apparmor: support ptrace checks
apparmor: support ptrace checks

Kernel 4.13 introduced finer-grained ptrace checks

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=v4.13.2&id=290f458a4f16f9cf6cb6562b249e69fe1c3c3a07

With kernel 4.13 and apparmor 2.11, simply starting libvirtd
results in the following apparmor denial

type=AVC msg=audit(1506112085.645:954): apparmor="DENIED"
operation="ptrace" profile="/usr/sbin/libvirtd" pid=6984
comm="libvirtd" requested_mask="trace" denied_mask="trace"
peer="unconfined"

Attempting to start an unconfined domain results in

type=AVC msg=audit(1506112301.227:1112): apparmor="DENIED"
operation="ptrace" profile="/usr/sbin/libvirtd" pid=7498
comm="libvirtd" requested_mask="trace" denied_mask="trace"
peer="/usr/sbin/libvirtd"

And attempting to start a confined domain results in

type=AVC msg=audit(1506112631.408:1312): apparmor="DENIED"
operation="open" profile="virt-aa-helper" name="/etc/libnl/classid"
pid=8283 comm="virt-aa-helper" requested_mask="r" denied_mask="r"
fsuid=0 ouid=0
type=AVC msg=audit(1506112631.530:1319): apparmor="DENIED"
operation="open" profile="virt-aa-helper" name="/etc/libnl/classid"
pid=8289 comm="virt-aa-helper" requested_mask="r" denied_mask="r"
fsuid=0 ouid=0
type=AVC msg=audit(1506112632.186:1324): apparmor="DENIED"
operation="ptrace" profile="/usr/sbin/libvirtd" pid=8342
comm="libvirtd" requested_mask="trace" denied_mask="trace"
peer="libvirt-66154842-e926-4f92-92f0-1c1bf61dd1ff"

Add ptrace rules to allow the trace operations.

Resolves: https://bugzilla.suse.com/show_bug.cgi?id=1058847
Signed-off-by: Jim Fehlig <39929b5b86d72d51fceac59b52303e3fe8a3083e@suse.com>
Reviewed-by: Guido Günther <7ebf60a2ee90c1ac7f28776faba2e1a6e374ba74@sigxcpu.org>

jfehlig/libvirt,zippy2/libvirt,jardasgit/libvirt,jfehlig/libvirt,eskultety/libvirt,nertpinx/libvirt,libvirt/libvirt,andreabolognani/libvirt,olafhering/libvirt,jfehlig/libvirt,crobinso/libvirt,fabianfreyer/libvirt,jardasgit/libvirt,eskultety/libvirt,eskultety/libvirt,zippy2/libvirt,eskultety/libvirt,fabianfreyer/libvirt,libvirt/libvirt,fabianfreyer/libvirt,jardasgit/libvirt,crobinso/libvirt,zippy2/libvirt,andreabolognani/libvirt,andreabolognani/libvirt,olafhering/libvirt,fabianfreyer/libvirt,jfehlig/libvirt,andreabolognani/libvirt,crobinso/libvirt,olafhering/libvirt,jardasgit/libvirt,fabianfreyer/libvirt,olafhering/libvirt,libvirt/libvirt,nertpinx/libvirt,nertpinx/libvirt,libvirt/libvirt,nertpinx/libvirt,eskultety/libvirt,nertpinx/libvirt,zippy2/libvirt,crobinso/libvirt,andreabolognani/libvirt,jardasgit/libvirt