[Bug 1968187] Re: apparmor denial when using swtpm

[Launchpad Bug Tracker]

This bug was fixed in the package libvirt - 8.0.0-1ubuntu7

---------------
libvirt (8.0.0-1ubuntu7) jammy; urgency=medium

  * d/p/ubuntu-aa/0035-apparmor-separate-swtpm-rules.patch: Patch the libvirtd
    and libvirt-qemu apparmor profiles to allow swtpm to use its own profile
    (LP: #1968187)

 -- Lena Voytek <lena.voytek at canonical.com>  Tue, 12 Apr 2022 10:04:05
-0700

** Changed in: libvirt (Ubuntu)
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to swtpm in Ubuntu.
https://bugs.launchpad.net/bugs/1968187

Title:
  apparmor denial when using swtpm

Status in libvirt package in Ubuntu:
  Fix Released
Status in swtpm package in Ubuntu:
  Fix Released

Bug description:
  Guest using:
  <devices>
   <tpm model='tpm-tis'>
    <backend type='emulator' version='2.0'/>
   </tpm>
  </devices>

  Triggers:
  apparmor="DENIED" operation="open" profile="libvirt-202a34a9-2ee2-4826-b206-c249f535be90" name="/etc/ssl/openssl.cnf" pid=15149 comm="swtpm" requested_mask="r" denied_mask="r" fsuid=113 ouid=0

  Find from the swtpm side, but we need to open up the guest as well.
  OTOH it is not fatal, and you'd wonder why qemu needs it - will need to check and then allow or deny this.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1968187/+subscriptions