[libvirt] [PATCH] apparmor: fix ptrace rules with kernel 4.18

[Christian Ehrhardt]

Due to kernel upstream change 338d0be4 ("apparmor: fix ptrace read check")
libvirt now hits apparmor denies like:
  apparmor="DENIED" operation="ptrace" profile="/usr/sbin/libvirtd"
  pid=4409 comm="libvirtd" requested_mask="read" denied_mask="read"
  peer="libvirt-14e92a75-7668-4b97-8f92-322fc1b9c78a"

Extend the ptrace rule to also allow 'ptrace (read)' for libvirtd to work
with these newer kernels.

Fixes: https://bugs.launchpad.net/bugs/1788603

Reported-by: Thadeu Lima de Souza Cascardo <thadeu.cascardo at canonical.com>
Signed-off-by: Christian Ehrhardt <christian.ehrhardt at canonical.com>
---
 examples/apparmor/usr.sbin.libvirtd | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd
index 80e348b7ee..f0ffc53008 100644
--- a/examples/apparmor/usr.sbin.libvirtd
+++ b/examples/apparmor/usr.sbin.libvirtd
@@ -50,10 +50,10 @@
   # for --p2p migrations
   unix (send, receive) type=stream addr=none peer=(label=unconfined addr=none),
 
-  ptrace (trace) peer=unconfined,
-  ptrace (trace) peer=/usr/sbin/libvirtd,
-  ptrace (trace) peer=/usr/sbin/dnsmasq,
-  ptrace (trace) peer=libvirt-*,
+  ptrace (read,trace) peer=unconfined,
+  ptrace (read,trace) peer=/usr/sbin/libvirtd,
+  ptrace (read,trace) peer=/usr/sbin/dnsmasq,
+  ptrace (read,trace) peer=libvirt-*,
 
   signal (send) peer=/usr/sbin/dnsmasq,
   signal (read, send) peer=libvirt-*,
-- 
2.17.1