libvirt doesn't include *.vnc files with apparmor profiles

Thanks for reproring this bug.

Could you please give the full exact vmbuildder command you are using? I'll try to reproduce.

The command line used was :

virt-install -n laranja.fritz.box -r 512 --os-variant=ubuntuprecise --disk /home/vms/disk_laranja_root.img,device=disk,bus=virtio,size=8,sparse=true,format=raw -w bridge=vms,model=virtio --graphics vnc,listen=0.0.0.0,password=qwerty --location=http://de.archive.ubuntu.com/ubuntu/dists/precise/main/installer-amd64/

Attached also the result of 'virsh dumpxml laranja.fritz.box'

Thanks for that info.

Your dumpxml output shows

   <graphics type="vnc" socket="/var/lib/libvirt/qemu/laranja.fritz.box.vnc">

but when I reproduce your command exactly I get the normal

   <graphics type='vnc' port='-1' autoport='yes' listen='0.0.0.0'>

Do you know how you ended up with the vnc socket defined?

If it was done by hand, then I'd prefer to say that you should also add the socket file to the apparmor profile by hand. If it was done automatically, then either the new rule should be added as you suggested, or the external tool (if one was used) should perhaps add it to the domain's /etc/apparmor.d/libvirt/libvirt-<uuid>.files file.

I will try to investigate what happened that the socket path was used instead of listen (maybe in one of the debugging attempts, I did not supply the listen parameter ?). I'm sorry to not be able to provide an immediate answer on this one since I can't reach my test system at the moment since I'm currently on a different network.

But AFAIK the /etc/apparmor.d/libvirt/libvirt-<uuid>.files is autogenerated. IMHO if its possible to have a socket option it should parse and add the file to the appropriate profile. Adding it by hand gets overwritten once you stop and start the VM.

After checking again, the XML file (/etc/libvirt/qemu/laranja.fritz.box.xml) contains (snipped):
    <graphics type='vnc' port='-1' autoport='yes' listen='0.0.0.0' passwd='qwerty'>
      <listen type='address' address='0.0.0.0'/>
    </graphics>

a virsh dumpxml produces after the vm is started (snipped):
    <graphics type='vnc' socket='/var/lib/libvirt/qemu/laranja.fritz.box.vnc'>
      <listen type='address' address='0.0.0.0'/>
    </graphics>

Per irc discussion, this should be done with a domain-specific rule added through virt-aa-helper.

This bug was fixed in the package libvirt - 1.0.0-0ubuntu4

---------------
libvirt (1.0.0-0ubuntu4) raring; urgency=low

  * debian/patches/apparmor-allow-hugepages: update apparmor policies to
    allow use of hugepages. (LP: #646468)
  * debian/patches/vnc-socket.patch: If a vnc socket is in use, add it's
    path to the apparmor policy. (LP: #1069534)
 -- Serge Hallyn <email address hidden> Wed, 05 Dec 2012 16:43:04 -0600