apparmor denies VM startup when image is network mounted

[Kevin Otte]

=========================================
SRU Justification
Impact: cannot start vms on nfs mounted disk images
Testcase: set up libvirt managed nfs mount, try to start a vm on it.
Fix: add 'network ipv6' permission to virt-aa-helper's apparmor policy.
Regression potential: this only adds permission to use 'ipv6', alongside the
  existing support for 'ipv4'. There should be no regressions.
=========================================

If I attempt to start a VM with one of its disk images on a libvirt managed NFS mount, it fails:

Oct 30 15:30:56 athens kernel: [545232.917662] audit: type=1400 audit(1446233456.718:81): apparmor="DENIED" operation="sendmsg" profile="/usr/lib/libvirt/virt-aa-helper" pid=13760 comm="virt-aa-helper" laddr=fd60:e0:a0f4:121::8 lport=757 faddr=fd60:e0:a0f4:121::4 fport=2049 family="inet6" sock_type="stream" protocol=6

[Serge Hallyn (serge-hallyn)]

Thanks for reporting this bug.

Can you show the xml for the libvirt managed nfs storage and for the VM?

The virt-aa-helper policy has

  # needed for when disk is on a network filesystem
  network inet,

Which I suspect should prevent this from happening, so I will target this at apparmor.

[Christian Boltz (cboltz)]

The log message says family="inet6" so you'll need "network inet6 stream," (inet != inet6 ;-)

"stream" is an optional restriction - I'd recommend to add it (also to the existing "network inet," rule, assuming that only "stream" is needed) to avoid superfluous permissions.

[Kevin Otte (nivex)]

Ah ha! I was looking in the abstractions.d for the actual VM definitions. I hadn't thought to look up a level for the virt-aa-helper definition.

Sure enough, adding "network inet6," just below the "network inet," and restarting the libvirt-bin service caused the VM to be able to start.

[Kevin Otte (nivex)]

Now this is bizarre. The first start of the VM after restarting libvirt-bin succeeds. Once I shut down the VM and try to start it again, I get the same DENIED message in syslog.

[Jamie Strandboge (jdstrand)]

Kevin, be sure that you ran 'sudo apparmor_parser -r /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper' for you change to take affect in the policy.

[Jamie Strandboge (jdstrand)]

As Christian mentioned, just need to adjust the virt-aa-helper policy. Removing the apparmor task.

[Kevin Otte (nivex)]

The apparmor_parser ... command did the trick.
Just need to put the "network inet6," in the package for the next release then?

[Launchpad Janitor (janitor)]

This bug was fixed in the package libvirt - 1.2.16-2ubuntu12

---------------
libvirt (1.2.16-2ubuntu12) xenial; urgency=medium

  * virt-aa-helper apparmor policy: add 'network inet6' (LP: #1511830)

 -- Serge Hallyn <email address hidden> Mon, 02 Nov 2015 11:49:56 -0600

[Brian Murray (brian-murray)]

Hello Kevin, or anyone else affected,

Accepted libvirt into wily-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libvirt/1.2.16-2ubuntu11.15.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Brian Murray (brian-murray)]

Hello Kevin, or anyone else affected,

Accepted libvirt into vivid-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libvirt/1.2.12-0ubuntu14.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Kevin Otte (nivex)]

Apologies for the delay in getting the test done.

Test procedure:
- Enable proposed per instructions
- Update packages
# apt-get -t wily-proposed install libvirt-bin
...
Setting up libvirt0 (1.2.16-2ubuntu11.15.10.1) ...
Setting up libvirt-bin (1.2.16-2ubuntu11.15.10.1) ...
...
- Reload apparmor profile
# apparmor_parser -r /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper
- Bring test VM up and down a couple times to make sure all is right

It looks as though this fix is working correctly.

[Sebastien Bacher (seb128)]

thanks for testing!

[Launchpad Janitor (janitor)]

This bug was fixed in the package libvirt - 1.2.12-0ubuntu14.3

---------------
libvirt (1.2.12-0ubuntu14.3) vivid; urgency=medium

  * virt-aa-helper apparmor policy: add 'network inet6' (LP: #1511830)

 -- Serge Hallyn <email address hidden> Wed, 04 Nov 2015 11:23:08 -0600

[Chris J Arges (arges)]

The verification of the Stable Release Update for libvirt has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libvirt - 1.2.16-2ubuntu11.15.10.1

---------------
libvirt (1.2.16-2ubuntu11.15.10.1) wily; urgency=medium

  * virt-aa-helper apparmor policy: add 'network inet6' (LP: #1511830)

 -- Serge Hallyn <email address hidden> Wed, 04 Nov 2015 11:17:20 -0600

[Brian Murray (brian-murray)]

Hello Kevin, or anyone else affected,

Accepted libvirt into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libvirt/1.2.2-0ubuntu13.1.18 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Adam Conrad (adconrad)]

Hello Kevin, or anyone else affected,

Accepted libvirt into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libvirt/1.2.2-0ubuntu13.1.19 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Ubuntu Foundations Team Bug Bot (crichton)]

The fix for this bug has been awaiting testing feedback in the -proposed repository for trusty for more than 90 days. Please test this fix and update the bug appropriately with the results. In the event that the fix for this bug is still not verified 15 days from now, the package will be removed from the -proposed repository.

[Martin Pitt (pitti)]

The version of libvirt in the proposed pocket of Trusty that was purported to fix this bug report has been removed because the bugs that were to be fixed by the upload were not verified in a timely (105 days) fashion.