title: virt-aa-helper doesn't add path for storage pool in AppArmor generated rules
body: <p>I'm having a new VM on a new Ubuntu 20.04 host (libvirtd (libvirt) 6.0.0) that fails to start due to AppArmor denying read access to the VM disk. The disk is defined as follows:</p>
  <pre><code>&lt;disk type='volume' device='disk'&gt;
    &lt;driver name='qemu' type='qcow2'/&gt;
    &lt;source pool='default' volume='awesome.qcow2'/&gt;
    &lt;target dev='vda' bus='virtio'/&gt;
    &lt;address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/&gt;
  &lt;/disk&gt;
  &lt;disk type='file' device='cdrom'&gt;
    &lt;driver name='qemu' type='raw'/&gt;
    &lt;source file='/var/lib/libvirt/images/ubuntu-20.04.1-live-server-amd64.iso'/&gt;
    &lt;target dev='hda' bus='sata'/&gt;
    &lt;readonly/&gt;
    &lt;address type='drive' controller='0' bus='0' target='0' unit='0'/&gt;
  &lt;/disk&gt;
  </code></pre>
  <p>During VM startup, it fails with the following message:</p>
  <pre><code>error: Failed to start domain playground
  error: internal error: qemu unexpectedly closed the monitor: 2020-09-06T20:25:32.047663Z qemu-system-x86_64: -blockdev {&quot;driver&quot;:&quot;file&quot;,&quot;filename&quot;:&quot;/var/lib/libvirt/images/awesome.qcow2&quot;,&quot;node-name&quot;:&quot;libvirt-2-storage&quot;,&quot;auto-read-only&quot;:true,&quot;discard&quot;:&quot;unmap&quot;}: Could not open '/var/lib/libvirt/images/awesome.qcow2': Permission denied
  </code></pre>
  <p>Permissions are correct, I have verified it by disabling AppArmor and also the following is printed in the kernel logs:</p>
  <pre><code>[10757.098291] audit: type=1400 audit(1599423932.042:131): apparmor=&quot;DENIED&quot; operation=&quot;open&quot; profile=&quot;libvirt-b68582b8-0f35-4298-afd8-45c89ff3cbaa&quot; name=&quot;/var/lib/libvirt/images/awesome.qcow2&quot; pid=8654 comm=&quot;qemu-system-x86&quot; requested_mask=&quot;r&quot; denied_mask=&quot;r&quot; fsuid=64055 ouid=64055
  </code></pre>
  <p>Looking at the profile generated by <code>virt-aa-helper</code> in <code>/etc/apparmor.d/libvirt/</code> (while the VM is starting up), I can see the following contents:</p>
  <pre><code># DO NOT EDIT THIS FILE DIRECTLY. IT IS MANAGED BY LIBVIRT.
    &quot;/var/log/libvirt/**/playground.log&quot; w,
    &quot;/var/lib/libvirt/qemu/domain-playground/monitor.sock&quot; rw,
    &quot;/var/lib/libvirt/qemu/domain-17-playground/*&quot; rw,
    &quot;/run/libvirt/**/playground.pid&quot; rwk,
    &quot;/run/libvirt/**/*.tunnelmigrate.dest.playground&quot; rw,
    &quot;/var/lib/libvirt/images/ubuntu-20.04.1-live-server-amd64.iso&quot; rk,
    &quot;/dev/vhost-net&quot; rw,
    &quot;/var/lib/libvirt/qemu/domain-17-playground/{,**}&quot; rwk,
    &quot;/var/lib/libvirt/qemu/channel/target/domain-17-playground/{,**}&quot; rwk,
    &quot;/var/lib/libvirt/qemu/domain-17-playground/master-key.aes&quot; rwk,
    &quot;/dev/net/tun&quot; rwk,
  </code></pre>
  <p>For some reason, the path of the the disk is missing, while the ISO is correctly added. I can see the path of the default pool in <code>/etc/apparmor.d/usr.lib.libvirt.virt-aa-helper</code>:</p>
  <pre><code>[...]
  @{HOME}/ r,
  @{HOME}/** r,
  /var/lib/libvirt/images/ r,
  /var/lib/libvirt/images/** r,
  # nova base images (LP: #907269)
  /var/lib/nova/images/** r,
  [...]
  </code></pre>
  <p>I suspect there should be an entry to the disk file in the volume. Why doesn't <code>virt-aa-helper</code> add it?</p>