Home / ubuntu / Questions / 741035
Accepted
Programster
Asked: 2016-03-02 19:01:47 +0800 CST

Disabling AppArmor for KVM

  • 772

I'm trying to take an external snapshot of my KVM guest using the following script:

DOMAIN=test-snapshots.programster.org
SNAPSHOT_NAME=snap3
STATE_FILE="/media/kvm/test-snapshots/mem-snap.qcow2"
DISK_FILE="/media/kvm/test-snapshots/disk-snap.qcow2"


sudo virsh snapshot-create-as \
--domain $DOMAIN $SNAPSHOT_NAME \
--diskspec vda,file=$DISK_FILE,snapshot=external \
--memspec file=$STATE_FILE,snapshot=external \
--atomic

Unfortunately, whenever executed, it produces the following error output

error: internal error: unable to execute QEMU command 'transaction': Could not open '/media/kvm/KVM-Command-Generator/vms/test-snapshots.programster.org.img': Could not open '/media/kvm/KVM-Command-Generator/vms/test-snapshots.programster.org.img': Permission denied: Permission denied

I read that this can be resolved by using aa-complain. I followed the steps to get the ID of the VM which is 5e1df6be-2cdd-8d7a-a45b-01097c7f44c6.

However, when I run:

sudo aa-complain libvirt-5e1df6be-2cdd-8d7a-a45b-01097c7f44c6

I get the following error:

Can't find libvirt-5e1df6be-2cdd-8d7a-a45b-01097c7f44c6 in the system path list. If the name of the application
is correct, please run 'which libvirt-5e1df6be-2cdd-8d7a-a45b-01097c7f44c6' as a user with correct PATH
environment set up in order to find the fully-qualified path and
use the full path as parameter.

I made sure to double check it was still an apparmor issue by checking the syslog which has the following entries when trying to perform the snapshot.

Mar  2 02:58:22 kvm kernel: [542687.670005] audit: type=1400 audit(1456887502.702:140): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="libvirt-5e1df6be-2cdd-8d7a-a45b-01097c7f44c6" pid=6824 comm="apparmor_parser"
Mar  2 02:58:22 kvm kernel: [542687.675951] audit: type=1400 audit(1456887502.706:141): apparmor="DENIED" operation="open" profile="libvirt-5e1df6be-2cdd-8d7a-a45b-01097c7f44c6" name="/media/kvm/KVM-Command-Generator/vms/test-snapshots.programster.org.img" pid=8107 comm="qemu-system-x86" requested_mask="r" denied_mask="r" fsuid=118 ouid=118
Mar  2 02:58:22 kvm kernel: [542687.675989] audit: type=1400 audit(1456887502.710:142): apparmor="DENIED" operation="open" profile="libvirt-5e1df6be-2cdd-8d7a-a45b-01097c7f44c6" name="/media/kvm/KVM-Command-Generator/vms/test-snapshots.programster.org.img" pid=8107 comm="qemu-system-x86" requested_mask="r" denied_mask="r" fsuid=118 ouid=118
Mar  2 02:58:22 kvm kernel: [542687.676034] audit: type=1400 audit(1456887502.710:143): apparmor="DENIED" operation="open" profile="libvirt-5e1df6be-2cdd-8d7a-a45b-01097c7f44c6" name="/media/kvm/KVM-Command-Generator/vms/test-snapshots.programster.org.img" pid=8107 comm="qemu-system-x86" requested_mask="r" denied_mask="r" fsuid=118 ouid=118
Mar  2 02:58:23 kvm kernel: [542687.969561] audit: type=1400 audit(1456887503.002:144): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="libvirt-5e1df6be-2cdd-8d7a-a45b-01097c7f44c6" pid=6841 comm="apparmor_parser"

What do I need to do in order to allow the external snapshotting of KVM guests? This may be something like tweaking/disabling apparmor, or perhaps there is a better solution?

Extra Details

OS: Ubuntu 14.04

Output of uname -a

Linux kvm.programster.org 4.2.0-30-generic #35~14.04.1-Ubuntu SMP Fri Feb 19 14:48:13 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

The output of aa-status is:

apparmor module is loaded.
35 profiles are loaded.
34 profiles are in enforce mode.
   /sbin/dhclient
   /usr/bin/evince
   /usr/bin/evince-previewer
   /usr/bin/evince-previewer//sanitized_helper
   /usr/bin/evince-thumbnailer
   /usr/bin/evince-thumbnailer//sanitized_helper
   /usr/bin/evince//sanitized_helper
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/cups/backend/cups-pdf
   /usr/lib/libvirt/virt-aa-helper
   /usr/lib/lightdm/lightdm-guest-session
   /usr/lib/lightdm/lightdm-guest-session//chromium
   /usr/lib/telepathy/mission-control-5
   /usr/lib/telepathy/telepathy-*
   /usr/lib/telepathy/telepathy-*//pxgsettings
   /usr/lib/telepathy/telepathy-*//sanitized_helper
   /usr/lib/telepathy/telepathy-ofono
   /usr/sbin/cups-browsed
   /usr/sbin/cupsd
   /usr/sbin/tcpdump
   libvirt-0146f0b4-3117-bfae-8142-7fd2680f0e02
   libvirt-1418991d-64ec-9a1f-f9b0-f4c95285c0fa
   libvirt-1ce386c6-c44a-054c-199a-0c44726fe973
   libvirt-271e5909-afe4-57e2-6013-587071919685
   libvirt-5e1df6be-2cdd-8d7a-a45b-01097c7f44c6
   libvirt-701ad939-e103-d41d-e7f1-71f368218604
   libvirt-8a05e9ca-1918-7ec7-37b7-48b7c7e03a6d
   libvirt-a0a8fa52-f59e-2d7f-06d3-7e5080369f1b
   libvirt-be861e30-baf5-9c34-75d6-0142e10cf000
   libvirt-bef3d687-5f3b-217f-29d7-795aaed8a865
   libvirt-c2c962ef-4864-fd32-37d0-3ec0fa773a30
   libvirt-e299551e-d503-7a47-5696-8f28f5c0754d
   libvirt-f8ed2b66-c957-d104-262b-ac3aa63b237f
1 profiles are in complain mode.
   /usr/sbin/libvirtd
17 processes have profiles defined.
16 processes are in enforce mode.
   /usr/lib/telepathy/mission-control-5 (3368) 
   /usr/sbin/cups-browsed (1179) 
   /usr/sbin/cupsd (18585) 
   /usr/sbin/cupsd (18588) 
   libvirt-0146f0b4-3117-bfae-8142-7fd2680f0e02 (2741) 
   libvirt-1418991d-64ec-9a1f-f9b0-f4c95285c0fa (2803) 
   libvirt-1ce386c6-c44a-054c-199a-0c44726fe973 (2867) 
   libvirt-271e5909-afe4-57e2-6013-587071919685 (2470) 
   libvirt-5e1df6be-2cdd-8d7a-a45b-01097c7f44c6 (8107) 
   libvirt-701ad939-e103-d41d-e7f1-71f368218604 (2564) 
   libvirt-8a05e9ca-1918-7ec7-37b7-48b7c7e03a6d (2666) 
   libvirt-a0a8fa52-f59e-2d7f-06d3-7e5080369f1b (2705) 
   libvirt-be861e30-baf5-9c34-75d6-0142e10cf000 (2607) 
   libvirt-bef3d687-5f3b-217f-29d7-795aaed8a865 (2834) 
   libvirt-c2c962ef-4864-fd32-37d0-3ec0fa773a30 (2095) 
   libvirt-f8ed2b66-c957-d104-262b-ac3aa63b237f (2772) 
1 processes are in complain mode.
   /usr/sbin/libvirtd (1562) 
0 processes are unconfined but have a profile defined.
kvm

4 Answers

  1. The apparmor profile for libvirt guests is created on the fly. If you want to add extra files to the allowed list, add the required files to the end of the following file:

    /etc/apparmor.d/abstractions/libvirt-qemu

      /var/lib/libvirt/images/*.ign r,
    • 4
  2. Best Answer

    After reviewing all the information, it appears that you are on the right path. The issue is that the aa-complain command is expecting a full path.

    The solution is to run the command below that specifies the full path to the VM:

    sudo aa-complain /etc/apparmor.d/libvirt/libvirt-5e1df6be-2cdd-8d7a-a45b-01097c7f44c6

    • 3

  3. It seems that in your case, AppArmor is constraining libvirtd too much. If you have a profile /etc/apparmor.d/usr.sbin.libvirtd, you can disable it in the following way:

    sudo ln -s /etc/apparmor.d/usr.sbin.libvirtd /etc/apparmor.d/disable/usr.sbin.libvirtd

    You will need to reboot for this to take effect.

    • 2

  4. This happened to me after a working kvm host was upgraded from stretch to buster. The image file itself was readable, the complaint was about the qcow2-backing file. I added "file," to /etc/apparmor.d/libvirt/TEMPLATE.qemu (like in the lxc template). After that everything seemed to work fine.

    • 2