apparmor causes issues on libvirt with custom qemu
apparmor, libvirt, qemu
Solution
Your log message indicates that the problem was in the `/usr/sbin/libvirtd` profile; see the `profile="/usr/sbin/libvirtd"` portion of the message. This profile is stored in `/etc/apparmor.d/usr.sbin.libvirtd`; this profile does not include the `/etc/apparmor.d/abstractions/libvirt-qemu` abstraction -- this is instead loaded via the profiles in `/etc/apparmor.d/libvirt/`. See the last lines in the `libvirtd` profile:
# allow changing to our UUID-based named profiles
change_profile -> @{LIBVIRT}-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*,
Probably the easiest answer would be to add the following line to your `local/usr.sbin.libvirtd` file:
/usr/local/bin/qemu-system-x86_64 rmix,
(Though perhaps it would require `PUx` instead; the main `/usr/sbin/libvirtd` profile currently has `/usr/bin/* PUx,`, which is probably how the `/usr/bin/qemu-system-x86_64` gets executed currently.)
Another approach is to run `aa-logprof`, and allow the tools to prompt you. You may not build the prettiest profiles using the tools, but it should be fairly straightforward and have the same security properties as hand-authoring your profiles.
I hope this helps.
Problem
I wanted to run libvirt using a customized version of qemu. However, after I installed my version of qemu and rebooted I get the following message in dmesg type=1400 audit(1338385059.381:51): apparmor="DENIED" operation="exec" parent=1700 profile="/usr/sbin/libvirtd" name="/usr/local/bin/qemu-system-x86_64" pid=1746 comm="libvirtd" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 I tried editing the /etc/apparmor.d/abstractions/libvirt-qemu and added the following line and rebooted /usr/local/bin/qemu-system-x86_64 rmix, However the issue is still present. I am really new to apparmor, in fact hadn't read much on it till I found this error. Any help would be greatly appreciated.