apparmor=DENIED operation=open parent=3343 profile=/usr/lib/libvirt/virt-aa-helper

[C de-Avillez]

Running on daily ISO 20100913, with Eucalyptus 2.0+brz1239-0ubuntu2. All instances fail to start, and I see this message all around.

ProblemType: Bug
DistroRelease: Ubuntu 10.10
Package: libvirt-bin 0.8.3-1ubuntu9
ProcVersionSignature: Ubuntu 2.6.35-20.29-server 2.6.35.4
Uname: Linux 2.6.35-20-server x86_64
Architecture: amd64
Date: Mon Sep 13 16:07:22 2010
ProcEnviron:
 LC_TIME=en_DK.utf8
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: libvirt

[Jamie Strandboge (jdstrand)]

Here is an example message:
Sep 13 15:57:29 marula kernel: [ 7535.484814] type=1400 audit(1284407849.038:878): apparmor="DENIED" operation="open" parent=3346 profile="/usr/lib/libvirt/virt-aa-helper" name="/var/lib/eucalyptus/instances/admin/i-35280636/loader" pid=29440 comm="virt-aa-helper" requested_mask="r" denied_mask="r" fsuid=0 ouid=105

We currently only allow the following in /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper:
  /var/lib/eucalyptus/instances/**/disk* r,

What is /var/lib/eucalyptus/instances/admin/i-35280636/loader? Can you also attach the domain XML for an instance that fails to start?

[C de-Avillez (hggdh2)]

Sorry, Jamie, should have really read the messages... should have seen it.

loader is a new option, implemented by Scott Moser, to allow arbitrary kernels to load. I will grab the XML.

[C de-Avillez (hggdh2)]

Ugh!

I am in the middle of a new install, so it will be a while... If it helps any, here's the aa-helper-generated .files (when I set aa-helper to COMPLAIN mode):

#
# This profile is for the domain whose UUID matches this file.
#

#include <tunables/global>

/etc/apparmour.d/libvirt/ libvirt-ff58f570-9915-eaa8-4fa6-3cba2a827850:

profile libvirt-ff58f570-9915-eaa8-4fa6-3cba2a827850 {
  #include <abstractions/libvirt-qemu>
  #include <libvirt/libvirt-ff58f570-9915-eaa8-4fa6-3cba2a827850.files>

}

/etc/apparmor.d/libvirt/ libvirt-ff58f570-9915-eaa8-4fa6-3cba2a827850.files:

# DO NOT EDIT THIS FILE DIRECTLY. IT IS MANAGED BY LIBVIRT.
  "/var/log/libvirt/**/i-3F170794.log" w,
  "/var/lib/libvirt/**/i-3F170794.monitor" rw,
  "/var/run/libvirt/**/i-3F170794.pid" rwk,
  "/var/lib/eucalyptus/instances/admin/i-3F170794/loader" rw,
  "/var/lib/eucalyptus/instances/admin/i-3F170794/disk" rw,
  "/var/lib/eucalyptus/instances/admin/i-3F170794/console.log" rw,

[Jamie Strandboge (jdstrand)]

A failure of virt-aa-helper to access a file is not necessarily fatal, as can be seen from /etc/apparmor.d/libvirt/libvirt-ff58f570-9915-eaa8-4fa6-3cba2a827850.files -- it added it to the profile just fine. While this certainly needs to be fixed in the AppArmor profile (to avoid confusion), the failure to start is something else. I've examined the kern.log and I don't see any AppArmor denials that would cause the guest to not start.

[Jamie Strandboge (jdstrand)]

Based on the title of this bug, I am going to triage the virt-aa-helper denial bug as Low and if you find what is causing eucalyptus to fail to start the VMs, a new bug should perhaps be filed.

[Dave Walker (davewalker)]

In regards to this potentially causing eucalyptus to fail, I was not able to reproduce this.

[Jamie Strandboge (jdstrand)]

0.8.3-1ubuntu10 uploaded to fix this.