[Pkg-libvirt-maintainers] Bug#914940: libvirt-daemon-system: AppArmor definition missing for qemu-system-riscv64

[Evgheni Dereveanchin]

Package: libvirt-daemon-system
Version: 4.7.0-1+b1
Severity: normal

Dear Maintainer,

/etc/apparmor.d/abstractions/libvirt-qemu is missing the riscv64 binary
which is causing libvirt errors when trying to run a VM with this arch
on systems where AppArmor is enabled:

libvirt:  error : cannot execute binary /usr/bin/qemu-system-riscv64:
Permission denied

This binary is part of qemu-system-misc package and other ones shipped with it
are present in the above mentioned file.

Related AppArmor log line:

audit: type=1400 audit(1543440433.257:40): apparmor="DENIED"
operation="exec"
profile="libvirt-e2902a0d-9410-44b9-944f-81f470234b49"
name="/usr/bin/qemu-system-riscv64" pid=2210 comm="
libvirtd" requested_mask="x" denied_mask="x" fsuid=115 ouid=0


-- System Information:
Debian Release: buster/sid
 APT prefers unstable
 APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.18.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=ru_RU.UTF-8, LC_CTYPE=ru_RU.UTF-8 (charmap=UTF-8),
LANGUAGE= (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libvirt-daemon-system depends on:
ii  adduser                3.118
ii  debconf [debconf-2.0]  1.5.69
ii  gettext-base           0.19.8.1-9
ii  iptables               1.8.2-2
ii  libacl1                2.2.52-3+b1
ii  libapparmor1           2.13.1-3+b1
ii  libaudit1              1:2.8.4-2
ii  libblkid1              2.32.1-0.2
ii  libc6                  2.27-8
ii  libcap-ng0             0.7.9-1
ii  libdbus-1-3            1.12.10-1
ii  libdevmapper1.02.1     2:1.02.145-4.1
ii  libgnutls30            3.5.19-1+b1
ii  libnl-3-200            3.4.0-1
ii  libnl-route-3-200      3.4.0-1
ii  libnuma1               2.0.12-1
ii  libselinux1            2.8-1+b1
ii  libvirt-clients        4.7.0-1+b1
ii  libvirt-daemon         4.7.0-1+b1
ii  libvirt0               4.7.0-1+b1
ii  libxml2                2.9.4+dfsg1-7+b2
ii  libyajl2               2.1.0-3
ii  logrotate              3.14.0-4
ii  lsb-base               9.20170808
ii  policykit-1            0.105-21

Versions of packages libvirt-daemon-system recommends:
ii  bridge-utils                 1.5-16
ii  dmidecode                    3.2-1
ii  dnsmasq-base [dnsmasq-base]  2.80-1
ii  ebtables                     2.0.10.4-5
ii  iproute2                     4.18.0-2
ii  parted                       3.2-23

Versions of packages libvirt-daemon-system suggests:
ii  apparmor    2.13.1-3+b1
pn  auditd      <none>
pn  nfs-common  <none>
pn  open-iscsi  <none>
ii  pm-utils    1.4.1-18
pn  radvd       <none>
ii  systemd     239-13
pn  systemtap   <none>
pn  zfsutils    <none>

-- Configuration Files:
/etc/libvirt/nwfilter/allow-arp.xml [Errno 13] Permission denied:
'/etc/libvirt/nwfilter/allow-arp.xml'
/etc/libvirt/nwfilter/allow-dhcp-server.xml [Errno 13] Permission
denied: '/etc/libvirt/nwfilter/allow-dhcp-server.xml'
/etc/libvirt/nwfilter/allow-dhcp.xml [Errno 13] Permission denied:
'/etc/libvirt/nwfilter/allow-dhcp.xml'
/etc/libvirt/nwfilter/allow-incoming-ipv4.xml [Errno 13] Permission
denied: '/etc/libvirt/nwfilter/allow-incoming-ipv4.xml'
/etc/libvirt/nwfilter/allow-ipv4.xml [Errno 13] Permission denied:
'/etc/libvirt/nwfilter/allow-ipv4.xml'
/etc/libvirt/nwfilter/clean-traffic-gateway.xml [Errno 13] Permission
denied: '/etc/libvirt/nwfilter/clean-traffic-gateway.xml'
/etc/libvirt/nwfilter/clean-traffic.xml [Errno 13] Permission denied:
'/etc/libvirt/nwfilter/clean-traffic.xml'
/etc/libvirt/nwfilter/no-arp-ip-spoofing.xml [Errno 13] Permission
denied: '/etc/libvirt/nwfilter/no-arp-ip-spoofing.xml'
/etc/libvirt/nwfilter/no-arp-mac-spoofing.xml [Errno 13] Permission
denied: '/etc/libvirt/nwfilter/no-arp-mac-spoofing.xml'
/etc/libvirt/nwfilter/no-arp-spoofing.xml [Errno 13] Permission
denied: '/etc/libvirt/nwfilter/no-arp-spoofing.xml'
/etc/libvirt/nwfilter/no-ip-multicast.xml [Errno 13] Permission
denied: '/etc/libvirt/nwfilter/no-ip-multicast.xml'
/etc/libvirt/nwfilter/no-ip-spoofing.xml [Errno 13] Permission denied:
'/etc/libvirt/nwfilter/no-ip-spoofing.xml'
/etc/libvirt/nwfilter/no-mac-broadcast.xml [Errno 13] Permission
denied: '/etc/libvirt/nwfilter/no-mac-broadcast.xml'
/etc/libvirt/nwfilter/no-mac-spoofing.xml [Errno 13] Permission
denied: '/etc/libvirt/nwfilter/no-mac-spoofing.xml'
/etc/libvirt/nwfilter/no-other-l2-traffic.xml [Errno 13] Permission
denied: '/etc/libvirt/nwfilter/no-other-l2-traffic.xml'
/etc/libvirt/nwfilter/no-other-rarp-traffic.xml [Errno 13] Permission
denied: '/etc/libvirt/nwfilter/no-other-rarp-traffic.xml'
/etc/libvirt/nwfilter/qemu-announce-self-rarp.xml [Errno 13]
Permission denied: '/etc/libvirt/nwfilter/qemu-announce-self-rarp.xml'
/etc/libvirt/nwfilter/qemu-announce-self.xml [Errno 13] Permission
denied: '/etc/libvirt/nwfilter/qemu-announce-self.xml'
/etc/libvirt/qemu.conf [Errno 13] Permission denied: '/etc/libvirt/qemu.conf'
/etc/libvirt/qemu/networks/default.xml [Errno 13] Permission denied:
'/etc/libvirt/qemu/networks/default.xml'

-- debconf information:
 libvirt-daemon-system/id_warning: true