Comment 20 for bug 1483071

Revision history for this message
Jean-Pierre van Riel (jpvr) wrote :

I have encoutered a similar bug related to the libvirt per guest AppArmor profile helper, libvirt-aa-helper

Virtual Machine Manager GUI reports
---
Error starting domain: internal error: process exited while connecting to monitor: 2015-11-16T09:39:50.572025Z qemu-system-x86_64: -drive file=/var/lib/libvirt/qemu/nvram
...
bvirtError: internal error: process exited while connecting to monitor: 2015-11-16T09:39:50.572025Z qemu-system-x86_64: -drive file=/var/lib/libvirt/qemu/nvram/Win10Raw_VARS.fd,if=pflash,format=raw,unit=1: Could not open '/var/lib/libvirt/qemu/nvram/Win10Raw_VARS.fd': Permission denied
---

And here is the AppArmour error seen in dmesg
---
[ 5576.944602] audit: type=1400 audit(1447663737.977:80): apparmor="DENIED" operation="open" profile="libvirt-bf7063cc-3a6a-4359-88a4-c84bb625a421" name="/var/lib/libvirt/qemu/nvram/Win10Raw_VARS.fd" pid=2802 comm="qemu-system-x86" requested_mask="wr" denied_mask="wr" fsuid=123 ouid=123
---

As per http://wiki.apparmor.net/index.php/Libvirt, virt-aa-helper is used and as per https://www.redhat.com/archives/libvir-list/2015-August/msg00534.html there's a bugfix. However, it still doesn't include and cater for using NVRAM VAR OVMF files generated at /var/lib/libvirt/qemu/nvram/<domain>_VARS.fd.

The fix for this seems to be in this commit: http://libvirt.org/git/?p=libvirt.git;a=commit;h=91fdcefa7f145c1c39acc8e9a44fbfbf11568e54

The issue is that the libvirtd version in the ubuntu repo for 15.10 is too old to include the patch (i.e. v1.2.16)?