Merge ~hectorcao/ubuntu/+source/libvirt:lp2120278-noble into ubuntu/+source/libvirt:ubuntu/noble-devel

[Hector CAO]

[Christian Ehrhardt (paelzer)]

Approved - for more details see the plucky variant https://code.launchpad.net/~hectorcao/ubuntu/+source/libvirt/+git/libvirt/+merge/492653

review: Approve

[Christian Ehrhardt (paelzer)]

Combined two fixes that were ready and uploaded

Uploading libvirt_10.0.0-2ubuntu8.9.dsc
Uploading libvirt_10.0.0-2ubuntu8.9.debian.tar.xz
Uploading libvirt_10.0.0-2ubuntu8.9_source.buildinfo
Uploading libvirt_10.0.0-2ubuntu8.9_source.changes

Unmerged commits

e333837... by Hector CAO on 2025-09-16

changelog

2881783... by Hector CAO on 2025-09-16

d/p/u-aa/lp2120278-*: virt-aa-helper: Avoid duplicate when append rule (LP: #2120278)

Signed-off-by: Hector Cao <email address hidden>

diff --git a/debian/changelog b/debian/changelog
index 86d7472..a57fc7a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+libvirt (10.0.0-2ubuntu8.9) noble; urgency=medium
+
+  * d/p/u-aa/lp2079869-* : virt-aa-helper: Avoid duplicate when append rule
+    (LP: #2120278)
+
+ -- Hector Cao <[e-mail]>  Wed, 17 Sep 2025 01:20:45 +0200
+
 libvirt (10.0.0-2ubuntu8.8) noble; urgency=medium
 
   [ Lukas Märdian ]
diff --git a/debian/patches/series b/debian/patches/series
index 66f6acd..14dab0f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -61,3 +61,4 @@ ubuntu-aa/virt-aa-helper-allow-riscv64-EDK-II.patch
 ubuntu/lp-2084136-fix-get-number-block-io-throttle-params.patch
 ubuntu-aa/lp-2100024-Allow-SGX-if-configured.patch
 ubuntu/lp2106812-cpu_map-Drop-mpx-from-x86-cpu-models.patch
+ubuntu-aa/lp2120278-virt-aa-helper-Avoid-duplicate-when-append-rule.patch
diff --git a/debian/patches/ubuntu-aa/lp2120278-virt-aa-helper-Avoid-duplicate-when-append-rule.patch b/debian/patches/ubuntu-aa/lp2120278-virt-aa-helper-Avoid-duplicate-when-append-rule.patch
new file mode 100644
index 0000000..5b36e59
--- /dev/null
+++ b/debian/patches/ubuntu-aa/lp2120278-virt-aa-helper-Avoid-duplicate-when-append-rule.patch
@@ -0,0 +1,60 @@
+From 35862b423aaf58c2a0e06a8d60b1298ea711d0a1 Mon Sep 17 00:00:00 2001
+From: Hector Cao <[e-mail]>
+Date: Wed, 17 Sep 2025 01:32:24 +0200
+Subject: [PATCH] virt-aa-helper: Avoid duplicate when append rule
+
+when a device is dynamically attached to a VM, and it needs a special
+system access for apparmor, libvirt calls virt-aa-helper (with argument -F)
+to append a new rule to the apparmor profile of the VM. virt-aa-helper does
+not check for duplicate and blindly appends the rule to the profile. since
+there is no rule removal when a device is detached, this can make the profile
+grow in size if a big number of attach/detach operations are done and the
+profile might hit the size limit and futur attach operations might dysfunction
+because no rule can be added into the apparmor profile.
+
+this patch tries to mitigate this issue by doing a duplicate check
+when rules are appended into the profile. this fix does not guarantee
+the absence of duplicates but should be enough to prevent the profile
+to grow significantly in size and reach its size limit.
+
+Signed-off-by: Hector CAO <[e-mail]>
+Signed-off-by: Michal Privoznik <[e-mail]>
+Reviewed-by: Michal Privoznik <[e-mail]>
+
+Origin: backport, https://github.com/libvirt/libvirt/commit/291dbefd074378df6b541fc1c19d3504279e069b
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+bug/2120278
+---
+ src/security/virt-aa-helper.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
+index 0374581f07..008ea4f3e0 100644
+--- a/src/security/virt-aa-helper.c
++++ b/src/security/virt-aa-helper.c
+@@ -215,10 +215,21 @@ update_include_file(const char *include_file, const char *included_files,
+             return rc;
+     }
+ 
+-    if (append && virFileExists(include_file))
++    if (append && existing) {
++        /* Duplicate check: include_files might contain multiple rules
++         * the best is to check for each rule (separated by \n) but
++         * it might be overkilled, just do the check for the whole
++         * include_files.
++         * Most of the time, include_files contains only one rule
++         * so this check is OK to avoid the overflow of the profile
++         * duplicates might still exist though.
++         */
++        if (strstr(existing, included_files) != NULL)
++            return 0;
+         pcontent = g_strdup_printf("%s%s", existing, included_files);
+-    else
++    } else {
+         pcontent = g_strdup_printf("%s%s", warning, included_files);
++    }
+ 
+     plen = strlen(pcontent);
+     if (plen > MAX_FILE_LEN) {
+-- 
+2.45.2
+