virt-aa-helper fails with host os type is x86_64 and guest arch='i686'

Bug #448671 reported by Sheldon Hearn
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
libvirt (Ubuntu)
Fix Released
Medium
Jamie Strandboge
Karmic
Fix Released
Medium
Jamie Strandboge

Bug Description

Binary package hint: apparmor

We set up a new KVM server and thought we'd try Ubuntu 9.10 Beta amd64.

While trying to create a new kvm virtual machine with virsh create, we received the following error on stderr:

# virsh create manage6.hetzner.africa.xml
Connecting to uri: qemu:///system
error: Failed to create domain from manage6.hetzner.africa.xml
error: could not remove profile for 'libvirt-fc18ccb7-fcd5-9847-724b-7a95a4020899'

In /var/log/syslog, we found:

Oct 7 11:18:18 manage0 kernel: [ 1174.735787] type=1505 audit(1254907098.103:22): operation="profile_load" pid=2976 name=/usr/sbin/libvirtd
Oct 7 11:18:18 manage0 kernel: [ 1174.770796] type=1505 audit(1254907098.139:23): operation="profile_load" pid=2978 name=/usr/bin/virt-aa-helper
Oct 7 15:23:59 manage0 libvirtd: 15:23:59.260: error : virSecurityReportError:108 : error calling aa_change_profile()
Oct 7 15:23:59 manage0 libvirtd: 15:23:59.260: error : qemudSecurityHook:1790 : internal error Failed to set security label
Oct 7 15:23:59 manage0 libvirtd: 15:23:59.261: error : virExecDaemonize:678 : internal error Intermediate daemon process exited with status 1.
Oct 7 15:23:59 manage0 kernel: [ 641.172840] tun: Universal TUN/TAP device driver, 1.6
Oct 7 15:23:59 manage0 kernel: [ 641.172843] tun: (C) 1999-2004 Max Krasnyansky <email address hidden>
Oct 7 15:23:59 manage0 kernel: [ 641.173835] device vnet0 entered promiscuous mode
Oct 7 15:23:59 manage0 kernel: [ 641.174924] br0: port 2(vnet0) entering forwarding state
Oct 7 15:23:59 manage0 kernel: [ 641.175946] __ratelimit: 42 callbacks suppressed
Oct 7 15:23:59 manage0 kernel: [ 641.175949] type=1503 audit(1254921839.254:26): operation="change_profile" info="profile not found" error=-2 pid=2159 parent=1835 profile="/usr/sbin/libvirtd" name="libvirt-29112815-1900-9027-26b3-19a1f9126658" name2="default"
Oct 7 15:23:59 manage0 libvirtd: 15:23:59.374: error : qemudReadLogOutput:816 : internal error Process exited while reading console log output
Oct 7 15:23:59 manage0 libvirtd: 15:23:59.374: error : qemudWaitForMonitor:1103 : internal error unable to start guest: libvir: Security Labeling error : error calling aa_change_profile()#012libvir: QEMU error : internal error Failed to set security label#012
Oct 7 15:23:59 manage0 libvirtd: 15:23:59.378: error : virRun:833 : internal error '/usr/bin/virt-aa-helper -R -u libvirt-29112815-1900-9027-26b3-19a1f9126658' exited with non-zero status 1 and signal 0: virt-aa-helper: error: profile does not exist#012
Oct 7 15:23:59 manage0 libvirtd: 15:23:59.378: error : virSecurityReportError:108 : could not remove profile for 'libvirt-29112815-1900-9027-26b3-19a1f9126658'
Oct 7 15:24:04 manage0 libvirtd: 15:24:04.531: error : virSecurityReportError:108 : error calling aa_change_profile()
Oct 7 15:24:04 manage0 libvirtd: 15:24:04.531: error : qemudSecurityHook:1790 : internal error Failed to set security label
Oct 7 15:24:04 manage0 libvirtd: 15:24:04.532: error : virExecDaemonize:678 : internal error Intermediate daemon process exited with status 1.

The same XML file, image and command-line invocation work on Ubuntu 9.04 x86, which is what we rolled back to, pretty much immediately. So if it works for you, assume we got something wrong and close the bug. But it's probably worth someone confirming that 9.10 supports libvirt+KVM. :-)

Related branches

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Thank you for using Ubuntu and taking the time to report a bug. What version of libvirt are you using? Can you also attach the xml file?

affects: apparmor (Ubuntu) → libvirt (Ubuntu)
Changed in libvirt (Ubuntu):
assignee: nobody → Jamie Strandboge (jdstrand)
status: New → Incomplete
Revision history for this message
Sheldon Hearn (sheldonh) wrote : Re: [Bug 448671] Re: apparmor breaks kvm

On Sun, 2009-10-11 at 18:01 +0000, Jamie Strandboge wrote:
> Thank you for using Ubuntu and taking the time to report a bug. What
> version of libvirt are you using? Can you also attach the xml file?

Regrettably, I can't provide the version, because the host was
reinstalled with 9.04 as soon as we realized that there was a regression
that affected the role of the host.

I'm pretty sure the version number ended in "ubuntu10", because I saw a
promising (but eventually disappointing) changelog entry for "ubuntu8"
while trying to work around the problem.

XML file attached (with the hostname changed to protect the innocent).

Sorry I couldn't be more helpful.

Ciao,
Sheldon.

Changed in libvirt (Ubuntu):
importance: Undecided → Medium
milestone: none → ubuntu-9.10
status: Incomplete → Confirmed
summary: - apparmor breaks kvm
+ virt-aa-helper fails with type hvm and arch='i686'
tags: added: regression-potential
Changed in libvirt (Ubuntu Karmic):
status: Confirmed → Triaged
Revision history for this message
Sheldon Hearn (sheldonh) wrote : Re: virt-aa-helper fails with type hvm and arch='i686'

Can you suggest a work-around? I'm keen to press on with 9.10, so that I get the fast snapshot support in kvm86.

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

You can disable apparmor for libvirt until I upload the fix (I am working on it now). See /usr/share/doc/libvirt-bin/README.Debian.gz for details.

Changed in libvirt (Ubuntu Karmic):
status: Triaged → In Progress
summary: - virt-aa-helper fails with type hvm and arch='i686'
+ virt-aa-helper fails with host os type is x86_64 and guest arch='i686'
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package libvirt - 0.7.0-1ubuntu11

---------------
libvirt (0.7.0-1ubuntu11) karmic; urgency=low

  * debian/patches/9091-apparmor.patch:
    - src/virt-aa-helper.c: update to parse XML for guest's architecture and
      os.type rather than just trying to make something up.
    - tests/virt-aa-helper-test: add some tests for the above and fix another
      test
    - LP: #448671

 -- Jamie Strandboge <email address hidden> Wed, 14 Oct 2009 14:55:20 -0500

Changed in libvirt (Ubuntu Karmic):
status: In Progress → Fix Released
Revision history for this message
brane (brane-apache) wrote :

I just encountered the same issue.
The problem persists in Karmic Beta with
   libvirt0 0.7.0-1ubuntu13
   apparmor 2.3.1+1403-0ubuntu27

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Are you sure it is the same issue? There are several bugs open against virt-manager. Please open a new bug using 'ubuntu-bug libvirt-bin'.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.