virsh save doesn't work for vm with hdd image in non-default location, AppArmor-related error

[RussianNeuroMancer]

virsh save does work for vm located in /var/lib/libvirt/images, but doesn't work for vm located for example in /mnt/storage/data/limages
Error message:
~$ LANG=C virsh save owncloud /mnt/storage/data/images/owncloud.dump
error: Failed to save domain owncloud to /mnt/storage/data/images/owncloud.dump
error: внутренняя ошибка: не удалось обновить профиль AppArmor «libvirt-b9f02241-f8a7-4c11-86de-5eccbdff6511»

Translation:
error: internal error: unable to update AppArmor profile «libvirt-b9f02241-f8a7-4c11-86de-5eccbdff6511»

I tried to dumpxml and then define it again from xml, but that doesn't help.
Ubuntu Server 15.10.

[Serge Hallyn (serge-hallyn)]

Thanks for reporting this bug. I can't reproduce it here:

0 ✓ serge@sl ~ $ virsh start docker
Domain docker started
0 ✓ serge@sl ~ $ virsh save docker /mnt/docker.dmp

Domain docker saved to /mnt/docker.dmp

Same happened on a 15.10 host.

Can you append your full xml?

Normally the apparmor profile messages happen when there is a pathname which confuses virt-aa-helper or libvirt.

[RussianNeuroMancer (russianneuromancer)]

This particular VM is removed now (guest moved to nspawn container) but I find xml in host btrfs snapshots.

[Serge Hallyn (serge-hallyn)]

Thanks, nothing looks out of the ordinary there. Just to make sure, does

realpath /mnt/storage/data/images/owncloud.qcow2

show something different than the original path? (I.e. could a path element there be a symlink into one of the restricted paths?)

[RussianNeuroMancer (russianneuromancer)]

> show something different than the original path?
No, only path that represent current image location (inside btrfs snapshot).

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Christian Ehrhardt  (paelzer)]

Sorry this has been dormant for way too long, but I can still not reproduce as Serge couldn't back then. To properly reflect that I'm setting incomplete for now.

You could try to check what /usr/lib/libvirt/virt-aa-helper does with your XML.
Maybe it fails to process it or generates content in your case that libvirt won't accept?

[Launchpad Janitor (janitor)]

[Expired for libvirt (Ubuntu) because there has been no activity for 60 days.]