Merge ~hectorcao/ubuntu/+source/libvirt:lp2120278-plucky into ubuntu/+source/libvirt:ubuntu/plucky-devel

[Hector CAO]

[Christian Ehrhardt (paelzer)]

Target release, target version, changelog, patch header, all seems good to me.

Usually we (server team habit) directly couple this with a PPA for testing, but here we might combine it with other fixes for the SRU so it is ok to not have that (save the busy builders some work)

+1 (with a hint)

review: Approve

[Christian Ehrhardt (paelzer)]

Combined two fixes that were ready and uploaded

Uploading libvirt_11.0.0-2ubuntu6.3.dsc
Uploading libvirt_11.0.0-2ubuntu6.3.debian.tar.xz
Uploading libvirt_11.0.0-2ubuntu6.3_source.buildinfo
Uploading libvirt_11.0.0-2ubuntu6.3_source.changes

Unmerged commits

d406101... by Hector CAO on 2025-09-16

changelog

a07c2a9... by Hector CAO on 2025-09-16

d/p/u-aa/lp2120278-*: virt-aa-helper: Avoid duplicate when append rule (LP: #2120278)

Signed-off-by: Hector Cao <email address hidden>

diff --git a/debian/changelog b/debian/changelog
index 271948d..acc2092 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+libvirt (11.0.0-2ubuntu6.3) plucky; urgency=medium
+
+  * d/p/u-aa/lp2079869-* : virt-aa-helper: Avoid duplicate when append rule
+    (LP: #2120278)
+
+ -- Hector Cao <[e-mail]>  Wed, 17 Sep 2025 01:13:17 +0200
+
 libvirt (11.0.0-2ubuntu6.2) plucky; urgency=medium
 
   * l-d-config-network.postinst: clear 'autostarted' state, to activate
diff --git a/debian/patches/series b/debian/patches/series
index d4294f1..6bdac62 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -29,3 +29,4 @@ ubuntu-aa/0034-apparmor-virt-aa-helper-access-for-snapped-nova.patch
 ubuntu-aa/lp-1815910-allow-vhost-hotplug.patch
 ubuntu-aa/lp2079869-allow-access-for-bridge-helper-to-sys-devices-system.patch
 ubuntu-aa/lp-2100024-Allow-SGX-if-configured.patch
+ubuntu-aa/lp2120278-virt-aa-helper-Avoid-duplicate-when-append-rule.patch
diff --git a/debian/patches/ubuntu-aa/lp2120278-virt-aa-helper-Avoid-duplicate-when-append-rule.patch b/debian/patches/ubuntu-aa/lp2120278-virt-aa-helper-Avoid-duplicate-when-append-rule.patch
new file mode 100644
index 0000000..6e5cc21
--- /dev/null
+++ b/debian/patches/ubuntu-aa/lp2120278-virt-aa-helper-Avoid-duplicate-when-append-rule.patch
@@ -0,0 +1,59 @@
+From: Hector Cao <[e-mail]>
+Subject: virt-aa-helper: Avoid duplicate when append rule
+
+when a device is dynamically attached to a VM, and it needs a special
+system access for apparmor, libvirt calls virt-aa-helper (with argument -F)
+to append a new rule to the apparmor profile of the VM. virt-aa-helper does
+not check for duplicate and blindly appends the rule to the profile. since
+there is no rule removal when a device is detached, this can make the profile
+grow in size if a big number of attach/detach operations are done and the
+profile might hit the size limit and futur attach operations might dysfunction
+because no rule can be added into the apparmor profile.
+
+this patch tries to mitigate this issue by doing a duplicate check
+when rules are appended into the profile. this fix does not guarantee
+the absence of duplicates but should be enough to prevent the profile
+to grow significantly in size and reach its size limit.
+
+Signed-off-by: Hector CAO <[e-mail]>
+Signed-off-by: Michal Privoznik <[e-mail]>
+Reviewed-by: Michal Privoznik <[e-mail]>
+
+Origin: upstream, https://github.com/libvirt/libvirt/commit/291dbefd074378df6b541fc1c19d3504279e069b
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+bug/2120278
+
+---
+ src/security/virt-aa-helper.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
+index b662d971cb..8a297d4b54 100644
+--- a/src/security/virt-aa-helper.c
++++ b/src/security/virt-aa-helper.c
+@@ -208,10 +208,21 @@ update_include_file(const char *include_file, const char *included_files,
+             return -1;
+     }
+ 
+-    if (append && virFileExists(include_file))
++    if (append && existing) {
++        /* Duplicate check: include_files might contain multiple rules
++         * the best is to check for each rule (separated by \n) but
++         * it might be overkilled, just do the check for the whole
++         * include_files.
++         * Most of the time, include_files contains only one rule
++         * so this check is OK to avoid the overflow of the profile
++         * duplicates might still exist though.
++         */
++        if (strstr(existing, included_files) != NULL)
++            return 0;
+         pcontent = g_strdup_printf("%s%s", existing, included_files);
+-    else
++    } else {
+         pcontent = g_strdup_printf("%s%s", warning, included_files);
++    }
+ 
+     plen = strlen(pcontent);
+     if (plen > MAX_FILE_LEN) {
+-- 
+2.45.2
+