required to not get into awkward situations.

+1 from me, thanks intrigeri

Thanks :)