Merge ~paelzer/ubuntu/+source/libvirt:lp-1927519-profile-recreate-focal into ubuntu/+source/libvirt:ubuntu/focal-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4717

[Sergio Durigan Junior (sergiodj)]

Thanks, Christian.

This one LGTM; it's pretty similar to the MP you filed for Jammy (and which I also approved). autopkgtest still hasn't run for the PPA, so this approval is conditional to the tests passing.

LGTM, +1.

review: Approve

[Christian Ehrhardt  (paelzer)]

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading libvirt_6.0.0-0ubuntu8.15.dsc: done.
  Uploading libvirt_6.0.0-0ubuntu8.15.debian.tar.xz: done.
  Uploading libvirt_6.0.0-0ubuntu8.15_source.buildinfo: done.
  Uploading libvirt_6.0.0-0ubuntu8.15_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index 0831f55..799cf79 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+libvirt (6.0.0-0ubuntu8.15) focal; urgency=medium
+
+  * d/p/u/lp-1927519-virt-aa-helper-Purge-profile-if-corrupted.patch:
+    avoid issues due to corrupted apparmor profiles (LP: #1927519)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 18 Nov 2021 10:23:11 +0100
+
 libvirt (6.0.0-0ubuntu8.14) focal; urgency=medium
 
   * Fixup backport of "util: Add phys_port_name support on virPCIGetNetName"
diff --git a/debian/patches/series b/debian/patches/series
index 2b4f3a6..fe6c059 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -169,3 +169,4 @@ ubuntu/lp-1929202-qemuMigrationCookieAddNBD-Remove-ret-variable-and-cl.patch
 ubuntu/lp-1929202-qemuMigrationCookieAddNBD-Fix-filling-of-capacity-wh.patch
 ubuntu/lp-1892132-add-virNetDevGetPhysPortName.patch
 ubuntu/lp-1892132-Add-phys_port_name-support-on-virPCIGetNetName.patch
+ubuntu/lp-1927519-virt-aa-helper-Purge-profile-if-corrupted.patch
diff --git a/debian/patches/ubuntu/lp-1927519-virt-aa-helper-Purge-profile-if-corrupted.patch b/debian/patches/ubuntu/lp-1927519-virt-aa-helper-Purge-profile-if-corrupted.patch
new file mode 100644
index 0000000..4a4ee3f
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1927519-virt-aa-helper-Purge-profile-if-corrupted.patch
@@ -0,0 +1,76 @@
+From 4ab33415db31d0e77015bb852cab4a08dd0efd40 Mon Sep 17 00:00:00 2001
+From: Ioanna Alifieraki <[e-mail]>
+Date: Tue, 2 Nov 2021 16:04:45 +0200
+Subject: [PATCH] virt-aa-helper: Purge profile if corrupted
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This commit aims to address the bug reported in [1] and [2].
+If the profile is corrupted (0-size) the VM cannot be launched.
+To overcome this, check if the profile exists and if it has 0 size
+remove it.
+
+[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=890084
+[2] https://bugs.launchpad.net/bugs/1927519
+
+Signed-off-by: Ioanna Alifieraki <[e-mail]>
+Reviewed-by: Christian Ehrhardt <[e-mail]>
+Reviewed-by: Ján Tomko <[e-mail]>
+
+Origin: upstream, https://libvirt.org/git/?p=libvirt.git;a=commit;h=4ab33415db
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1927519
+Last-Update: 2021-11-18
+
+---
+ src/security/virt-aa-helper.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
+index 7c21ab9515..218e07bfb0 100644
+--- a/src/security/virt-aa-helper.c
++++ b/src/security/virt-aa-helper.c
+@@ -1437,6 +1437,8 @@ main(int argc, char **argv)
+     int rc = -1;
+     char *profile = NULL;
+     char *include_file = NULL;
++    off_t size;
++    bool purged = 0;
+ 
+     if (virGettextInitialize() < 0 ||
+         virErrorInitialize() < 0) {
+@@ -1484,6 +1486,22 @@ main(int argc, char **argv)
+         if (ctl->cmd == 'c' && virFileExists(profile))
+             vah_error(ctl, 1, _("profile exists"));
+ 
++        /*
++         * Rare cases can leave corrupted empty files behind breaking
++         * the guest. An empty file is never correct as virt-aa-helper
++         * would at least add the basic rules, therefore clean this up
++         * for a proper refresh.
++         */
++        if (virFileExists(profile)) {
++                size = virFileLength(profile, -1);
++                if (size == 0) {
++                        vah_warning(_("Profile of 0 size detected, will attempt to remove it"));
++                        if ((rc = parserRemove(ctl->uuid) != 0))
++                                vah_error(ctl, 1, _("could not remove profile"));
++                        unlink(profile);
++                        purged = true;
++                }
++        }
+         if (ctl->append && ctl->newfile) {
+             if (vah_add_file(&buf, ctl->newfile, "rwk") != 0)
+                 goto cleanup;
+@@ -1523,7 +1541,7 @@ main(int argc, char **argv)
+ 
+ 
+         /* create the profile from TEMPLATE */
+-        if (ctl->cmd == 'c') {
++        if (ctl->cmd == 'c' || purged) {
+             char *tmp = NULL;
+             tmp = g_strdup_printf("  #include <libvirt/%s.files>\n", ctl->uuid);
+ 
+-- 
+2.34.0
+