Every time I run virsh destroy ${KVM} as root I get the following error (virsh shutdown ${KVM} is showing absolutely no reaction, nothing happens):

error: Failed to destroy domain ${KVM}
error: Failed to terminate process 11956 with SIGTERM: Permission denied

When I run shutdown -h now inside the KVM, it hangs forever until I kill the qemu-system-x86_64 process (kill ${PID_OF_QEMU_PROCESS}). As stated in the syslog, apparmor is blocking the calls (both for virsh shutdown and virsh destroy):

apparmor="DENIED" operation="ptrace" profile="/usr/sbin/libvirtd" pid=23212
    comm="libvirtd" requested_mask="trace" denied_mask="trace" peer="unconfined"

In the qemu configuration file /etc/libvirt/qemu.conf I tried to disable Apparmor (security_driver = "none"), but I still get the same error.

Some details: OS = Debian 9, Kernel = 4.14.0-0.bpo.2-amd64, libvirt-version = 3.0.0-4.

Does anyone know how to fix the problem without disabling apparmor?

  • Maybe stopping it first would make a difference? Jan 11, 2018 at 12:55
  • Same situation with shutdown - I edited my question. Thanks for the advice.
    – manifestor
    Jan 11, 2018 at 13:15

1 Answer 1


Setting security_driver = "none" will not disable apparmor in the kernel, just some support in libvirt itself

Looking at the apparmor profile in current stable (debian 9/stretch) and the one currently in unstable, I see quite some differences.

I believe you could add the following rule in /etc/apparmor.d/local/usr.sbin.libvirtd (this is one of the many differences between the two versions):

ptrace (trace) peer=unconfined,

And then restart the apparmor service with service restart apparmor

Other rules would probably be needed to make everything work though.

An other solution would be to set the profile in "complain" mode with aa-complain /usr/sbin/libvirtd, that will prevent apparmor from denying anything but you would keep the issues logged.

You could later use aa-logprof to generate the missing rules (after carefully reviewing them) or try to get the apparmor profile files from unstable.

  • Perfect, thanks, I took the usr.sbin.libvirt profile from unstable and also the /etc/apparmor.d/abstractions/libvirt-qemu template. Now it works fluently.
    – manifestor
    Jan 11, 2018 at 21:06
  • That should maybe be reported in Debian
    – Bigon
    Jan 11, 2018 at 21:12
  • This has been fixed in stretch-proposed-updates bugs.debian.org/cgi-bin/bugreport.cgi?bug=882697#80 Feb 28, 2018 at 15:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .