From 155d4fe3fa8b2115003973f692512a7007ab9264 Mon Sep 17 00:00:00 2001 From: Sam Hartman Date: Mon, 3 Aug 2020 12:08:41 +0200 Subject: [PATCH] apparmor: allow default pki path /etc/pki/qemu is a pki path recommended by qemu tls docs [1] and one that can cause issues with spice connections when missing. Add the path to the allowed list of pki paths to fix the issue. Note: this is active in Debian/Ubuntu [1] for quite a while already. [1]: https://www.qemu.org/docs/master/system/tls.html [2]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930100 Signed-off-by: Christian Ehrhardt Reviewed-by: Andrea Bolognani Acked-by: Jamie Strandboge --- src/security/apparmor/libvirt-qemu | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu index 1a4b226612..2d08d6f7ad 100644 --- a/src/security/apparmor/libvirt-qemu +++ b/src/security/apparmor/libvirt-qemu @@ -94,6 +94,8 @@ /etc/pki/CA/* r, /etc/pki/libvirt{,-spice,-vnc}/ r, /etc/pki/libvirt{,-spice,-vnc}/** r, + /etc/pki/qemu/ r, + /etc/pki/qemu/** r, # the various binaries /usr/bin/kvm rmix,