Dear Maintainer,

This report is the follow-up of #1149683.

* What led up to the situation?

  virt-customize does not work at all because passt was broken.

  Partially "passt permission denied" was fixed in
  passt/0.0~git20261002.cba3570-1 [1], but not solve the rest of issue
  yet.

  [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149683

  sudo journalctl -k -b --no-pager |
    grep -E 'apparmor=.*(passt|guestfs)|uid_map|gid_map|setgroups'
  10月 03 19:17:33 jet kernel: audit: type=1400
  audit(1791022653.210:182): apparmor="STATUS"
  operation="profile_replace" info="same as current profile, skipping"
  profile="unconfined" name="passt" pid=59220 comm="apparmor_parser"
  10月 03 19:18:58 jet kernel: audit: type=1400
  audit(1791022738.834:184): apparmor="DENIED" operation="open"
  class="file" info="Failed name lookup - disconnected path" error=-13
  profile="guestfs-tools//passt" name="" pid=66509 comm="passt.avx2"
  requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

* What exactly did you do (or not do) that was effective (or
  ineffective)?

  I've applied flags for /etc/apparmor.d/guestfs-tools.

Before:

   profile passt {

After:

   profile passt flags=(attach_disconnected) {

  Then reload it with:

  sudo apparmor_parser -r /etc/apparmor.d/guestfs-tools

* What was the outcome of this action?

  virt-customize succeeds without error. (e.g. update qcow2 image)

  virt-customize --verbose -x --add unstable-xfce-template.qcow2
  --update

Best Regards,

Hello,

thank you for the patch above, I'm trying to run on Debian testing the
following coomand:

virt-customize -v --root-password password:f -a
resolute-server-cloudimg-amd64v3.img

patching the policy helped with the following error:

kernel: audit: type=1400 audit(1792010054.510:171): apparmor="DENIED"
operation="open" class="file" info="Failed name lookup - disconnected
path" error=-13 profile="guestfs-tools//passt" name="" pid=6563
comm="passt.avx2" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

but the policy still denies mknod operation:

kernel: audit: type=1400 audit(1792011995.296:492): apparmor="DENIED"
operation="mknod" class="file" profile="passt"
name="/run/user/1000/libguestfsewiR6y/passt.sock" pid=10413
comm="passt.avx2" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000

for the following commands virt-customize runs:

libguestfs: command: run: passt
libguestfs: command: run: \ --one-off
libguestfs: command: run: \ --socket
/run/user/1000/libguestfsewiR6y/passt.sock
libguestfs: command: run: \ --pid /run/user/1000/libguestfsewiR6y/passt2.pid
libguestfs: command: run: \ --address 169.254.2.15
libguestfs: command: run: \ --netmask 16
libguestfs: command: run: \ --mac-addr 52:56:00:00:00:02
libguestfs: command: run: \ --gateway 169.254.2.2
No interfaces with usable IPv6 routes
IPv6: no external interface as template, use local mode
Failed to bind UNIX domain socket: Permission denied

Best Regards
Ivan Stana