Package: guestfs-tools Version: 1.56.0-1 Severity: important X-Debbugs-Cc: [email protected]
Dear Maintainer, This report is the follow-up of #1149683. * What led up to the situation? virt-customize does not work at all because passt was broken. Partially "passt permission denied" was fixed in passt/0.0~git20261002.cba3570-1 [1], but not solve the rest of issue yet. [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149683 sudo journalctl -k -b --no-pager | grep -E 'apparmor=.*(passt|guestfs)|uid_map|gid_map|setgroups' 10月 03 19:17:33 jet kernel: audit: type=1400 audit(1791022653.210:182): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="passt" pid=59220 comm="apparmor_parser" 10月 03 19:18:58 jet kernel: audit: type=1400 audit(1791022738.834:184): apparmor="DENIED" operation="open" class="file" info="Failed name lookup - disconnected path" error=-13 profile="guestfs-tools//passt" name="" pid=66509 comm="passt.avx2" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 * What exactly did you do (or not do) that was effective (or ineffective)? I've applied flags for /etc/apparmor.d/guestfs-tools. Before: profile passt { After: profile passt flags=(attach_disconnected) { Then reload it with: sudo apparmor_parser -r /etc/apparmor.d/guestfs-tools * What was the outcome of this action? virt-customize succeeds without error. (e.g. update qcow2 image) virt-customize --verbose -x --add unstable-xfce-template.qcow2 --update Best Regards, -- System Information: Debian Release: forky/sid APT prefers unstable APT policy: (500, 'unstable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 7.2.8+deb14-amd64 (SMP w/24 CPU threads; PREEMPT) Kernel taint flags: TAINT_OOT_MODULE Locale: LANG=ja_JP.utf8, LC_CTYPE=ja_JP.utf8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages guestfs-tools depends on: ii curl 8.23.0~rc2-1 ii libc6 2.43-6 ii libcrypt1 1:4.5.2+20251210-1 ii libglib2.0-0t64 2.90.0-1 ii libguestfs-perl 1:1.60.1-2 ii libguestfs0t64 1:1.60.1-2 ii libintl-perl 1.37-1 ii libjson-c5 0.19+ds-1 ii liblzma5 5.8.4-1 ii libosinfo-1.0-0 1.12.0-3+b2 ii libpcre2-8-0 10.48-3.1 ii libstring-shellquote-perl 1.04-3 ii libsys-virt-perl 12.7.0-1 ii libtinfo6 6.6+20260608-2 ii libvirt0 12.7.0-1 ii libwin-hivex-perl 1.3.24-3+b1 ii libxml2-16 2.15.4+dfsg-1 ii perl 5.42.3-1 Versions of packages guestfs-tools recommends: ii gnupg 2.4.9-7 ii libguestfs-tools 1:1.60.1-2 ii virt-p2v 1.42.4-2 guestfs-tools suggests no packages. -- Configuration Files: /etc/apparmor.d/guestfs-tools changed: @{GUESTFS_TOOLS} = virt-alignment-scan virt-builder virt-builder-repository @{GUESTFS_TOOLS} += virt-cat virt-customize virt-df virt-diff virt-drivers @{GUESTFS_TOOLS} += virt-edit virt-filesystems virt-format virt-get-kernel @{GUESTFS_TOOLS} += virt-index-validate virt-inspector virt-log virt-ls @{GUESTFS_TOOLS} += virt-make-fs virt-resize virt-sparsify virt-sysprep @{GUESTFS_TOOLS} += virt-tail virt-win-reg abi <abi/3.0>, include <tunables/global> profile guestfs-tools /usr/bin/@{GUESTFS_TOOLS} { include <abstractions/base> include <abstractions/consoles> include <abstractions/nameservice> # Full access to filesystem (we don't know where images are) /** mrwlk, # ...and to run QEMU and any sort of helper without a profile /** ix, unix, # These might be needed for disk images capability dac_override, capability dac_read_search, # ...and to preserve ownership and device nodes as we untar supermin(1) appliances capability chown, capability fowner, capability mknod, # Receive any signal signal (receive) peer=/usr/bin/@{GUESTFS_TOOLS}, signal (receive) peer=@{GUESTFS_TOOLS}, # Network using passt(1) /usr/bin/passt Cx -> passt, profile passt flags=(attach_disconnected) { # profile passt { /usr/bin/passt r, # passt needs to accept SIGTERM from any of the tools signal (receive) set=("term") peer=/usr/bin/@{GUESTFS_TOOLS}, signal (receive) set=("term") peer=@{GUESTFS_TOOLS}, # Possible paths for socket and PID files (as user and as root) owner @{run}/user/[0-9]*/libguestfs*/passt.sock rw, owner @{run}/user/[0-9]*/libguestfs*/passt[0-9]*.pid rw, owner /tmp/libguestfs*/passt.sock rw, owner /tmp/libguestfs*/passt[0-9].pid rw, include if exists <abstractions/passt> } } -- no debconf information
