On 9/16/19 9:27 AM, Chris Coulson wrote:
The AppArmor profile generated by virt-aa-helper is too strict for swtpm. This change contains 2 small fixes: - Relax append access to swtpm's log file to permit write access instead. Append access is insufficient because the log is opened with O_CREAT. - Permit swtpm to acquire a lock on its lock file.
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> I suppose you are not using the AppArmor policy that is part of the libvirt repo but Ubuntu has its own, right? I couldn't get it to work with the one in libvirt back then, so the AppArmor support was 'best effort'. Thanks a lot for fixing this! Please repost it with your Signed-off-by! Regards, Stefan
--- src/security/virt-aa-helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 326cfaf52a..3d7cc32459 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1238,10 +1238,10 @@ get_files(vahControl * ctl) * directory, log, and PID files. */ virBufferAsprintf(&buf, - " \"%s/lib/libvirt/swtpm/%s/%s/**\" rw,\n", + " \"%s/lib/libvirt/swtpm/%s/%s/**\" rwk,\n", LOCALSTATEDIR, uuidstr, tpmpath); virBufferAsprintf(&buf, - " \"%s/log/swtpm/libvirt/qemu/%s-swtpm.log\" a,\n", + " \"%s/log/swtpm/libvirt/qemu/%s-swtpm.log\" w,\n", LOCALSTATEDIR, ctl->def->name); virBufferAsprintf(&buf, " \"%s/libvirt/qemu/swtpm/%s-swtpm.pid\" rw,\n",