[karmic] libvirt/apparmor breaks non-default serial, console, kernel and initrd
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| libvirt (Ubuntu) |
Fix Released
|
High
|
Jamie Strandboge | ||
Bug Description
This is related to bug #431090. Currently, the apparmor security driver updates the disks, pid, monitor file and log. It does not honor the following:
<os>
...
<kernel>
<initrd>
...
</os>
...
<serial type='file'>
<source path='/
<target port='0'/>
</serial>
<console type='file'>
<source path='/
<target port='0'/>
</console>
...
This is a regression over Jaunty. The fix is to make virt-aa-helper use the XML. This approach is recommended by upstream as well before they will accept the apparmor security driver. Once I get the patch approved upstream, I can rebase the Karmic patch and this bug can be closed.
Related branches
| Changed in libvirt (Ubuntu): | |
| assignee: | nobody → Jamie Strandboge (jdstrand) |
| importance: | Undecided → High |
| milestone: | none → ubuntu-9.10-beta |
| status: | New → In Progress |
| Launchpad Janitor (janitor) wrote | #1 |
| Changed in libvirt (Ubuntu): | |
| status: | In Progress → Fix Released |
This bug was fixed in the package libvirt - 0.7.0-1ubuntu8
---------------
libvirt (0.7.0-1ubuntu8) karmic; urgency=low
* debian/
licensing compliance with upstream and bug fixes:
- handle files with spaces in the name (LP: #432810)
- add serial, console, kernel and initrd support (LP: #432581)
- allow read only access to /boot, /vmlinuz and /initrd.img
- allow access to character devices (eg USB devices)
- have virt-aa-helper accept XML on stdin, which allows for adding
other devices in the future and helps ensure we always have the most
up to date definition
- update profile on attach and detach of devices (LP: #435527)
- add --dryrun option to virt-aa-helper, and greatly improve the
virt-
* revert workaround for LP: #431090 now that kernel, initrd, et al is
properly supported
* debian/
recommended by upstream to prevent potential regressions
-- Jamie Strandboge <email address hidden> Tue, 22 Sep 2009 20:04:58 -0500