Merge ~paelzer/ubuntu/+source/libvirt:lp-1890858-fix-connectivity-FOCAL into ubuntu/+source/libvirt:ubuntu/focal-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4582
SRU Bug: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1890858

[Christian Ehrhardt  (paelzer)]

Held back for the new insights into systemd's involvement into this.

[Christian Ehrhardt  (paelzer)]

Ok, new input resolved - I update this MP to contain the new better rule.

P.S. the central rule might later (independent) be added in abstractions/nameservices but this is independent to this fix as e.g. libvirt would not immediately benefit from the abstraction fix anyway (and it would open up much more than wanted).

[Robie Basak (racb)]

Perfect, and great job in working the bug as well as finding the solution!

review: Approve (sru)

[Christian Ehrhardt  (paelzer)]

Thank you!

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/libvirt
 * [new tag] upload/6.0.0-0ubuntu8.10 -> upload/6.0.0-0ubuntu8.10

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading libvirt_6.0.0-0ubuntu8.10.dsc: done.
  Uploading libvirt_6.0.0-0ubuntu8.10.debian.tar.xz: done.
  Uploading libvirt_6.0.0-0ubuntu8.10_source.buildinfo: done.
  Uploading libvirt_6.0.0-0ubuntu8.10_source.changes: done.
Successfully uploaded packages.

[Christian Ehrhardt  (paelzer)]

This migrated

diff --git a/debian/changelog b/debian/changelog
index fa7efba..d201ca8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+libvirt (6.0.0-0ubuntu8.10) focal; urgency=medium
+
+  * d/p/ubuntu-aa/lp-1890858-unix-socket.patch: avoid issues of some users
+    to connect to libvirtd (LP: #1890858)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 14 Jun 2021 14:36:04 +0200
+
 libvirt (6.0.0-0ubuntu8.9) focal; urgency=medium
 
   * d/p/u/lp-1921754*: add EPYC-Rome-v2 as v1 missed IBRS and thereby fails
diff --git a/debian/patches/series b/debian/patches/series
index 33f754c..d4e8461 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -155,3 +155,4 @@ ubuntu/lp-1922907-cputest-Add-data-for-Intel-R-Xeon-R-Platinum-9242-CP.patch
 ubuntu/lp-1922907-cputest-Add-data-for-Intel-R-Xeon-R-Gold-6130-CPU.patch
 ubuntu/lp-1922907-cpu_map-Distinguish-Cascadelake-Server-from-Skylake-.patch
 ubuntu/lp-1922907-cleanup-test-data.patch
+ubuntu-aa/lp-1890858-unix-socket.patch
diff --git a/debian/patches/ubuntu-aa/lp-1890858-unix-socket.patch b/debian/patches/ubuntu-aa/lp-1890858-unix-socket.patch
new file mode 100644
index 0000000..6622e34
--- /dev/null
+++ b/debian/patches/ubuntu-aa/lp-1890858-unix-socket.patch
@@ -0,0 +1,22 @@
+Description: allow network unix dgram for NSS UID resolution
+ Certain conditions - aong others non local users - can in Focal
+ trigger libvirt to call for NSS resolving usernames.
+ That is done through a unix socket bind/call which is denied
+ by apparmor. In some cases that is crashing libvirtd and in others
+ it "only" denies the user from using libvirtd.
+Forwarded: no
+X-Not-Forwarded-Reason: not a problem for latter libvirt versions - Ubuntu Focal only
+Author: Christian Ehrhardt <[e-mail]>
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1890858
+Last-Update: 2021-06-14
+--- a/src/security/apparmor/usr.sbin.libvirtd
++++ b/src/security/apparmor/usr.sbin.libvirtd
+@@ -46,6 +46,8 @@ profile libvirtd /usr/sbin/libvirtd flag
+   network netlink raw,
+   network packet dgram,
+   network packet raw,
++  # For UID resolution in Focal (LP: #1890858)
++  unix (bind) type=dgram addr=@userdb-*,
+ 
+   # for --p2p migrations
+   unix (send, receive) type=stream addr=none peer=(label=unconfined addr=none),