[Pkg-libvirt-maintainers] Bug#916587: AppArmor breaks virtio-gpu + virgl

[intrigeri]

Control: severity -1 important
Control: tag -1 + fixed-upstream

Hi,

bumping severity as this totally breaks an option offered to users via
virt-manager.

Now, I've verified that virt-manager in current sid still creates new
VMs with QXL graphics by default, so this bug only affects users who
opt in for virtio + 3D acceleration. As such, I'm unsure how much of
a stretch it would be to request a freeze exception — Guido, what do
you think?

If it helps, I'd be happy to test the corresponding upstream patches:

   commit f2cbb94eabdd5e3422c45b1afa48eb4c951c09e0
   Author: Christian Ehrhardt <christian.ehrhardt at canonical.com>
   Date:   Tue Mar 5 13:38:38 2019 +0100
   
       security: aa-helper: gl devices in sysfs at arbitrary depth
   
   commit 00fbb9e51678f76effa2d20e78a9be861ad5f484
   Author: Christian Ehrhardt <christian.ehrhardt at canonical.com>
   Date:   Fri Mar 1 07:25:59 2019 +0100
   
       security: aa-helper: nvidia rules for gl devices
   
   commit 27a9ebf28183cb3c3c784fcab622e67e978eb3dc
   Author: Christian Ehrhardt <christian.ehrhardt at canonical.com>
   Date:   Tue Feb 12 11:12:52 2019 +0100
   
       security: aa-helper: generate more rules for gl devices
   
   commit d85e8e400b48f1b4c1dfbf438dda83cd959eacf7
   Author: Christian Ehrhardt <christian.ehrhardt at canonical.com>
   Date:   Tue Feb 12 10:33:23 2019 +0100
   
       security: aa-helper: allow virt-aa-helper to read /dev/dri
   
   commit fb01e1a44daea773cd53f275cad6f031506c20db
   Author: Christian Ehrhardt <christian.ehrhardt at canonical.com>
   Date:   Mon Jan 14 15:15:06 2019 +0200
   
       virt-aa-helper: generate rules for gl enabled graphics devices

Cheers!