3

I'm trying to use a binary of Qemu that I compiled using this tutorial, since the version of Qemu that's packaged with my OS, Debian, doesn't seem to support OpenGL acceleration with Spice. After a successful compilation, I tried to set the <emulator> tag to the path to new Qemu executable in /usr/local/bin, but I receive the following error:

error: internal error: Failed to probe QEMU binary with QMP: libvirt: error : cannot execute binary /usr/local/bin/qemu-2.12.1/x86_64-softmmu/qemu-system-x86_64: Permission denied

The 'emulator' part of my virsh edit configuration file is as follows:

<emulator>/usr/bin/kvm</emulator>

I have experimented with changing the permissions and ownership of the file, made sure to allow execution (chmod a+x), however none seem to work.

If there are any other ways of using the OpenGL acceleration feature of Qemu, please let me know.

I am currently using Debian Stretch, with the the virt-manager, libvirt-daemon and qemu-kvm from the 'testing' repository, on an Intel Core i5-8400, using the integrated GPU. I have compiled Qemu so I could use the OpenGL 3D acceleration feature with 'libvirglrenderer'.

Improve this question
10
  • Just to verify, no SELinux is running? Or if it is, the context is set correctly on the file? The directory where the file is locatedis also set to allow traversal, yes? – KevinO Sep 25 '18 at 14:31
  • 1
    You need to check the permissions of the file and all of its containing directories. You may find namei -l <file> useful for this. – Michael Hampton Sep 25 '18 at 14:41
  • @roaima It's Linux-specific. I'm not aware of any other Unix that has anything like it. – Michael Hampton Sep 25 '18 at 15:13
  • @KevinO I’m using Debian, so SELinux is not available. As far as I know, AppArmor is not restricting anything. – wispi Sep 25 '18 at 17:02
  • 1
    I said: "You need to check the permissions of the file and all of its containing directories. You may find namei -l <file> useful for this." You do not appear to have acted on this. If you have, then please edit your question and add its output. – Michael Hampton Sep 25 '18 at 17:27
3

I just solved same problem on Debian Buster. Apparmor was denying access to my compiled qemu binary. You can check if apparmor is enabled on your system using command:

sudo aa-status

If your output contains following lines then apparmor is surely enabled and needs to be configured to allow access to your compiled binary:

...
22 profiles are in enforce mode.
...
   /usr/sbin/libvirtd
...
3 processes are in enforce mode.
   /usr/sbin/libvirtd (1098)
...

Add apparmor permission for libvirt to execute your qemu binary. You can do it, for example, with placing following lines in /etc/apparmor.d/usr.sbin.libvirtd just before last '}' symbol in config. End of config would look then like this:

# ... skipped lines
  /usr/bin/kvm rmix,
  /usr/local/bin/qemu-2.12.1/x86_64-softmmu/qemu-system-x86_64 rmix,
}

Probably you will also need to add same apparmor permissions for qemu in /etc/apparmor.d/abstractions/libvirt-qemu:

  /usr/bin/kvm rmix,
  /usr/local/bin/qemu-2.12.1/x86_64-softmmu/qemu-system-x86_64 rmix,

You can reload apparmor rulesets using sudo systemctl reload apparmor. Apparmor rules syntax described, for example, here.

Improve this answer
0

@alexcloud2 is the best answer. I had to modify the apparmor config line a little (probably due to recent software changes.) In usr.sbin.libvirtd I added the line:

/usr/local/bin/* PUx,
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.