Merge ~paelzer/ubuntu/+source/libvirt:lp-1989078-AAVMF-locking-JAMMY into ubuntu/+source/libvirt:ubuntu/jammy-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~paelzer/+archive/ubuntu/lp-1989078-aavmf-locking

[Paride Legovini (paride)]

Patch OK (clean upstream cherry-pick of what we already have in Kinetic), dep-3 headers OK, d/changelog entry OK. The patch fully complies with the SRU plan for LP: #1989078.

+1 modulo PPA build, which didn't finish yet.

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: paelzer, paride
Uploaders: paelzer, paride
MP auto-approved

review: Approve

[Christian Ehrhardt  (paelzer)]

Build is happy as well.

Test on canonistack as well.

Uploading ...

diff --git a/debian/changelog b/debian/changelog
index b568750..a06a29b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+libvirt (8.0.0-1ubuntu7.2) jammy; urgency=medium
+
+  * d/p/u/lp-1989078-apparmor-Allow-locking-AAVMF-firmware.patch: allow arm64
+    to lock its OVMF resources (LP: #1989078)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 08 Sep 2022 12:00:39 +0200
+
 libvirt (8.0.0-1ubuntu7.1) jammy; urgency=medium
 
   * d/p/u/lp-1972075-Allow-VM-to-read-sysfs-PCI-config-revision-files.patch:
diff --git a/debian/patches/series b/debian/patches/series
index 722d026..36f7453 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -33,3 +33,4 @@ ubuntu-aa/lp-1815910-allow-vhost-hotplug.patch
 ubuntu/swtpm-by-swtpm-user.patch
 ubuntu-aa/0035-apparmor-separate-swtpm-rules.patch
 ubuntu/lp-1972075-Allow-VM-to-read-sysfs-PCI-config-revision-files.patch
+ubuntu/lp-1989078-apparmor-Allow-locking-AAVMF-firmware.patch
diff --git a/debian/patches/ubuntu/lp-1989078-apparmor-Allow-locking-AAVMF-firmware.patch b/debian/patches/ubuntu/lp-1989078-apparmor-Allow-locking-AAVMF-firmware.patch
 new file mode 100644
index 0000000..b5da0cb
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1989078-apparmor-Allow-locking-AAVMF-firmware.patch
@@ -0,0 +1,35 @@
+From 2b98d5d91d95087d8a96d6450fa96414ed05ba5c Mon Sep 17 00:00:00 2001
+From: Andrea Bolognani <[e-mail]>
+Date: Mon, 23 May 2022 10:31:02 +0200
+Subject: [PATCH] apparmor: Allow locking AAVMF firmware
+
+We already allow this for OVMF.
+
+Closes: https://gitlab.com/libvirt/libvirt/-/issues/312
+Signed-off-by: Andrea Bolognani <[e-mail]>
+Reviewed-by: Martin Kletzander <[e-mail]>
+
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/2b98d5d91
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1989078
+Last-Update: 2022-09-08
+
+---
+ src/security/apparmor/libvirt-qemu | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu
+index c29168da27..02ee273e7e 100644
+--- a/src/security/apparmor/libvirt-qemu
++++ b/src/security/apparmor/libvirt-qemu
+@@ -78,7 +78,7 @@
+   /var/lib/dbus/machine-id r,
+ 
+   # access to firmware's etc
+-  /usr/share/AAVMF/** r,
++  /usr/share/AAVMF/** rk,
+   /usr/share/bochs/** r,
+   /usr/share/edk2-ovmf/** rk,
+   /usr/share/kvm/** r,
+-- 
+2.37.3
+