From 64ae7635e642bed571c45feb2b388719c7bf0b2a Mon Sep 17 00:00:00 2001 From: Jim Fehlig Date: Wed, 16 Jun 2021 15:25:33 -0600 Subject: [PATCH] Apparmor: Allow reading /etc/ssl/openssl.cnf I noticed the following denial when running confined VMs with the QEMU driver type=AVC msg=audit(1623865089.263:865): apparmor="DENIED" operation="open" \ profile="virt-aa-helper" name="/etc/ssl/openssl.cnf" pid=12503 \ comm="virt-aa-helper" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Allow reading the file by including the openssl abstraction in the virt-aa-helper profile. Signed-off-by: Jim Fehlig Reviewed-by: Christian Ehrhardt --- src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in | 1 + 1 file changed, 1 insertion(+) diff --git a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in index 8ebb47596a..ff1d46bebe 100644 --- a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in +++ b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in @@ -2,6 +2,7 @@ profile virt-aa-helper @libexecdir@/virt-aa-helper { #include + #include # needed for searching directories capability dac_override,