2 disks:
Oct 15 13:14:07 e libvirtd[612]: internal error: unable to execute QEMU command 'transaction': Could not create file: Permission denied
Oct 15 13:14:08 e libvirtd[612]: Path '/var/lib/libvirt/images/eoan-disk1.snapshot1.qcow' is not accessible: No such file or directory
Oct 15 13:14:08 e libvirtd[612]: Unable to tear down cgroup access on /var/lib/libvirt/images/eoan-disk1.snapshot1.qcow
Oct 15 13:14:08 e libvirtd[612]: internal error: child reported (status=125): unable to set user and group to '0:0' on '/var/lib/libvirt/images/eoan-disk1.snapshot1.qcow': No such file or directory
Oct 15 13:14:08 e libvirtd[612]: Unable to restore security label on /var/lib/libvirt/images/eoan-disk1.snapshot1.qcow
Oct 15 13:14:08 e libvirtd[612]: Path '/var/lib/libvirt/images/eoan-disk2.snapshot1.qcow' is not accessible: No such file or directory
Oct 15 13:14:08 e libvirtd[612]: Unable to tear down cgroup access on /var/lib/libvirt/images/eoan-disk2.snapshot1.qcow
Oct 15 13:14:08 e libvirtd[612]: internal error: child reported (status=125): unable to set user and group to '0:0' on '/var/lib/libvirt/images/eoan-disk2.snapshot1.qcow': No such file or directory
Oct 15 13:14:08 e libvirtd[612]: Unable to restore security label on /var/lib/libvirt/images/eoan-disk2.snapshot1.qcow
One disk:
- no message
- new rule
"/var/lib/libvirt/images/eoan-disk1.snapshot1.qcow" rwk,
This looks like a late call from labelling (comes with rwk by default).
Check what we get with one disk and two disks in GDB:
Num Type Disp Enb Address What
3 breakpoint keep y 0x00007f92474dacd0 in load_profile at ../../../src/security/security_apparmor.c:166
silent
if fn == 0
cont
p fn
end
(gdb) bt
#0 load_profile (profile=0x7f9224049f10 "libvirt-2370eae2-cc9a-493c-b502-d2d64e2ee1d1", def=def@entry=0x7f92380e9190,
fn=0x7f92180be390 "/var/lib/libvirt/images/eoan-disk1.snapshot2.qcow", append=append@entry=false, mgr=<optimized out>) at ../../../src/security/security_apparmor.c:166
#1 0x00007f92474db08b in AppArmorSetSecurityImageLabel (mgr=<optimized out>, def=0x7f92380e9190, src=0x7f92181f9930, flags=<optimized out>) at ../../../src/security/security_apparmor.c:830
#2 0x00007f92474d1ebe in virSecurityManagerSetImageLabel (mgr=0x7f91f401d0b0, vm=vm@entry=0x7f92380e9190, src=src@entry=0x7f92181f9930, flags=flags@entry=(unknown: 0))
at ../../../src/security/security_manager.c:506
#3 0x00007f92474cd9a9 in virSecurityStackSetImageLabel (mgr=<optimized out>, vm=0x7f92380e9190, src=0x7f92181f9930, flags=(unknown: 0)) at ../../../src/security/security_stack.c:575
#4 0x00007f92474d1ebe in virSecurityManagerSetImageLabel (mgr=0x7f91f401b920, vm=0x7f92380e9190, src=src@entry=0x7f92181f9930, flags=flags@entry=(unknown: 0))
at ../../../src/security/security_manager.c:506
#5 0x00007f923c27a014 in qemuSecuritySetImageLabel (driver=driver@entry=0x7f91f400f880, vm=vm@entry=0x7f92240444b0, src=src@entry=0x7f92181f9930, backingChain=backingChain@entry=false)
at ../../../src/qemu/qemu_security.c:115
#6 0x00007f923c1dccad in qemuDomainStorageSourceAccessModify (driver=0x7f91f400f880, vm=0x7f92240444b0, src=0x7f92181f9930, flags=QEMU_DOMAIN_STORAGE_SOURCE_ACCESS_SKIP_REVOKE)
at ../../../src/qemu/qemu_domain.c:9350
#7 0x00007f923c275473 in qemuDomainSnapshotCreateSingleDiskActive (reuse=false, actions=<optimized out>, dd=0x7f92181f98c0, vm=<optimized out>, driver=0x7f91f400f880)
at ../../../src/qemu/qemu_driver.c:15216
#8 qemuDomainSnapshotCreateDiskActive (asyncJob=QEMU_ASYNC_JOB_SNAPSHOT, flags=144, snap=<optimized out>, vm=<optimized out>, driver=0x7f91f400f880)
at ../../../src/qemu/qemu_driver.c:15269
#9 qemuDomainSnapshotCreateActiveExternal (flags=144, snap=<optimized out>, vm=<optimized out>, driver=0x7f91f400f880) at ../../../src/qemu/qemu_driver.c:15476
#10 qemuDomainSnapshotCreateXML (domain=<optimized out>, xmlDesc=<optimized out>, flags=144) at ../../../src/qemu/qemu_driver.c:15773
#11 0x00007f92475ed698 in virDomainSnapshotCreateXML (domain=domain@entry=0x7f92180f3100,
xmlDesc=0x7f92183119a0 "<domainsnapshot>\n <disks>\n <disk name='vda' snapshot='no'/>\n <disk name='vdb' snapshot='no'/>\n <disk name='vdc' snapshot='external'>\n <source file='/var/lib/libvirt/images/eoan-disk1.sn"..., flags=144) at ../../../src/libvirt-domain-snapshot.c:241
#12 0x0000561722d17ddc in remoteDispatchDomainSnapshotCreateXML (server=0x56172369bed0, msg=0x56172371b300, ret=0x7f921830c9e0, args=0x7f921803a160, rerr=0x7f9241fce9a0,
client=<optimized out>) at ../../../src/remote/remote_daemon_dispatch_stubs.h:11744
#13 remoteDispatchDomainSnapshotCreateXMLHelper (server=0x56172369bed0, client=<optimized out>, msg=0x56172371b300, rerr=0x7f9241fce9a0, args=0x7f921803a160, ret=0x7f921830c9e0)
at ../../../src/remote/remote_daemon_dispatch_stubs.h:11718
#14 0x00007f92474fbcb1 in virNetServerProgramDispatchCall (msg=0x56172371b300, client=0x5617236f00e0, server=0x56172369bed0, prog=0x5617236e5550)
at ../../../src/rpc/virnetserverprogram.c:435
#15 virNetServerProgramDispatch (prog=0x5617236e5550, server=server@entry=0x56172369bed0, client=0x5617236f00e0, msg=0x56172371b300) at ../../../src/rpc/virnetserverprogram.c:302
#16 0x00007f92475022bc in virNetServerProcessMsg (msg=<optimized out>, prog=<optimized out>, client=<optimized out>, srv=0x56172369bed0) at ../../../src/rpc/virnetserver.c:142
#17 virNetServerHandleJob (jobOpaque=<optimized out>, opaque=0x56172369bed0) at ../../../src/rpc/virnetserver.c:163
#18 0x00007f924742860f in virThreadPoolWorker (opaque=opaque@entry=0x56172368a580) at ../../../src/util/virthreadpool.c:163
#19 0x00007f92474278fc in virThreadHelper (data=<optimized out>) at ../../../src/util/virthread.c:206
#20 0x00007f9247299669 in start_thread (arg=<optimized out>) at pthread_create.c:479
#21 0x00007f92471c1323 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
I see those calls for both paths:
Thread 4 "libvirtd" hit Breakpoint 5, load_profile (profile=0x7f9224049f10 "libvirt-2370eae2-cc9a-493c-b502-d2d64e2ee1d1", def=def@entry=0x7f92380e9190,
fn=0x7f9210007be0 "/var/lib/libvirt/images/eoan-disk1.snapshot2.qcow", append=append@entry=false, mgr=<optimized out>) at ../../../src/security/security_apparmor.c:166
166 load_profile(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
$17 = 0x7f9210007be0 "/var/lib/libvirt/images/eoan-disk1.snapshot2.qcow"
(gdb) c
Continuing.
[Detaching after fork from child process 21613]
[Detaching after fork from child process 21616]
logs:
2 disks: libvirt/ images/ eoan-disk1. snapshot1. qcow' is not accessible: No such file or directory libvirt/ images/ eoan-disk1. snapshot1. qcow libvirt/ images/ eoan-disk1. snapshot1. qcow': No such file or directory libvirt/ images/ eoan-disk1. snapshot1. qcow libvirt/ images/ eoan-disk2. snapshot1. qcow' is not accessible: No such file or directory libvirt/ images/ eoan-disk2. snapshot1. qcow libvirt/ images/ eoan-disk2. snapshot1. qcow': No such file or directory libvirt/ images/ eoan-disk2. snapshot1. qcow
Oct 15 13:14:07 e libvirtd[612]: internal error: unable to execute QEMU command 'transaction': Could not create file: Permission denied
Oct 15 13:14:08 e libvirtd[612]: Path '/var/lib/
Oct 15 13:14:08 e libvirtd[612]: Unable to tear down cgroup access on /var/lib/
Oct 15 13:14:08 e libvirtd[612]: internal error: child reported (status=125): unable to set user and group to '0:0' on '/var/lib/
Oct 15 13:14:08 e libvirtd[612]: Unable to restore security label on /var/lib/
Oct 15 13:14:08 e libvirtd[612]: Path '/var/lib/
Oct 15 13:14:08 e libvirtd[612]: Unable to tear down cgroup access on /var/lib/
Oct 15 13:14:08 e libvirtd[612]: internal error: child reported (status=125): unable to set user and group to '0:0' on '/var/lib/
Oct 15 13:14:08 e libvirtd[612]: Unable to restore security label on /var/lib/
One disk: lib/libvirt/ images/ eoan-disk1. snapshot1. qcow" rwk,
- no message
- new rule
"/var/
This looks like a late call from labelling (comes with rwk by default).
Check what we get with one disk and two disks in GDB: ./src/security/ security_ apparmor. c:166
Num Type Disp Enb Address What
3 breakpoint keep y 0x00007f92474dacd0 in load_profile at ../../.
silent
if fn == 0
cont
p fn
end
(gdb) bt 0x7f9224049f10 "libvirt- 2370eae2- cc9a-493c- b502-d2d64e2ee1 d1", def=def@ entry=0x7f92380 e9190, 0x7f92180be390 "/var/lib/ libvirt/ images/ eoan-disk1. snapshot2. qcow", append= append@ entry=false, mgr=<optimized out>) at ../../. ./src/security/ security_ apparmor. c:166 rityImageLabel (mgr=<optimized out>, def=0x7f92380e9190, src=0x7f92181f9930, flags=<optimized out>) at ../../. ./src/security/ security_ apparmor. c:830 gerSetImageLabe l (mgr=0x7f91f401 d0b0, vm=vm@entry= 0x7f92380e9190, src=src@ entry=0x7f92181 f9930, flags=flags@ entry=( unknown: 0)) ./src/security/ security_ manager. c:506 kSetImageLabel (mgr=<optimized out>, vm=0x7f92380e9190, src=0x7f92181f9930, flags=(unknown: 0)) at ../../. ./src/security/ security_ stack.c: 575 gerSetImageLabe l (mgr=0x7f91f401 b920, vm=0x7f92380e9190, src=src@ entry=0x7f92181 f9930, flags=flags@ entry=( unknown: 0)) ./src/security/ security_ manager. c:506 ImageLabel (driver= driver@ entry=0x7f91f40 0f880, vm=vm@entry= 0x7f92240444b0, src=src@ entry=0x7f92181 f9930, backingChain= backingChain@ entry=false) ./src/qemu/ qemu_security. c:115 geSourceAccessM odify (driver= 0x7f91f400f880, vm=0x7f92240444b0, src=0x7f92181f9930, flags=QEMU_ DOMAIN_ STORAGE_ SOURCE_ ACCESS_ SKIP_REVOKE) ./src/qemu/ qemu_domain. c:9350 hotCreateSingle DiskActive (reuse=false, actions=<optimized out>, dd=0x7f92181f98c0, vm=<optimized out>, driver= 0x7f91f400f880) ./src/qemu/ qemu_driver. c:15216 hotCreateDiskAc tive (asyncJob= QEMU_ASYNC_ JOB_SNAPSHOT, flags=144, snap=<optimized out>, vm=<optimized out>, driver= 0x7f91f400f880) ./src/qemu/ qemu_driver. c:15269 hotCreateActive External (flags=144, snap=<optimized out>, vm=<optimized out>, driver= 0x7f91f400f880) at ../../. ./src/qemu/ qemu_driver. c:15476 hotCreateXML (domain=<optimized out>, xmlDesc=<optimized out>, flags=144) at ../../. ./src/qemu/ qemu_driver. c:15773 otCreateXML (domain= domain@ entry=0x7f92180 f3100, 0x7f92183119a0 "<domainsnapshot>\n <disks>\n <disk name='vda' snapshot='no'/>\n <disk name='vdb' snapshot='no'/>\n <disk name='vdc' snapshot= 'external' >\n <source file='/ var/lib/ libvirt/ images/ eoan-disk1. sn"..., flags=144) at ../../. ./src/libvirt- domain- snapshot. c:241 omainSnapshotCr eateXML (server= 0x56172369bed0, msg=0x56172371b300, ret=0x7f921830c9e0, args=0x7f921803 a160, rerr=0x7f9241fc e9a0, <optimized out>) at ../../. ./src/remote/ remote_ daemon_ dispatch_ stubs.h: 11744 omainSnapshotCr eateXMLHelper (server= 0x56172369bed0, client=<optimized out>, msg=0x56172371b300, rerr=0x7f9241fc e9a0, args=0x7f921803 a160, ret=0x7f921830c9e0) ./src/remote/ remote_ daemon_ dispatch_ stubs.h: 11718 gramDispatchCal l (msg=0x56172371 b300, client= 0x5617236f00e0, server= 0x56172369bed0, prog=0x5617236e 5550) ./src/rpc/ virnetserverpro gram.c: 435 gramDispatch (prog=0x5617236 e5550, server= server@ entry=0x5617236 9bed0, client= 0x5617236f00e0, msg=0x56172371b300) at ../../. ./src/rpc/ virnetserverpro gram.c: 302 cessMsg (msg=<optimized out>, prog=<optimized out>, client=<optimized out>, srv=0x56172369bed0) at ../../. ./src/rpc/ virnetserver. c:142 dleJob (jobOpaque= <optimized out>, opaque= 0x56172369bed0) at ../../. ./src/rpc/ virnetserver. c:163 opaque@ entry=0x5617236 8a580) at ../../. ./src/util/ virthreadpool. c:163 ./src/util/ virthread. c:206 create. c:479 unix/sysv/ linux/x86_ 64/clone. S:95
#0 load_profile (profile=
fn=
#1 0x00007f92474db08b in AppArmorSetSecu
#2 0x00007f92474d1ebe in virSecurityMana
at ../../.
#3 0x00007f92474cd9a9 in virSecurityStac
#4 0x00007f92474d1ebe in virSecurityMana
at ../../.
#5 0x00007f923c27a014 in qemuSecuritySet
at ../../.
#6 0x00007f923c1dccad in qemuDomainStora
at ../../.
#7 0x00007f923c275473 in qemuDomainSnaps
at ../../.
#8 qemuDomainSnaps
at ../../.
#9 qemuDomainSnaps
#10 qemuDomainSnaps
#11 0x00007f92475ed698 in virDomainSnapsh
xmlDesc=
#12 0x0000561722d17ddc in remoteDispatchD
client=
#13 remoteDispatchD
at ../../.
#14 0x00007f92474fbcb1 in virNetServerPro
at ../../.
#15 virNetServerPro
#16 0x00007f92475022bc in virNetServerPro
#17 virNetServerHan
#18 0x00007f924742860f in virThreadPoolWorker (opaque=
#19 0x00007f92474278fc in virThreadHelper (data=<optimized out>) at ../../.
#20 0x00007f9247299669 in start_thread (arg=<optimized out>) at pthread_
#21 0x00007f92471c1323 in clone () at ../sysdeps/
This effectively calls LOG_OUTPUTS= 3:stderr /usr/lib/ libvirt/ virt-aa- helper -r -u libvirt- 2370eae2- cc9a-493c- b502-d2d64e2ee1 d1 -f /var/lib/ libvirt/ images/ eoan-disk1. snapshot2. qcow"
$9 = 0x7f92180f6520 "LIBVIRT_
Which seems right to me ...
And after this I see in the profile it is added:
"/var/ lib/libvirt/ images/ eoan-disk1. snapshot2. qcow" rwk,
I see those calls for both paths: 0x7f9224049f10 "libvirt- 2370eae2- cc9a-493c- b502-d2d64e2ee1 d1", def=def@ entry=0x7f92380 e9190, 0x7f9210007be0 "/var/lib/ libvirt/ images/ eoan-disk1. snapshot2. qcow", append= append@ entry=false, mgr=<optimized out>) at ../../. ./src/security/ security_ apparmor. c:166 virSecurityMana gerPtr mgr ATTRIBUTE_UNUSED, libvirt/ images/ eoan-disk1. snapshot2. qcow"
Thread 4 "libvirtd" hit Breakpoint 5, load_profile (profile=
fn=
166 load_profile(
$17 = 0x7f9210007be0 "/var/lib/
(gdb) c
Continuing.
[Detaching after fork from child process 21613]
[Detaching after fork from child process 21616]
Thread 4 "libvirtd" hit Breakpoint 5, load_profile (profile= 0x7f9224049f10 "libvirt- 2370eae2- cc9a-493c- b502-d2d64e2ee1 d1", def=def@ entry=0x7f92380 e9190, 0x7f9210009f10 "/var/lib/ libvirt/ images/ eoan-disk2. snapshot1. qcow", append= append@ entry=false, mgr=<optimized out>) at ../../. ./src/security/ security_ apparmor. c:166 virSecurityMana gerPtr mgr ATTRIBUTE_UNUSED, libvirt/ images/ eoan-disk2. snapshot1. qcow"
fn=
166 load_profile(
$18 = 0x7f9210009f10 "/var/lib/
$29 = 0x7f92300055a0 "LIBVIRT_ LOG_OUTPUTS= 3:stderr /usr/lib/ libvirt/ virt-aa- helper -r -u libvirt- 2370eae2- cc9a-493c- b502-d2d64e2ee1 d1 -f /var/lib/ libvirt/ images/ eoan-disk2. snapshot1. qcow"
So surely both file labelling calls happen.