Bug#846050: libvirt-daemon-system: Cannot create VM - cannot load AppArmor profile

[Derth Lambert]

Package: libvirt-daemon-system
Version: 2.4.0-1+b1
Severity: normal

Dear Maintainer,

Trying to create a virtual machine using Virt-Manager interface OR import any
existing using "virsh define *.xml" result in:

Unable to complete install: 'internal error: cannot load AppArmor profile
'libvirt-xxxxxxx-xxxx-....'

Traceback (most recent call last):
File "/usr/share/virt-manager/virtManager/asyncjob.py", line 88, in
cb_wrapper
callback(asyncjob, *args, **kwargs)
File "/usr/share/virt-manager/virtManager/create.py", line 2288, in
_do_async_install
guest.start_install(meter=meter)
File "/usr/share/virt-manager/virtinst/guest.py", line 461, in start_install
doboot, transient)
File "/usr/share/virt-manager/virtinst/guest.py", line 396, in _create_guest
self.domain = self.conn.createXML(install_xml or final_xml, 0)
File "/usr/lib/python2.7/dist-packages/libvirt.py", line 3773, in createXML
if ret is None:raise libvirtError('virDomainCreateXML() failed', conn=self)
libvirtError: internal error: cannot load AppArmor profile 'libvirt-xxxxxxx-
xxxx-....'

It is brand new fresh Stretch install with apparmor enabled following Wiki.
there are no files created under /etc/apparmor.d/libvirt or any log errors
different from the above.

Cannot create any new VMs. This Debian Stretch brand new install fully updated
(stretch only, sid is pinned at -10).



-- System Information:
Debian Release: stretch/sid
APT prefers testing
APT policy: (990, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 4.8.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages libvirt-daemon-system depends on:
ii adduser 3.115
ii gettext-base 0.19.8.1-1
ii init-system-helpers 1.46
ii libapparmor1 2.10.95-6
ii libaudit1 1:2.6.7-1
ii libblkid1 2.29-1
ii libc6 2.24-5
ii libcap-ng0 0.7.7-3
ii libdbus-1-3 1.10.12-1
ii libdevmapper1.02.1 2:1.02.136-1
ii libnl-3-200 3.2.27-1
ii libnl-route-3-200 3.2.27-1
ii libnuma1 2.0.11-2
ii librados2 0.80.11-1.1
ii librbd1 0.80.11-1.1
ii libselinux1 2.6-3
ii libvirt-clients 2.4.0-1+b1
ii libvirt-daemon 2.4.0-1+b1
ii libvirt0 2.4.0-1+b1
ii libxml2 2.9.4+dfsg1-2.1
ii libyajl2 2.1.0-2
ii logrotate 3.8.7-2
ii policykit-1 0.105-17

Versions of packages libvirt-daemon-system recommends:
ii bridge-utils 1.5-10
ii dmidecode 3.0-4
ii dnsmasq-base 2.76-4
ii ebtables 2.0.10.4-3.5
ii iproute2 4.8.0-1
ii iptables 1.6.0-4
ii parted 3.2-16+b1

Versions of packages libvirt-daemon-system suggests:
ii apparmor 2.10.95-6
ii auditd 1:2.6.7-1
ii nfs-common 1:1.2.8-9.2
pn pm-utils <none>
pn radvd <none>
ii systemd 232-6
pn systemtap <none>
pn zfsutils <none>

-- Configuration Files:
/etc/libvirt/nwfilter/allow-arp.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/allow-arp.xml'
/etc/libvirt/nwfilter/allow-dhcp-server.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/allow-dhcp-server.xml'
/etc/libvirt/nwfilter/allow-dhcp.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/allow-dhcp.xml'
/etc/libvirt/nwfilter/allow-incoming-ipv4.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/allow-incoming-ipv4.xml'
/etc/libvirt/nwfilter/allow-ipv4.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/allow-ipv4.xml'
/etc/libvirt/nwfilter/clean-traffic.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/clean-traffic.xml'
/etc/libvirt/nwfilter/no-arp-ip-spoofing.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/no-arp-ip-spoofing.xml'
/etc/libvirt/nwfilter/no-arp-mac-spoofing.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/no-arp-mac-spoofing.xml'
/etc/libvirt/nwfilter/no-arp-spoofing.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/no-arp-spoofing.xml'
/etc/libvirt/nwfilter/no-ip-multicast.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/no-ip-multicast.xml'
/etc/libvirt/nwfilter/no-ip-spoofing.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/no-ip-spoofing.xml'
/etc/libvirt/nwfilter/no-mac-broadcast.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/no-mac-broadcast.xml'
/etc/libvirt/nwfilter/no-mac-spoofing.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/no-mac-spoofing.xml'
/etc/libvirt/nwfilter/no-other-l2-traffic.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/no-other-l2-traffic.xml'
/etc/libvirt/nwfilter/no-other-rarp-traffic.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/no-other-rarp-traffic.xml'
/etc/libvirt/nwfilter/qemu-announce-self-rarp.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/qemu-announce-self-rarp.xml'
/etc/libvirt/nwfilter/qemu-announce-self.xml [Errno 13] Permission denied: u'/etc/libvirt/nwfilter/qemu-announce-self.xml'
/etc/libvirt/qemu.conf [Errno 13] Permission denied: u'/etc/libvirt/qemu.conf'
/etc/libvirt/qemu/networks/default.xml [Errno 13] Permission denied: u'/etc/libvirt/qemu/networks/default.xml'

-- no debconf information

[Guido Günther]

Reduce the domain XML to a minimal test case and attach it to the
bugreport please.

You can also check if validation works with

DOM=<DOMNAME>
/usr/lib/libvirt/virt-aa-helper -d -r -p 0 -u libvirt-$(virsh domuuid $DOM) < /etc/libvirt/qemu/$DOM.xml

Replace <DONAME> with the name of your domain.

Cheers,
-- Guido

[intrigeri]

Control: tag -1 + moreinfo

Hi,

> On Mon, Nov 28, 2016 at 02:16:38AM -0500, Derth Lambert wrote:
>> Trying to create a virtual machine using Virt-Manager interface OR import any
>> existing using "virsh define *.xml" result in:
>>
>> Unable to complete install: 'internal error: cannot load AppArmor profile
>> 'libvirt-xxxxxxx-xxxx-....'

Can you still reproduce this problem on current Buster?
Worst case, on current Stretch?

Cheers,
--
intrigeri

[toby cabot]

Package: libvirt-daemon-system
Version: 5.0.0-4+deb10u1
Followup-For: Bug #846050

Dear Maintainer,

I hit the same error that the original poster does if I run this example command from the Debian wiki KVM page:

> tobyc@refectory:~$ virt-install --virt-type kvm --name buster-amd64 \
> > --location http://deb.debian.org/debian/dists/stable/main/installer-amd64/ \
> > --extra-args "console=ttyS0" -v --os-variant debian10 \
> > --disk size=10 --memory 1000
>
> Starting install...
> Retrieving file linux... | 5.0 MB 00:00:00
> Retrieving file initrd.gz... | 29 MB 00:00:00
> Allocating 'buster-amd64.qcow2' | 10 GB 00:00:00
> ERROR internal error: cannot load AppArmor profile 'libvirt-7b5d99f5-b3f4-48a5-828f-7411b9e59ce7'
> Removing disk 'buster-amd64.qcow2' | 0 B 00:00:00
> Domain installation does not appear to have been successful.
> If it was, you can restart your domain by running:
> virsh --connect qemu:///session start buster-amd64
> otherwise, please restart your installation.

If I add my user to the libvirt and kvm groups and "export LIBVIRT_DEFAULT_URI='qemu:///system'", however, I no longer get that error.

> tobyc@refectory:~$ virt-install --virt-type kvm --name buster-amd64 --location http://deb.debian.org/debian/dists/stable/main/installer-amd64/ --extra-args "console=ttyS0" -v --os-variant debian10 --disk size=10 --memory 1000
>
> Starting install...
> Retrieving file linux... | 5.0 MB 00:00:00
> Retrieving file initrd.gz... | 29 MB 00:00:00
> Allocating 'virtinst-linux.5gs_3p8e' | 5.0 MB 00:00:00
> Transferring virtinst-linux.5gs_3p8e | 5.0 MB 00:00:00
> Allocating 'virtinst-initrd.gz.93yf6kgn' | 29 MB 00:00:00
> Transferring virtinst-initrd.gz.93yf6kgn | 29 MB 00:00:00
> Allocating 'buster-amd64.qcow2' | 10 GB 00:00:00
> ERROR Requested operation is not valid: network 'default' is not active
> Removing disk 'buster-amd64.qcow2' | 0 B 00:00:00
> Domain installation does not appear to have been successful.
> If it was, you can restart your domain by running:
> virsh --connect qemu:///system start buster-amd64
> otherwise, please restart your installation.

HTH,
Toby


-- System Information:
Debian Release: 10.4
APT prefers stable
APT policy: (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-8-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libvirt-daemon-system depends on:

ii adduser 3.118
ii debconf [debconf-2.0] 1.5.71
ii gettext-base 0.19.8.1-9
ii iptables 1.8.2-4
ii libacl1 2.2.53-4
ii libapparmor1 2.13.2-10
ii libaudit1 1:2.8.4-3
ii libblkid1 2.33.1-0.1
ii libc6 2.28-10
ii libcap-ng0 0.7.9-2
ii libdbus-1-3 1.12.16-1
ii libdevmapper1.02.1 2:1.02.155-3
ii libgnutls30 3.6.7-4+deb10u3
ii libnl-3-200 3.4.0-1
ii libnl-route-3-200 3.4.0-1
ii libnuma1 2.0.12-1
ii libselinux1 2.8-1+b1
ii libvirt-clients 5.0.0-4+deb10u1
ii libvirt-daemon 5.0.0-4+deb10u1
ii libvirt0 5.0.0-4+deb10u1
ii libxml2 2.9.4+dfsg1-7+b3
ii libyajl2 2.1.0-3
ii logrotate 3.14.0-4
ii lsb-base 10.2019051400
ii policykit-1 0.105-25

Versions of packages libvirt-daemon-system recommends:

ii dmidecode 3.2-1
ii dnsmasq-base [dnsmasq-base] 2.80-1
ii iproute2 4.20.0-2
ii parted 3.2-25

Versions of packages libvirt-daemon-system suggests:

ii apparmor 2.13.2-10
pn auditd <none>
ii nfs-common 1:1.3.4-2.5
pn open-iscsi <none>

pn pm-utils <none>
pn radvd <none>

ii systemd 241-7~deb10u4

pn systemtap <none>
pn zfsutils <none>

-- Configuration Files:

/etc/libvirt/nwfilter/allow-arp.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-arp.xml'
/etc/libvirt/nwfilter/allow-dhcp-server.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-dhcp-server.xml'
/etc/libvirt/nwfilter/allow-dhcp.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-dhcp.xml'
/etc/libvirt/nwfilter/allow-incoming-ipv4.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-incoming-ipv4.xml'
/etc/libvirt/nwfilter/allow-ipv4.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-ipv4.xml'
/etc/libvirt/nwfilter/clean-traffic-gateway.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/clean-traffic-gateway.xml'
/etc/libvirt/nwfilter/clean-traffic.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/clean-traffic.xml'
/etc/libvirt/nwfilter/no-arp-ip-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-arp-ip-spoofing.xml'
/etc/libvirt/nwfilter/no-arp-mac-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-arp-mac-spoofing.xml'
/etc/libvirt/nwfilter/no-arp-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-arp-spoofing.xml'
/etc/libvirt/nwfilter/no-ip-multicast.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-ip-multicast.xml'
/etc/libvirt/nwfilter/no-ip-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-ip-spoofing.xml'
/etc/libvirt/nwfilter/no-mac-broadcast.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-mac-broadcast.xml'
/etc/libvirt/nwfilter/no-mac-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-mac-spoofing.xml'
/etc/libvirt/nwfilter/no-other-l2-traffic.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-other-l2-traffic.xml'
/etc/libvirt/nwfilter/no-other-rarp-traffic.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-other-rarp-traffic.xml'
/etc/libvirt/nwfilter/qemu-announce-self-rarp.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/qemu-announce-self-rarp.xml'
/etc/libvirt/nwfilter/qemu-announce-self.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/qemu-announce-self.xml'
/etc/libvirt/qemu.conf [Errno 13] Permission denied: '/etc/libvirt/qemu.conf'
/etc/libvirt/qemu/networks/default.xml [Errno 13] Permission denied: '/etc/libvirt/qemu/networks/default.xml'

-- debconf information:
libvirt-daemon-system/id_warning: true

[Domenico Andreoli]

Hi,

Today I solved a similar issue on my machine, or at least something
that was manifesting with the same error message.

The original problem is that my VM was referring to a file missing from
disk, the XML definition was valid but the VM was not.

This made some libvirtd child process die and, for reasons I ignore,
failed the AppArmor profile validation.

This is from syslog:

Jul 21 12:36:55 r9 libvirtd[1129]: internal error: Child process (LIBVIRT_LOG_OUTPUTS=3:stderr /usr/lib/libvirt/virt-aa-helper -c -u libvirt-ae75c26b-557a-4772-afe0-f820cfcdf410) unexpected exit status 1: virt-aa-helper: warning: path does not exist, skipping file type checks#012virt-aa-helper: error: /usr/share/AAVMF/AAVMF_VARS.fd#012virt-aa-helper: error: skipped restricted file#012virt-aa-helper: error: invalid VM definition
Jul 21 12:36:55 r9 libvirtd[1129]: internal error: cannot load AppArmor profile 'libvirt-ae75c26b-557a-4772-afe0-f820cfcdf410'


Therefore if you get this "cannot load AppArmor profile" error, look
for the actual error in /var/log/syslog.

I also suggest to close this bug, it's of the kind catch-all and cannot
be solved in any way.

Dom

--
rsa4096: 3B10 0CA1 8674 ACBA B4FE FCD2 CE5B CF17 9960 DE13
ed25519: FFB4 0CC3 7F2E 091D F7DA 356E CC79 2832 ED38 CB05