Bug 1120109 - QEMU-KVM fails to load apparmor profile when starting saved domain
Summary: QEMU-KVM fails to load apparmor profile when starting saved domain
Keywords:
Status: CLOSED DEFERRED
Alias: None
Product: Virtualization Tools
Classification: Community
Component: libvirt
Version: unspecified
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Libvirt Maintainers
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-07-16 09:58 UTC by Arunas
Modified: 2016-05-02 14:29 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-05-02 14:29:25 UTC

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Arunas 2014-07-16 09:58:13 UTC 
Description of problem:
Cannot restart saved QEMU domain under (default) apparmour security container.
The app-armor profiles are present and loadable

--- Console ---
virsh # managedsave Win7

Domain Win7 state saved by libvirt

virsh # start Win7
error: Failed to start domain Win7
error: internal error: cannot load AppArmor profile 'libvirt-230df182-437a-457a-bd9c-62819ff24929'

uk-lc13-lab:~>ls /etc/apparmor.d/libvirt/libvirt-230df182-437a-457a-bd9c-62819ff24929*
/etc/apparmor.d/libvirt/libvirt-230df182-437a-457a-bd9c-62819ff24929
/etc/apparmor.d/libvirt/libvirt-230df182-437a-457a-bd9c-62819ff24929.files
uk-lc13-lab:~>aa-exec -f /etc/apparmor.d/libvirt/libvirt-230df182-437a-457a-bd9c-62819ff24929 date
Wed Jul 16 10:52:42 BST 2014
--- END ---

Version-Release number of selected component (if applicable):
1.2.2

How reproducible:
Always

Steps to Reproduce:
1.virsh managedsave <domain>
2.virsh start <domain>
3.

Actual results:
Domain fails to start

Expected results:
Domain restarts from the saved state.

Additional info:

apparmor version 2.8.95
Ubuntu 14.04 with kernel 3.15.3-031503-lowlatency
Disk volume is on ZFS.
Comment 1 Vincent Gerris 2014-10-10 14:21:31 UTC 
I have the same issue. Mine is on an ext4 volume.
I saw some people mentioning that a space in the name might be an issue.
I tried to add the profile manually and set the apparmor policy to just alarm, but keep getting the error.
Comment 2 Cole Robinson 2016-04-10 19:04:46 UTC 
Sorry this didn't receive a timely response. Is anyone still seeing this with a more recent distro and libvirt version?
Comment 3 Cole Robinson 2016-05-02 14:29:25 UTC 
Since there's no response, closing as DEFERRED. But if anyone is still affected with newer libvirt versions, please re-open and we can triage from there
Note You need to log in before you can comment on or make changes to this bug.