CODEWITHSUNDEEP
virtual-machinelibvirtapparmorvirsh
NoobieG
NoobieG

Reputation: 83

libvirt Apparmor permission denied when accessing qemu socket

I was trying to use ivshmem device of qemu, after running the server, I can succesfully create a vm with command:

sudo qemu-system-x86_64 -m 1024 -hda testvm01.img -enable-kvm \
-device ivshmem-doorbell,vectors=1,chardev=ivshmem \
-chardev socket,path=/tmp/ivshmem_socket,id=ivshmem

Then I want to use libvirt to boot the vm, and my configuration file as follows:

<domain type='kvm' xmlns:qemu='http://libvirt.org/schemas/domain/qemu/1.0'>
  <name>testlinux1</name>
  <memory unit='KiB'>1048576</memory>
  <currentMemory unit='KiB'>1048576</currentMemory>
  <vcpu placement='static'>1</vcpu>
  <os>
    <type arch='x86_64' machine='pc-i440fx-bionic'>hvm</type>
  </os>
  <devices>
    <emulator>/usr/bin/qemu-system-x86_64</emulator>
    <disk type='file' device='disk'>
      <driver name='qemu' type='raw'/>
      <source file='/home/gavin/vms/testvm01.img'/>
      <target dev='hda' bus='ide'/>
      <address type='drive' controller='0' bus='0' target='0' unit='0'/>
    </disk>
  </devices>
  <qemu:commandline>
    <qemu:arg value='-device'/>
    <qemu:arg value='ivshmem-doorbell,vectors=2,chardev=ivshmem'/>
    <qemu:arg value='-chardev'/>
    <qemu:arg value='socket,path=/tmp/ivshmem_socket,id=ivshmem'/>
  </qemu:commandline>
</domain>

When I try to create the vm with command virsh create testlinux1.xml, I get the error:

error: Failed to start domain testlinux1
error: internal error: process exited while connecting to monitor: 2018-07-19T22:12:52.443682Z qemu-system-x86_64: -chardev socket,path=/tmp/ivshmem_socket,id=ivshmem: Failed to connect socket /tmp/ivshmem_socket: Permission denied

I have seen the same question at: Using IVSHMEM with libvirt virt-manager

I can not follow the solution there since I failed to create the vm, there is no libvirt-<uuid> file under /etc/apparmor.d/libvirt, and I have no way to change AppArmor mode to complain with sudo aa-complain libvirt-<uuid> //replace <uuid> with uuid of vm.

Can anyone helps me figure out how to change the mode to complain before creating the file? Thank you very much!

Upvotes: 2

Views: 2702

Answers (1)

cstroe
cstroe

Reputation: 4236

You can put AppArmor in complain mode for libvirt:

aa-complain /usr/sbin/libvirtd

This disables the security, so may not be the best solution.

Upvotes: 1

Related Questions