apparmor aprofile access to ptrace for nova-compute
Software environment
- Operating system: Ubuntu 20.04.3
- Architecture: x86_64
- kernel version: 5.4.0-86-generic
- libvirt version: 6.0.0-0ubuntu8.14
- Hypervisor and version: nova 21.2.22-0ubuntu1, qemu 4.2-3ubuntu6.17
Description of problem
We have a OpenStack environment, that has iscsi environment, and is used to attach volumes via iscci and multipath. When attaching the disk to libvirtd via nova-compute we get a DENY from apparmor, showing the following log entry in journal
Oct 19 17:22:22 node114 audit[2576]: AVC apparmor="DENIED" operation="ptrace" profile="libvirtd" pid=2576 comm="libvirtd" requested_mask="read" denied_mask="read" peer="/usr/bin/nova-compute"
I would like to request for this to be added, if possible.