Changing libvirt emulator: Permission denied

Question

I'm trying to use a binary of Qemu that I compiled using this tutorial, since the version of Qemu that's packaged with my OS, Debian, doesn't seem to support OpenGL acceleration with Spice. After a successful compilation, I tried to set the <emulator> tag to the path to new Qemu executable in /usr/local/bin, but I receive the following error:

error: internal error: Failed to probe QEMU binary with QMP: libvirt: error : cannot execute binary /usr/local/bin/qemu-2.12.1/x86_64-softmmu/qemu-system-x86_64: Permission denied

The 'emulator' part of my virsh edit configuration file is as follows:

<emulator>/usr/bin/kvm</emulator>

I have experimented with changing the permissions and ownership of the file, made sure to allow execution (chmod a+x), however none seem to work.

If there are any other ways of using the OpenGL acceleration feature of Qemu, please let me know.

I am currently using Debian Stretch, with the the virt-manager, libvirt-daemon and qemu-kvm from the 'testing' repository, on an Intel Core i5-8400, using the integrated GPU. I have compiled Qemu so I could use the OpenGL 3D acceleration feature with 'libvirglrenderer'.

Answer 1

I just solved same problem on Debian Buster. Apparmor was denying access to my compiled qemu binary. You can check if apparmor is enabled on your system using command:

sudo aa-status

If your output contains following lines then apparmor is surely enabled and needs to be configured to allow access to your compiled binary:

...
22 profiles are in enforce mode.
...
   /usr/sbin/libvirtd
...
3 processes are in enforce mode.
   /usr/sbin/libvirtd (1098)
...

Add apparmor permission for libvirt to execute your qemu binary. You can do it, for example, with placing following lines in /etc/apparmor.d/usr.sbin.libvirtd just before last '}' symbol in config. End of config would look then like this:

# ... skipped lines
  /usr/bin/kvm rmix,
  /usr/local/bin/qemu-2.12.1/x86_64-softmmu/qemu-system-x86_64 rmix,
}

Probably you will also need to add same apparmor permissions for qemu in /etc/apparmor.d/abstractions/libvirt-qemu:

  /usr/bin/kvm rmix,
  /usr/local/bin/qemu-2.12.1/x86_64-softmmu/qemu-system-x86_64 rmix,

You can reload apparmor rulesets using sudo systemctl reload apparmor. Apparmor rules syntax described, for example, here.