cloudarchive-icehouse: virt-aa-helper: error: apparmor_parser exited with error

[Daniel Gollub]

With Ubuntu 12.04 Precise and Cloudarchive Icehouse libvirt 1.2.2-0ubuntu11~cloud0 is not able to spawn a VM instance due to incompatible apparmor profile with apparmor 2.7.102-0ubuntu3.9 (precise's version):

2014-04-11 10:27:10.997+0000: 8616: error : virCommandWait:2399 : internal error: Child process (/usr/lib/libvirt/virt-aa-helper -p 0 -c -u libvirt-d18f1dff-e275-4fcc-b712-2caf530aed74) unexpected exit status 1: virt-aa-helper: error: apparmor_parser exited with error

Also starting apparmor with 1.2.2-0ubuntu11~cloud0 results in a apparmor_parser error:

root@compute1:~# /etc/init.d/apparmor start
 * Starting AppArmor profiles
AppArmor parser error for /etc/apparmor.d/usr.sbin.libvirtd in /etc/apparmor.d/usr.sbin.libvirtd at line 37: syntax error, unexpected TOK_CONDID, expecting TOK_MODE

When OpenStack/Nova/libvirt tries to spawn an instance it fails due to following apparmor_parser issue:

/etc/apparmor.d/libvirt/libvirt-3138433d-a124-40dd-9630-68a9e227b0bd
in /etc/apparmor.d/abstractions/libvirt-qemu at line 143: syntax error, unexpected TOK_OPENPAREN, expecting TOK_MODE

New offending profile entries for apparmor 2.7.102-0ubuntu3.9 seems to be:

/etc/apparmor.d/usr.sbin.libvirtd:
  dbus bus=system,
  signal,
  ptrace,

/etc/apparmor.d/abstractions/libvirt-qemu:
  signal (receive) peer=/usr/sbin/libvirtd,
  ptrace (tracedby) peer=/usr/sbin/libvirtd,

Reverting those entries allows again to spawn a VM instance with OpenStack Icehouse RC2 from Cloudarchive-Ichouse on Ubuntu 12.04 Precise.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Daniel Gollub (d-gollub)]

Not quite sure if this can be fixed by requiring apparmor (>= 2.8.95~2430-0ubuntu4) for libvirt in Ubuntu Precise 12.04 - which does not hold such a recent version of apparmor.

[Daniel Gollub (d-gollub)]

Previous comment was referring with regards marking this report as duplicate of "Bug #1304167: syntax error, trusty beta-2 cloud image. "

[Serge Hallyn (serge-hallyn)]

In that case either apparmor will need to be added to the archive, or libvirt in the archive will need to carry a patch on top of the trusty version, since the apparmor policy language does not yet support versioning.

[Jamie Strandboge (jdstrand)]

I advise against backporting apparmor and suggest you simply adjust debian/rules to filter out the offending rules or to ship a different profile.

[Serge Hallyn (serge-hallyn)]

This should be fixed as of 1.2.8-0ubuntu13