apparmor prevents libvirt from running pygrub
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
libvirt (Ubuntu) |
Fix Released
|
High
|
Stefan Bader | ||
Trusty |
Fix Released
|
High
|
Unassigned |
Bug Description
On Ubuntu 14.04, while trying to run a VM using Xen + Libvirt I am not able to boot it, because apparmor prevents libivrt from running pygrub:
type=1400 audit(140180385
Setting libvirtd to complain only workarounds the issue.
The installed versions are:
ii apparmor 2.8.95~
ii libvirt-bin 1.2.2-0ubuntu13.1 amd64 programs for the libvirt libr
SRU Justification (for Trusty):
Impact: Apparmor prevents execution of pygrub from libvirtd / libxl. This prevents Xen PV guests being launched through libvirt.
Fix: Simple addition to the apparmor rules to allow execution of pygrub.
Testcase: Trying to launch a PV guest from libvirt (definition has bootloader set to pygrub and is of type linux) will fail. It succeeds with the change.
Changed in libvirt (Ubuntu): | |
assignee: | nobody → Stefan Bader (smb) |
importance: | Undecided → High |
tags: | added: patch |
description: | updated |
OK, this should not be hard to change. IIRC libvirt ships its own apparmor rules in Ubuntu. Just need to add pygrub. Must admit I have not looked into Xen PV guests started through libvirt. It used to be even more pain while using the xm toolstack. But that should not prevent us from improving the situation.
I would prepare the change in Utopic and then we could SRU it back into Trusty.