[libvirt] [PATCH] AppArmor: allow QEMU to set_process_name.

https://bugzilla.redhat.com/show_bug.cgi?id=1369281 --- examples/apparmor/libvirt-qemu | 3 +++ 1 file changed, 3 insertions(+) diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu index 11381d4df0..fdb5a23291 100644 --- a/examples/apparmor/libvirt-qemu +++ b/examples/apparmor/libvirt-qemu @@ -21,6 +21,9 @@ /dev/ptmx rw, /dev/kqemu rw, @{PROC}/*/status r, + # Per man(5) proc, the kernel enforces that a thread may + # only modify its comm value or those in its thread group. + owner @{PROC}/@{pid}/task/@{tid}/comm rw, @{PROC}/sys/kernel/cap_last_cap r, # For hostdev access. The actual devices will be added dynamically -- 2.11.0