Both of these binaries are spawn by libvirt. Add a rule to the
default profile to allow that.
Signed-off-by: Michal Privoznik <mpriv...@redhat.com>
---
src/security/apparmor/usr.sbin.libvirtd | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/security/apparmor/usr.sbin.libvirtd
b/src/security/apparmor/usr.sbin.libvirtd
index 2089ba1b3e..27314b1512 100644
--- a/src/security/apparmor/usr.sbin.libvirtd
+++ b/src/security/apparmor/usr.sbin.libvirtd
@@ -100,6 +100,8 @@ profile libvirtd /usr/sbin/libvirtd
flags=(attach_disconnected) {
audit deny /sys/kernel/security/apparmor/.* rwxl,
/sys/kernel/security/apparmor/profiles r,
/usr/{lib,lib64}/libvirt/* PUxr,
+ /usr/libexec/virt-aa-helper PUxr,
+ /usr/libexec/libvirt_lxc PUxr,
/usr/libexec/libvirt_parthelper ix,
/usr/libexec/libvirt_iohelper ix,
/etc/libvirt/hooks/** rmix,
--
2.24.1
