Ran into this bug trying to test running under UEFI.
I was able to get the VM booting (but it dropped into the EFI shell, no quite sure, but possible related to the use of the two files versus the single-combined file). Here's how I reproduced the issue:
This bug suggests to update the aa profile, but as already mentioned, this
complained about loading the profile. This comment here[1] helped me debug
and diagnose the issue. It appears that /usr/share is hardcoded as a no-go
place for libvirt/qemu to read from and hence aa denies access to the files.
to the template didn't help either. The comment from jdstrand made me think this was
hardcoded and couldn't be changed, so decided to relocate the OVMF files to a place where
libvirt and qemu can read them.
Ran into this bug trying to test running under UEFI.
I was able to get the VM booting (but it dropped into the EFI shell, no quite sure, but possible related to the use of the two files versus the single-combined file). Here's how I reproduced the issue:
On xenial amd64 host,
- sudo add-apt-repository multiverse ms-libvirt sync --source http:// cloud-images. ubuntu. com/daily release=xenial arch=amd64 >/usr/share/ OVMF/OVMF_ CODE.fd< /loader> '/usr/share/ OVMF/OVMF_ VARS.fd' >/var/lib/ libvirt/ qemu/nvram/ x1_VARS. fd</nvram>
- sudo apt install uvtool uvtool-libvirt ovmf
- uvt-simplestrea
- uvt-kvm create --memory 1024 --cpu 4 --disk 10 x1 release=xenial arch=amd64
- virsh stop x1
- virsh edit x1
Add inside <os> section:
<os>
...
<loader readonly='yes' type='pflash'
<nvram template=
...
</os>
- virsh start x1
... failed to start x1
This bug suggests to update the aa profile, but as already mentioned, this
complained about loading the profile. This comment here[1] helped me debug
and diagnose the issue. It appears that /usr/share is hardcoded as a no-go
place for libvirt/qemu to read from and hence aa denies access to the files.
I debugged that with:
% virsh dumpxml x1 | sudo /usr/lib/ libvirt/ virt-aa- helper -c -u libvirt-`virsh domuuid x1` x1 OVMF/OVMF_ CODE.fd
virt-aa-helper: error: /usr/share/
virt-aa-helper: error: skipped restricted file
virt-aa-helper: error: invalid VM definition
Even adding:
/usr/ share/OVMF/ OVMF_CODE. fd r,
to the template didn't help either. The comment from jdstrand made me think this was
hardcoded and couldn't be changed, so decided to relocate the OVMF files to a place where
libvirt and qemu can read them.
sudo cp /usr/share/ OVMF/OVMF* /var/lib/ uvtool/ libvirt/ images/
And updated the x1 xml with the correct path to the OVFM files, then re-run the virt-aa-helper:
(funkmetal) libvirt % virsh dumpxml x1 | sudo /usr/lib/ libvirt/ virt-aa- helper -c -u libvirt-`virsh domuuid x1` x1 log/libvirt/ **/x1.log" w, lib/libvirt/ qemu/domain- x1/monitor. sock" rw, run/libvirt/ **/x1.pid" rwk, libvirt/ **/x1.pid" rwk, run/libvirt/ **/*.tunnelmigr ate.dest. x1" rw, libvirt/ **/*.tunnelmigr ate.dest. x1" rw, lib/uvtool/ libvirt/ images/ x1.qcow" rw, lib/uvtool/ libvirt/ images/ x-uvt-b64- Y29tLnVidW50dS5 jbG91ZC5kYWlseT pzZXJ2ZXI6MTYuM DQ6YW1kNjQgMjAx NjAxMDU= " r, uvtool/ libvirt/ images/ x-uvt-b64- Y29tLnVidW50dS5 jbG91ZC5kYWlseT pzZXJ2ZXI6MTYuM DQ6YW1kNjQgMjAx NjAxMDU= " w, lib/uvtool/ libvirt/ images/ x1-ds.qcow" rw, lib/uvtool/ libvirt/ images/ OVMF_CODE. fd" r, uvtool/ libvirt/ images/ OVMF_CODE. fd" w, lib/libvirt/ qemu/nvram/ x1_VARS. fd" rw,
(funkmetal) libvirt % cat libvirt-`virsh domuuid x1`.files
# DO NOT EDIT THIS FILE DIRECTLY. IT IS MANAGED BY LIBVIRT.
"/var/
"/var/
"/var/
"/run/
"/var/
"/run/
"/var/
"/var/
# don't audit writes to readonly files
deny "/var/lib/
"/var/
"/var/
# don't audit writes to readonly files
deny "/var/lib/
"/var/
/dev/vhost-net rw,
(funkmetal) libvirt % cat libvirt-`virsh domuuid x1`
#
# This profile is for the domain whose UUID matches this file.
#
#include <tunables/global>
profile libvirt- 10a7b819- a30e-4155- b61f-4402fc2dae d2 { libvirt- qemu> libvirt- 10a7b819- a30e-4155- b61f-4402fc2dae d2.files>
#include <abstractions/
#include <libvirt/
}
1. https:/ /bugs.launchpad .net/ubuntu/ +source/ libvirt/ +bug/799997/ comments/ 34