[SRU] virt-aa-helper denied access to qcow2 backing file running nova in a snap

libvirt already has the ability to inject AppArmor rules into the profile that it generates for a domain when you set/modify the path to a disk image. You can test this manually by running `virsh edit DOMAIN`, adjusting one of the paths in the xml, and then looking at the corresponding change in /etc/apparmor.d/libvirt/libvirt-*.files.

I'm confused about why this isn't working for you. Maybe you're going through libvirt to set/update the paths to your images?

Can you post a sample XML file and the AppArmor denials that you're seeing when using the XML file?

If you are wanting to use the deb libvirt from the archive with the snapped nova from Canonical then you are going to need to adjust the profile for virt-aa-helper to account for that, just like we adjusted the profile when moving from eucalyptus to nova. I suggest just adding:

  /var/snap/nova-hypervisor/common/instances/_base/** r,

Hello James, or anyone else affected,

Accepted libvirt into zesty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libvirt/2.5.0-3ubuntu5.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-zesty to verification-done-zesty. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-zesty. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello James, or anyone else affected,

Accepted libvirt into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libvirt/1.3.1-1ubuntu10.11 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hi Andy,

I've verified this on both xenial-proposed [1] and zesty-proposed [2].

I tested using https://github.com/openstack-snaps/snap-test to deploy a minimal OpenStack cloud, deployed an instance on top of it, and created a snapshot from that instance.

Thanks,
Corey

[1] xenial-proposed
libvirt-bin:
  Installed: 1.3.1-1ubuntu10.11

[2] zesty-proposed
libvirt-bin:
  Installed: 2.5.0-3ubuntu5.3

Note to SRU Team: we want this to go to -updates (probably next week, all pre-reqs except time in proposed are complete) before accepting 1705132 which is in -unapproved waiting for this one here to complete.

This bug was fixed in the package libvirt - 2.5.0-3ubuntu5.3

---------------
libvirt (2.5.0-3ubuntu5.3) zesty; urgency=medium

  * d/p/ubuntu/0004-apparmor-apply-ubuntu-delta.patch: Allow access to base
    images and snapshots stored in nova-hypervisor snap's $SNAP_COMMON
    directory, enabling use of the libvirt deb from the nova-hypervisor
    snap (LP: #1644507).

 -- Corey Bryant <email address hidden> Thu, 22 Jun 2017 14:39:39 -0400

The verification of the Stable Release Update for libvirt has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

This bug was fixed in the package libvirt - 1.3.1-1ubuntu10.11

---------------
libvirt (1.3.1-1ubuntu10.11) xenial; urgency=medium

  * d/apparmor/usr.lib.libvirt.virt-aa-helper: Allow access to base
    images and snapshots stored in nova-hypervisor snap's $SNAP_COMMON
    directory, enabling use of the libvirt deb from the nova-hypervisor
    snap (LP: #1644507).

 -- Corey Bryant <email address hidden> Thu, 22 Jun 2017 14:43:11 -0400