Merge ~paelzer/ubuntu/+source/libvirt:bug-1847361-miss-old-so-on-upgrade-SRU-EOAN into ubuntu/+source/libvirt:ubuntu/eoan-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

Marking these WIP until bug 1871830 is finished

[Christian Ehrhardt  (paelzer)]

Bug 1871830 fixed and the required change is int he SRUs as well.
I uploaded a new build to the PPA and force pushed these branches.

[Christian Ehrhardt  (paelzer)]

SRU Template added, ready for review.

[Rafael David Tinoco (rafaeldtinoco)]

+1. Everything looks good.

review: Approve

[Christian Ehrhardt  (paelzer)]

Thanks, tags pushed and uploaded for SRU review

diff --git a/debian/changelog b/debian/changelog
index b5e2076..9c57097 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+libvirt (5.4.0-0ubuntu5.3) eoan; urgency=medium
+
+  * d/p/ubuntu-aa/lp-1847361-load-versioned-module.patch: allow loading
+    versioned modules after qemu package upgrades (LP: #1847361)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 09 Apr 2020 08:28:33 +0200
+
 libvirt (5.4.0-0ubuntu5.2) eoan; urgency=medium
 
   * d/p/u/lp-1655111-apparmor-fix-qemu_bridge_helper-for-named-profile.patch:
diff --git a/debian/patches/series b/debian/patches/series
index 964fb3c..0534883 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -61,3 +61,4 @@ ubuntu/lp-1828495-qemu-Drop-MSR-features-from-host-model-with-old-QEMU.patch
 ubuntu/lp-1828495-qemu-Probe-host-CPU-after-capabilities.patch
 ubuntu/lp-1844455-node_device_conf-Don-t-leak-physical_function.patch
 ubuntu/lp-1655111-apparmor-fix-qemu_bridge_helper-for-named-profile.patch
+ubuntu-aa/lp-1847361-load-versioned-module.patch
diff --git a/debian/patches/ubuntu-aa/lp-1847361-load-versioned-module.patch b/debian/patches/ubuntu-aa/lp-1847361-load-versioned-module.patch
new file mode 100644
index 0000000..b1efec9
--- /dev/null
+++ b/debian/patches/ubuntu-aa/lp-1847361-load-versioned-module.patch
@@ -0,0 +1,44 @@
+Description: allow loading modules from /var/run
+ apparmor: qemu load old shared objects
+
+ On qemu upgrades the old .so files usually are replaced. But on the other
+ hand since a qemu process represents a guest instance it is usually kept
+ around.
+
+ That makes late addition of dynamic features e.g. 'hot-attach of a ceph
+ disk' fail by trying to load a new version of e.f. block-rbd.so into an
+ old still running qemu binary.
+
+ Qemu adds a fallback to also load modules from a versioned directory in the
+ temporary /var/run path. That way qemu is providing a way for packaging
+ to store modules of an upgraded qemu package as needed until the next reboot.
+
+ This change is allowing the qemu process access to these paths.
+
+ Background:
+ This is a continuation of a discussion at KVM Forum 2019 eventually
+ becoming [1] and recently this change is queued to get into qemu properly [2].
+
+ [1]: https://lists.gnu.org/archive/html/qemu-devel/2019-11/msg00005.html
+ [2]: https://lists.nongnu.org/archive/html/qemu-devel/2020-03/msg03313.html
+
+ Signed-off-by: Christian Ehrhardt <[e-mail]>
+
+Forwarded: yes, https://www.redhat.com/archives/libvir-list/2020-March/msg00486.html
+Author: Christian Ehrhardt <[e-mail]>
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1847361
+Last-Update: 2020-03-13
+--- a/src/security/apparmor/libvirt-qemu
++++ b/src/security/apparmor/libvirt-qemu
+@@ -164,6 +164,11 @@
+   /usr/{lib,lib64}/qemu/*.so mr,
+   /usr/lib/@{multiarch}/qemu/*.so mr,
+ 
++  # let qemu load old shared objects after upgrades (LP: #1847361)
++  /{var/,}run/qemu/*/*.so mr,
++  # but explicitly deny with auditing writing to these files
++  audit deny /{var/,}run/qemu/*/*.so w,
++
+   # swtpm
+   /{usr/,}bin/swtpm rmix,
+   /usr/{lib,lib64}/libswtpm_libtpms.so mr,