0

Every time I run virsh destroy ${KVM} as root I get the following error (virsh shutdown ${KVM} is showing absolutely no reaction, nothing happens):

error: Failed to destroy domain ${KVM}
error: Failed to terminate process 11956 with SIGTERM: Permission denied

When I run shutdown -h now inside the KVM, it hangs forever until I kill the qemu-system-x86_64 process (kill ${PID_OF_QEMU_PROCESS}). As stated in the syslog, apparmor is blocking the calls (both for virsh shutdown and virsh destroy):

apparmor="DENIED" operation="ptrace" profile="/usr/sbin/libvirtd" pid=23212
    comm="libvirtd" requested_mask="trace" denied_mask="trace" peer="unconfined"

In the qemu configuration file /etc/libvirt/qemu.conf I tried to disable Apparmor (security_driver = "none"), but I still get the same error.

Some details: OS = Debian 9, Kernel = 4.14.0-0.bpo.2-amd64, libvirt-version = 3.0.0-4.

Does anyone know how to fix the problem without disabling apparmor?

  • Maybe stopping it first would make a difference? – George Udosen Jan 11 '18 at 12:55
  • Same situation with shutdown - I edited my question. Thanks for the advice. – chevallier Jan 11 '18 at 13:15
1

Setting security_driver = "none" will not disable apparmor in the kernel, just some support in libvirt itself

Looking at the apparmor profile in current stable (debian 9/stretch) and the one currently in unstable, I see quite some differences.

I believe you could add the following rule in /etc/apparmor.d/local/usr.sbin.libvirtd (this is one of the many differences between the two versions):

ptrace (trace) peer=unconfined,

And then restart the apparmor service with service restart apparmor

Other rules would probably be needed to make everything work though.

An other solution would be to set the profile in "complain" mode with aa-complain /usr/sbin/libvirtd, that will prevent apparmor from denying anything but you would keep the issues logged.

You could later use aa-logprof to generate the missing rules (after carefully reviewing them) or try to get the apparmor profile files from unstable.

  • Perfect, thanks, I took the usr.sbin.libvirt profile from unstable and also the /etc/apparmor.d/abstractions/libvirt-qemu template. Now it works fluently. – chevallier Jan 11 '18 at 21:06
  • That should maybe be reported in Debian – Bigon Jan 11 '18 at 21:12
  • This has been fixed in stretch-proposed-updates bugs.debian.org/cgi-bin/bugreport.cgi?bug=882697#80 – Johannes Ranke Feb 28 '18 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.