libvirtd: apparmor DENIED for /etc/ssl/openssl.cnf

[Knickers Brown]

Description:

When I try to use virt-manager to create a new qemu-system-x86_64 VM, it fails and the journal shows an apparmor DENIED for /etc/ssl/openssl.cnf message.

Reproducing:

It's pretty implicit that trying to create a new VM will reproduce this.
It happens 100% of the time.

Expected:

If I try to create a new VM using virt-manager, I will get a new, working VM.

Actual:

Everything about the VM creation looks OK until the VM boots and then the VM BIOS shows that the BIOS cannot open a disk or ISO or something like that.

Log messages:

Jun 20 22:00:26 coyote~ audit[67219]: AVC apparmor="DENIED" operation="open" class="file" profile="libvirt-01941a15-9df3-4e69-bdce-8ea2db714e81" name="/etc/ssl/openssl.cnf" pid=67219 comm="qemu-system-x86" requested_mask="r" denied_mask="r" fsuid=64055 ouid=0

Jun 20 22:00:26 coyote kernel: audit: type=1400 audit(1687312826.197:131): apparmor="DENIED" operation="open" class="file" profile="libvirt-01941a15-9df3-4e69-bdce-8ea2db714e81" name="/etc/ssl/openssl.cnf" pid=67219 comm="qemu-system-x86" requested_mask="r" denied_mask="r" fsuid=64055 ouid=0

ProblemType: Bug
DistroRelease: Ubuntu 23.10
Package: libvirt-daemon-system 9.0.0-2ubuntu2
ProcVersionSignature: Ubuntu 6.2.0-23.23-generic 6.2.12
Uname: Linux 6.2.0-23-generic x86_64
NonfreeKernelModules: zfs zunicode zavl icp zcommon znvpair
ApportVersion: 2.26.1-0ubuntu3
Architecture: amd64
CasperMD5CheckResult: pass
Date: Tue Jun 20 23:01:34 2023
InstallationDate: Installed on 2022-10-09 (254 days ago)
InstallationMedia: Ubuntu 22.10 "Kinetic Kudu" - Daily amd64 (20221008)
ProcEnviron:
 LANG=en_US.UTF-8
 PATH=(custom, no user)
 SHELL=/bin/bash
 TERM=xterm-256color
SourcePackage: libvirt
UpgradeStatus: Upgraded to mantic on 2023-06-20 (0 days ago)

[Paride Legovini (paride)]

Hello and thanks for running the Ubuntu development release!

I can confirm this happens on my Mantic system, even if the error doesn't seem to have any immediately visible adverse effect. The linked Debian bug also mentions the VM pausing after some time, but I'm not experiencing this behavior, which seems unrelated from the AppArmor issue.

It is likely that the profiles need updating to allow access to openssl.cnf.

[Christian Ehrhardt  (paelzer)]

Reminder for anyone fixing this, do not try to come up with ssl rules yourself, that would usually be covered by:
  #include <abstractions/openssl>

@Acceptable Name
The default behavior of spawning a guest does not trigger this, did you do any config in regard to libvirt or guest config to use some encryption triggering this? Essentially it would help to describe all steps you do from 1. clean system -> x. issue occurs

[Christian Ehrhardt  (paelzer)]

Note:
we added it quite a while ago to
  src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in
that is for the parser when a guest is started. But the reported issue is from the guest itself as libvirt-01941a15-9df3-4e69-bdce-8ea2db714e81 indicates a guest profile.

[Knickers Brown (metta-crawler)]

I think my issue is due to trying to install from a defective (or incompatible) ISO.

I tried installing it from an Arch Linux VM host and it failed the same way.

[Knickers Brown (metta-crawler)]

In case it helps anyone, the ISO is rlxos-desktop-x86_64.iso from https://rlxos.dev/

[Knickers Brown (metta-crawler)]

It's always one more thing, sigh. The reason that it got "No bootable device" is that the ISO is UEFI-only. Trying in UEFI mode had other issues.

Jun 23 05:21:05 coyote audit[49463]: AVC apparmor="DENIED" operation="open" class="file" profile="libvirt-b9e76fae-f449-44bc-8958-88843dacf702" name="/etc/ssl/openssl.cnf" pid=49463 comm="qemu-system
-x86" requested_mask="r" denied_mask="r" fsuid=64055 ouid=0
Jun 23 05:21:05 coyote kernel: audit: type=1400 audit(1687512065.224:89): apparmor="DENIED" operation="open" class="file" profile="libvirt-b9e76fae-f449-44bc-8958-88843dacf702" name="/etc/ssl/openssl
.cnf" pid=49463 comm="qemu-system-x86" requested_mask="r" denied_mask="r" fsuid=64055 ouid=0
Jun 23 05:21:07 coyote kernel: nouveau 0000:01:00.0: DRM: Moving pinned object 0000000078c07ada!
Jun 23 05:21:07 coyote kernel: BUG: kernel NULL pointer dereference, address: 000000000000000c
Jun 23 05:21:07 coyote kernel: #PF: supervisor read access in kernel mode
Jun 23 05:21:09 coyote kernel: #PF: error_code(0x0000) - not-present page
Jun 23 05:21:09 coyote kernel: PGD 800000026ad54067 P4D 800000026ad54067 PUD 26ad53067 PMD 0
Jun 23 05:21:10 coyote kernel: Oops: 0000 [#1] PREEMPT SMP PTI
Jun 23 05:21:10 coyote kernel: CPU: 4 PID: 46364 Comm: virt-manager Tainted: P O 6.3.0-7-generic #7-Ubuntu
Jun 23 05:21:10 coyote kernel: Hardware name: Dell Inc. Precision M4600/08V9YG, BIOS A19 09/14/2018
Jun 23 05:21:10 coyote kernel: RIP: 0010:nouveau_gem_prime_get_sg_table+0x11/0x30 [nouveau]
Jun 23 05:21:10 coyote kernel: Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 8b 87 78 01 00 00 48 8b 7f 08 <8b> 50 0c 48 8b 30 48 89 e5 e8 c1 27 be ff 5d 31 d2 31 f6 31 ff c3
Jun 23 05:21:10 coyote kernel: RSP: 0018:ffffac4a2e4f3810 EFLAGS: 00010282
Jun 23 05:21:10 coyote kernel: RAX: 0000000000000000 RBX: ffff945451bf1240 RCX: 0000000000000000
Jun 23 05:21:10 coyote kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9453dfdef000
Jun 23 05:21:10 coyote kernel: RBP: ffffac4a2e4f3838 R08: 0000000000000a81 R09: 0000000000000000
Jun 23 05:21:10 coyote kernel: R10: ffff945444ad6bd8 R11: 0000000000000000 R12: 0000000000000000
Jun 23 05:21:10 coyote kernel: R13: ffff945451bf1240 R14: 0000000000000a81 R15: ffffac4a2e4f3a10
Jun 23 05:21:10 coyote kernel: FS: 00007f6bf5c32040(0000) GS:ffff945acdb00000(0000) knlGS:0000000000000000
Jun 23 05:21:10 coyote kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Jun 23 05:21:10 coyote kernel: CR2: 000000000000000c CR3: 0000000252f34004 CR4: 00000000000626e0
Jun 23 05:21:10 coyote kernel: Call Trace:
Jun 23 05:21:10 coyote kernel: <TASK>
Jun 23 05:21:10 coyote kernel: ? show_regs+0x6d/0x80
Jun 23 05:21:10 coyote kernel: ? __die+0x24/0x80
Jun 23 05:21:10 coyote kernel: ? page_fault_oops+0x99/0x1b0
Jun 23 05:21:10 coyote kernel: ? kernelmode_fixup_or_oops+0xb2/0x140
Jun 23 05:21:10 coyote kernel: ? __bad_area_nosemaphore+0x1a5/0x2c0
Jun 23 05:21:10 coyote kernel: ? mt_find+0xee/0x250
Jun 23 05:21:10 coyote kernel: ? __bad_area+0x54/0x90
Jun 23 05:21:10 coyote kernel: ? bad_area+0x16/0x30
Jun 23 05:21:10 coyote kernel: ? do_user_addr_fault+0x3db/0x720...

[Sergio Durigan Junior (sergiodj)]

Argh, sorry about the last comment, I hit Submit too soon.

[Andreas Hasenack (ahasenack)]

libvirt in kinetic has the openssl abstraction included in the virt-aa-helper profile, as does lunar. Here I only see the DENIED log for the /etc/gnutls/config file:

[qui jul 13 03:05:45 2023] audit: type=1400 audit(1688507858.447:3964): apparmor="DENIED" operation="open" class="file" profile="virt-aa-helper" name="/etc/gnutls/config" pid=1009657 comm="virt-aa-helper" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

I have created /etc/gnutls/config manually to experiment with crypto settings in gnutls: that file is not shipped in ubuntu, that's why we are not seeing it in logs at large. This is worth a bug, but separate from this issue here.

The dynamic profile created by libvirt for the VM indeed does not seem to include the openssl abstraction, but I'm not getting the DENIED log entry for the openssl config file either. Something must be different in the VM configuration that @metta-crawler is using.

@metta-crawler, once you have a VM up that is triggering this apparmor DENIED error for the openssl config file, could you please dump it to xml and attach that to this bug?

The command would be this:

virsh dumpxml <vmname> > vm.xml

I don't *think* anything private will be in that file, but please check before attaching.