solves a problem. After running above command, I get following:
/etc/apparmor.d/libvirt/libvirt-ed29623f-5006-4b04-9d71-ac46267ef9fc.files:
# DO NOT EDIT THIS FILE DIRECTLY. IT IS MANAGED BY LIBVIRT.
"/var/log/libvirt/**/libreoffice-build-ubuntu-vagrant_default_1402187682182_36451.log" w,
"/var/lib/libvirt/**/libreoffice-build-ubuntu-vagrant_default_1402187682182_36451.monitor" rw,
"/var/run/libvirt/**/libreoffice-build-ubuntu-vagrant_default_1402187682182_36451.pid" rwk,
"/run/libvirt/**/libreoffice-build-ubuntu-vagrant_default_1402187682182_36451.pid" rwk,
"/var/run/libvirt/**/*.tunnelmigrate.dest.libreoffice-build-ubuntu-vagrant_default_1402187682182_36451" rw,
"/run/libvirt/**/*.tunnelmigrate.dest.libreoffice-build-ubuntu-vagrant_default_1402187682182_36451" rw,
"/home/miurahr/.vagrant.d/tmp/storage-pool/box-disk1-1402187682.img" rw,
"/home/miurahr/.vagrant.d/boxes/trusty/0/kvm/box-disk1.img" r,
# don't audit writes to readonly files
deny "/home/miurahr/.vagrant.d/boxes/trusty/0/kvm/box-disk1.img" w,
"/home/miurahr/Projects/libreoffice/libreoffice-build-ubuntu-vagrant/**" rw,
"/home/miurahr/Projects/libreoffice/libreoffice-build-ubuntu-vagrant/" r,
virt-aa-helper generates policy rule and reloaded properly.
The observation tell us a policy in /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper:
@{HOME}/** r,
/**.img r,
not working and fails update libvirt policy.
Affected on kernel 3.13.0-21.43 and later on Trusty.
Because 3.13.0-21.43 revert #1236455 fix.
linux (3.13.0-21.43) trusty; urgency=low
[ John Johansen ]
* Revert "SAUCE: Add config option to disable new apparmor 3 semantics"
* Revert "SAUCE: apparmor: fix uninitialized lsm_audit membe"
* Revert "SAUCE: (no-up) apparmor: Fix tasks not subject to, reloaded
policy"
* Revert "SAUCE: apparmor: allocate path lookup buffers during init"
* Revert "SAUCE: apparmor: fix unix domain sockets to be mediated on
connection"
* Revert "SAUCE: (no-up) apparmor: Sync to apparmor 3 - alpha 4 snapshot"
* SAUCE: (no-up) apparmor: Sync to apparmor3 - alpha6 snapshot
- LP: #1298611
linux (3.13.0-2.17) trusty; urgency=low
[ John Johansen ]
* SAUCE: (no-up) apparmor: Sync to apparmor 3 - alpha 4 snapshot
* SAUCE: apparmor: fix unix domain sockets to be mediated on connection
- LP: #1208988
* SAUCE: apparmor: allocate path lookup buffers during init
- LP: #1208988
* SAUCE: (no-up) apparmor: Fix tasks not subject to, reloaded policy
- LP: #1236455
I've observed a failing of AppArmor policy update with libvirt, qemu and vagrant.
vagrant ask libvirt to create vmimage backing with other qcow2 image that located in another directory.
virt-aa-helper should add it but fails.
/etc/apparmor. d/libvirt/ libvirt- ef734772- 4f19-4d0a- 994d-a7398d1783 78.files: log/libvirt/ **/libreoffice- build-ubuntu- vagrant_ default_ 1402186805388_ 83426.log" w, lib/libvirt/ **/libreoffice- build-ubuntu- vagrant_ default_ 1402186805388_ 83426.monitor" rw, run/libvirt/ **/libreoffice- build-ubuntu- vagrant_ default_ 1402186805388_ 83426.pid" rwk, libvirt/ **/libreoffice- build-ubuntu- vagrant_ default_ 1402186805388_ 83426.pid" rwk, run/libvirt/ **/*.tunnelmigr ate.dest. libreoffice- build-ubuntu- vagrant_ default_ 1402186805388_ 83426" rw, libvirt/ **/*.tunnelmigr ate.dest. libreoffice- build-ubuntu- vagrant_ default_ 1402186805388_ 83426" rw, miurahr/ .vagrant. d/tmp/storage- pool/box- disk1-140218680 5.img" rw, miurahr/ Projects/ libreoffice/ libreoffice- build-ubuntu- vagrant/ **" rw, miurahr/ Projects/ libreoffice/ libreoffice- build-ubuntu- vagrant/ " r,
# DO NOT EDIT THIS FILE DIRECTLY. IT IS MANAGED BY LIBVIRT.
"/var/
"/var/
"/var/
"/run/
"/var/
"/run/
"/home/
"/home/
"/home/
/var/log/ libivrt/ libvirtd. log: 3.746:81) : apparmor="DENIED" operation="open" profile= "libvirt- 7e96ebdc- d0cc-4c30- 9112-64d5aa9955 c0" name="/ home/miurahr/ .vagrant. d/boxes/ trusty/ 0/kvm/box- disk1.img" pid=19976 comm="qemu- system- x86" requested_mask="r" denied_mask="r" fsuid=118 ouid=118 3.746:82) : apparmor="DENIED" operation="open" profile= "libvirt- 7e96ebdc- d0cc-4c30- 9112-64d5aa9955 c0" name="/ home/miurahr/ .vagrant. d/boxes/ trusty/ 0/kvm/box- disk1.img" pid=19976 comm="qemu- system- x86" requested_mask="r" denied_mask="r" fsuid=118 ouid=118 3.746:83) : apparmor="DENIED" operation="open" profile= "libvirt- 7e96ebdc- d0cc-4c30- 9112-64d5aa9955 c0" name="/ home/miurahr/ .vagrant. d/boxes/ trusty/ 0/kvm/box- disk1.img" pid=19976 comm="qemu- system- x86" requested_mask="r" denied_mask="r" fsuid=118 ouid=118
Jun 8 09:26:13 tuna kernel: [33901.090187] type=1400 audit(140218717
Jun 8 09:26:13 tuna kernel: [33901.090212] type=1400 audit(140218717
Jun 8 09:26:13 tuna kernel: [33901.090251] type=1400 audit(140218717
running
sudo aa-complain /usr/lib/ libvirt/ virt-aa- helper
solves a problem. After running above command, I get following:
/etc/apparmor. d/libvirt/ libvirt- ed29623f- 5006-4b04- 9d71-ac46267ef9 fc.files: log/libvirt/ **/libreoffice- build-ubuntu- vagrant_ default_ 1402187682182_ 36451.log" w, lib/libvirt/ **/libreoffice- build-ubuntu- vagrant_ default_ 1402187682182_ 36451.monitor" rw, run/libvirt/ **/libreoffice- build-ubuntu- vagrant_ default_ 1402187682182_ 36451.pid" rwk, libvirt/ **/libreoffice- build-ubuntu- vagrant_ default_ 1402187682182_ 36451.pid" rwk, run/libvirt/ **/*.tunnelmigr ate.dest. libreoffice- build-ubuntu- vagrant_ default_ 1402187682182_ 36451" rw, libvirt/ **/*.tunnelmigr ate.dest. libreoffice- build-ubuntu- vagrant_ default_ 1402187682182_ 36451" rw, miurahr/ .vagrant. d/tmp/storage- pool/box- disk1-140218768 2.img" rw, miurahr/ .vagrant. d/boxes/ trusty/ 0/kvm/box- disk1.img" r, miurahr/ .vagrant. d/boxes/ trusty/ 0/kvm/box- disk1.img" w, miurahr/ Projects/ libreoffice/ libreoffice- build-ubuntu- vagrant/ **" rw, miurahr/ Projects/ libreoffice/ libreoffice- build-ubuntu- vagrant/ " r,
# DO NOT EDIT THIS FILE DIRECTLY. IT IS MANAGED BY LIBVIRT.
"/var/
"/var/
"/var/
"/run/
"/var/
"/run/
"/home/
"/home/
# don't audit writes to readonly files
deny "/home/
"/home/
"/home/
virt-aa-helper generates policy rule and reloaded properly.
The observation tell us a policy in /etc/apparmor. d/usr.lib. libvirt. virt-aa- helper:
@{HOME}/** r,
/**.img r,
not working and fails update libvirt policy.
This behavior is same as #1236455.