commit c44b29aacb6a3f445ab06d61899a0308b9d6d0d3
Author: Jim Fehlig <jfehlig@suse.com>
Date:   Fri Oct 6 14:20:36 2017 -0600

    apparmor: add dnsmasq ptrace rule to libvirtd profile
    
    Commit b482925c added ptrace rule for the apparmor profiles,
    but one was missed in the libvirtd profile for dnsmasq. It was
    overlooked since the test machine did not have an active libvirt
    network requiring dnsmasq that was also set to autostart. With
    one active and set to autostart, the following denial is observed
    in audit.log when restarting libvirtd
    
    type=AVC msg=audit(1507320136.306:298): apparmor="DENIED" \
    operation="ptrace" profile="/usr/sbin/libvirtd" pid=5472 \
    comm="libvirtd" requested_mask="trace" denied_mask="trace" \
    peer="/usr/sbin/dnsmasq"
    
    With an active network, I suspect a libvirtd restart causes access
    to /proc/<dnsmasq-pid>/*, hence the resulting denial. As a nasty
    side affect of the denial, libvirtd thinks it needs to spawn a
    dnsmasq process even though one is already running for the network.
    E.g. after two libvirtd restarts
    
    dnsmasq   1683  0.0  0.0  51188  2612 ?        S    12:03   0:00 \
     /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf \
     --leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper
    root      1684  0.0  0.0  51160   576 ?        S    12:03   0:00 \
     /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf \
     --leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper
    dnsmasq   4706  0.0  0.0  51188  2572 ?        S    13:54   0:00 \
     /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf \
     --leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper
    root      4707  0.0  0.0  51160   572 ?        S    13:54   0:00 \
     /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf \
     --leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper
    dnsmasq   4791  0.0  0.0  51188  2580 ?        S    13:56   0:00 \
     /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf \
     --leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper
    root      4792  0.0  0.0  51160   572 ?        S    13:56   0:00 \
     /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf \
     --leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper
    
    A simple fix is to add a ptrace rule for dnsmasq.
    
    Signed-off-by: Jim Fehlig <jfehlig@suse.com>
    Reviewed-By: Guido Günther <agx@sigxcpu.org>

Index: libvirt-3.8.0/examples/apparmor/usr.sbin.libvirtd
===================================================================
--- libvirt-3.8.0.orig/examples/apparmor/usr.sbin.libvirtd
+++ libvirt-3.8.0/examples/apparmor/usr.sbin.libvirtd
@@ -39,6 +39,7 @@
 
   ptrace (trace) peer=unconfined,
   ptrace (trace) peer=/usr/sbin/libvirtd,
+  ptrace (trace) peer=/usr/sbin/dnsmasq,
   ptrace (trace) peer=libvirt-*,
 
   # Very lenient profile for libvirtd since we want to first focus on confining