Merge from trunk revision 1620: Attached is an updated dnsmasq profile

that fixes the following:
- allow net_admin capability for DHCP server
- allow net_raw and network inet raw for ICMP pings when used as a DHCP server
- allow read and write access to libvirt pid files for dnsmasq

See the FAQ in the dnsmasq source for details. This fixes
https://launchpad.net/bugs/697239

Nominated-by: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>

profiles/apparmor.d/usr.sbin.dnsmasq

@@ -1,4 +1,14 @@
-# Author: John Dong <jdong@ubuntu.com>
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2009 John Dong <jdong@ubuntu.com>
+#    Copyright (C) 2010 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
 #include <tunables/global>
 /usr/sbin/dnsmasq {
   #include <abstractions/base>
@@ -8,6 +18,9 @@
   capability setgid,
   capability setuid,
   capability dac_override,
+  capability net_admin,         # for DHCP server
+  capability net_raw,           # for DHCP server ping checks
+  network inet raw,
 
   /etc/dnsmasq.conf r,
   /etc/dnsmasq.d/ r,
@@ -20,4 +33,9 @@
   /var/run/dnsmasq/* rw,
 
   /var/lib/misc/dnsmasq.leases rw, # Required only for DHCP server usage
+
+  # libvirt pid files for dnsmasq
+  /var/run/libvirt/network/      r,
+  /var/run/libvirt/network/*.pid rw,
+
 }