Bug #457716 “apparmor denies save and restore” : Bugs : libvirt package : Ubuntu

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2009-10-21:

#1

Dependencies.txt Edit (1.7 KiB, text/plain; charset="utf-8")
XsessionErrors.txt Edit (1.4 KiB, text/plain; charset="utf-8")

Changed in libvirt (Ubuntu):
assignee:	nobody → Jamie Strandboge (jdstrand)
importance:	Undecided → High
milestone:	none → karmic-updates
status:	New → Triaged

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2009-10-21:

#2

This may be better:

  # for save and resume
  #include <abstractions/private-files-strict>
  /bin/dash rmix,
  /bin/dd rmix,
  /bin/cat rmix,
  # 'owner' makes sure we don't overwrite the user's files (ie, if the file
  # exists, it must be owned by 'root')
  owner @{HOME}/ r,
  owner @{HOME}/** rw,
  owner /var/tmp/** rw,
  owner /var/tmp/ rw,
  owner /tmp/** rw,
  owner /tmp/ rw,

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2009-10-21:

#3

Err:
  # for save and resume
  #include <abstractions/private-files-strict>
  /bin/dash rmix,
  /bin/dd rmix,
  /bin/cat rmix,
  # 'owner' makes sure we don't overwrite the user's files (ie, if the file
  # exists, it must be owned by 'root')
  owner @{HOME}/ r,
  owner @{HOME}/** rw,
  owner /var/tmp/** rw,
  owner /var/tmp/ r,
  owner /tmp/** rw,
  owner /tmp/ r,

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2009-10-22:

#4

This also affects the selinux svirt driver. According to upstream, the svirt driver needs to be modified to 'relabel' the specified state file. Until this is fixed upstream, we can temporarily work around this with documentation and profiling.

Bug Watch Updater (bug-watch-updater) on 2009-10-22

Changed in libvirt (Fedora):
status:	Unknown → In Progress

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2009-10-22:

#5

I'll provide a workaround in an SRU after 9.10 release.

Changed in libvirt (Ubuntu):
status:	Triaged → In Progress

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2009-10-23:

#6

In retrospect, this loss of functionality is likely important to users and it would be best to get it in before release if possible. Subscribing ubuntu-release. The final workaround is a simple profile adjustment:
  # for save and resume
  /bin/dash rmix,
  /bin/dd rmix,
  /bin/cat rmix,

  # workaround https://launchpad.net/bugs/457716. The svirt driver does not
  # relabel the state file (https://bugzilla.redhat.com/show_bug.cgi?id=529363)
  # resulting in denied messages. The below works around this somewhat by
  # allowing users to save state files in their home directories. We use
  # 'owner' to make sure we don't overwrite the user's files. This will be
  # removed when the upstream bug is fixed.
  #include <abstractions/private-files-strict>
  owner @{HOME}/ r,
  owner @{HOME}/** rw,

Changed in libvirt (Ubuntu):
milestone:	karmic-updates → ubuntu-9.10
status:	In Progress → Fix Committed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2009-10-23:

#7

This bug was fixed in the package libvirt - 0.7.0-1ubuntu13

---------------
libvirt (0.7.0-1ubuntu13) karmic; urgency=low

  * allow save/restore to work in $HOME. This is a workaround until upstream
    https://bugzilla.redhat.com/show_bug.cgi?id=529363 is fixed. (LP: #457716)
  * debian/libvirt-bin.cron.daily: don't comlain if no domain XML definitions
    or domain AppArmor profiles. Based on work by Loïc Minier. (LP: #457607)

-- Jamie Strandboge <email address hidden> Fri, 23 Oct 2009 03:52:33 -0500

Changed in libvirt (Ubuntu):
status:	Fix Committed → Fix Released

Revision history for this message

In Red Hat Bugzilla #532654, IBM (ibm-redhat-bugs) wrote on 2009-11-03:

#17

=Comment: #0=================================================
SANTWANA SAMANTRAY <email address hidden> -

virsh save of the kvm guest hangs in Fedora12 rawhide.
After this, virsh doesn't respond properly, and even restarting libvirtd doesn't help.

Attachment: dmesg and strace of virsh save

[root@mx3550 ~]# strace -o virsh_save -f virsh save rhel6 /home/latest_save
-------HANGS HERE-----------

uname -a :Linux mx3550.in.ibm.com 2.6.31.5-96.fc12.x86_64 #1 SMP Fri Oct 23 19:30:30 EDT 2009 x86_64
x86_64 x86_64 GNU/Linux

Below are the versions installed:
[root@mx3550 ~]# rpm -qa|grep libvirt
libvirt-client-0.7.1-13.fc12.x86_64
libvirt-debuginfo-0.7.1-13.fc12.x86_64
libvirt-devel-0.7.1-13.fc12.x86_64
libvirt-python-0.7.1-13.fc12.x86_64
libvirt-0.7.1-13.fc12.x86_64

[root@mx3550 ~]# rpm -qa|grep kvm
qemu-kvm-0.11.0-9.fc12.x86_64

=Comment: #1=================================================
ANOOP C. VIJAYAN <email address hidden> -
The save hangs because the qemu process is not able to write to the file which libvirtd created.
This happens because qemu-kvm runs with uid of qemu user whereas libvirtd runs as a root user.
Moreover libvirtd creates the save file with only owner (root) read & write permissions.

[root@mx3550 ~]# tail /var/log/libvirt/qemu/rhel6.log
LC_ALL=C PATH=/sbin:/usr/sbin:/bin:/usr/bin HOME=/root USER=root LOGNAME=root QEMU_AUDIO_DRV=none
/usr/bin/qemu-kvm -S -M pc-0.11 -m 500 -smp 1 -name rhel6 -uuid 47b90387-e42a-d493-f037-0425f580cb9d
-monitor unix:/var/lib/libvirt/qemu/rhel6.monitor,server,nowait -boot c -drive
file=/var/lib/libvirt/images/rhel6.raw,if=ide,index=0,boot=on,format=raw -drive
file=,if=ide,media=cdrom,index=2 -net nic,macaddr=52:54:00:39:3f:5c,vlan=0,name=nic.0 -net
tap,fd=17,vlan=0,name=tap.0 -serial pty -parallel none -usb -vnc 127.0.0.1:0 -vga cirrus
char device redirected to /dev/pts/1
sh: /home/newguest: Permission denied <=======

[root@mx3550 ~]# ls -l /home/newguest
-rw------- 1 root root 1468 2009-11-03 15:59 /home/newguest

[root@mx3550 ~]# ps -eaf|grep qemu
qemu 4616 1 71 15:56 ? 00:00:28 /usr/bin/qemu-kvm -S -M pc-0.11 -m 500 -smp 1 -name
rhel6 -uuid 47b90387-e42a-d493-f037-0425f580cb9d -monitor
unix:/var/lib/libvirt/qemu/rhel6.monitor,server,nowait -boot c -drive
file=/var/lib/libvirt/images/rhel6.raw,if=ide,index=0,boot=on,format=raw -drive
file=,if=ide,media=cdrom,index=2 -net nic,macaddr=52:54:00:39:3f:5c,vlan=0,name=nic.0 -net
tap,fd=17,vlan=0,name=tap.0 -serial pty -parallel none -usb -vnc 127.0.0.1:0 -vga cirrus

[root@mx3550 ~]# ps -eaf|grep libvirtd
root 3800 1 0 15:32 ? 00:00:02 libvirtd --daemon

file: libvirt-0.7.1/src/qemu_driver.c
3803 static int qemudDomainSave(virDomainPtr dom,
3804 const char *path)
3805 {
------cut-----------
3874 /* Write header to file, followed by XML */
3875 if ((fd = open(path, O_CREAT|O_TRUNC|O_WRONLY, S_IRUSR|S_IWUSR)) < 0) {
3876 qemudReportError(dom->conn, dom, NULL, VIR_ERR_OPERATION_FAILED,
3877 _("failed to create '%s'"), path);

=Comment: #0=================================================
SANTWANA SAMANTRAY <santwana.samantray@in.ibm.com> -

virsh save of the kvm guest hangs in Fedora12 rawhide.
After this, virsh doesn't respond properly, and even restarting libvirtd doesn't help.

Attachment: dmesg and strace of virsh save

[root@mx3550 ~]# strace -o virsh_save -f virsh save rhel6 /home/latest_save
-------HANGS HERE-----------

uname -a :Linux mx3550.in.ibm.com 2.6.31.5-96.fc12.x86_64 #1 SMP Fri Oct 23 19:30:30 EDT 2009 x86_64
x86_64 x86_64 GNU/Linux

Below are the versions installed:
[root@mx3550 ~]# rpm -qa|grep libvirt
libvirt-client-0.7.1-13.fc12.x86_64
libvirt-debuginfo-0.7.1-13.fc12.x86_64
libvirt-devel-0.7.1-13.fc12.x86_64
libvirt-python-0.7.1-13.fc12.x86_64
libvirt-0.7.1-13.fc12.x86_64

[root@mx3550 ~]# rpm -qa|grep kvm
qemu-kvm-0.11.0-9.fc12.x86_64

=Comment: #1=================================================
ANOOP C. VIJAYAN <anoop.vijayan@in.ibm.com> - 
The save hangs because the qemu process is not able to write to the file which libvirtd created.
This happens because qemu-kvm runs with uid of qemu user whereas libvirtd runs as a root user.
Moreover libvirtd creates the save file with only owner (root) read & write permissions.

[root@mx3550 ~]# tail /var/log/libvirt/qemu/rhel6.log
LC_ALL=C PATH=/sbin:/usr/sbin:/bin:/usr/bin HOME=/root USER=root LOGNAME=root QEMU_AUDIO_DRV=none
/usr/bin/qemu-kvm -S -M pc-0.11 -m 500 -smp 1 -name rhel6 -uuid 47b90387-e42a-d493-f037-0425f580cb9d
-monitor unix:/var/lib/libvirt/qemu/rhel6.monitor,server,nowait -boot c -drive
file=/var/lib/libvirt/images/rhel6.raw,if=ide,index=0,boot=on,format=raw -drive
file=,if=ide,media=cdrom,index=2 -net nic,macaddr=52:54:00:39:3f:5c,vlan=0,name=nic.0 -net
tap,fd=17,vlan=0,name=tap.0 -serial pty -parallel none -usb -vnc 127.0.0.1:0 -vga cirrus
char device redirected to /dev/pts/1
sh: /home/newguest: Permission denied <=======

[root@mx3550 ~]# ls -l /home/newguest
-rw------- 1 root root 1468 2009-11-03 15:59 /home/newguest

[root@mx3550 ~]# ps -eaf|grep qemu
qemu      4616     1 71 15:56 ?        00:00:28 /usr/bin/qemu-kvm -S -M pc-0.11 -m 500 -smp 1 -name
rhel6 -uuid 47b90387-e42a-d493-f037-0425f580cb9d -monitor
unix:/var/lib/libvirt/qemu/rhel6.monitor,server,nowait -boot c -drive
file=/var/lib/libvirt/images/rhel6.raw,if=ide,index=0,boot=on,format=raw -drive
file=,if=ide,media=cdrom,index=2 -net nic,macaddr=52:54:00:39:3f:5c,vlan=0,name=nic.0 -net
tap,fd=17,vlan=0,name=tap.0 -serial pty -parallel none -usb -vnc 127.0.0.1:0 -vga cirrus

[root@mx3550 ~]# ps -eaf|grep libvirtd
root      3800     1  0 15:32 ?        00:00:02 libvirtd --daemon

file: libvirt-0.7.1/src/qemu_driver.c
3803 static int qemudDomainSave(virDomainPtr dom,
3804                            const char *path)
3805 {
------cut-----------
3874     /* Write header to file, followed by XML */
3875     if ((fd = open(path, O_CREAT|O_TRUNC|O_WRONLY, S_IRUSR|S_IWUSR)) < 0) {
3876         qemudReportError(dom->conn, dom, NULL, VIR_ERR_OPERATION_FAILED,
3877                          _("failed to create '%s'"), path);

Revision history for this message

In Red Hat Bugzilla #532654, IBM (ibm-redhat-bugs) wrote on 2009-11-03:

#18

Created attachment 367283
dmesg and strace of virsh save

Revision history for this message

In Red Hat Bugzilla #532654, IBM (ibm-redhat-bugs) wrote on 2009-11-05:

#19

Created attachment 367606
fix_virsh_save.patch

------- Comment on attachment From <email address hidden> 2009-11-05 07:47 EDT-------

Attaching a patch which gives write permission for the qemu user on the save file. Santwana, please test it and update with the results.

Revision history for this message

Norio Suzuki (nosuz) wrote on 2009-11-05:

#8

I might be affected this problem though I installed released version of Ubuntu 9.10.

Phenomenon:
I executed next command in "sudo su -".

# virsh save VM_NAME STATE_FILE

This command never finish and make block other libvirt related programs like virt-top or virt-manager, and virsh, of course. I must enter ^C to get back command prompt.

Reproduction:
This problem is reproduced on newly installed and upgraded from 9.04 machines.

Enviroment:
I am using newly installed and upgraded Ubuntu 9.10 (64 bit Server ed.)
"uname -r" is 2.6.31-14-server
libvirt(libvirt-bin, libvirt0, python-libvirt) version is 0.7.0-1ubuntu13. This version number was get from "dpkg -l | grep libvirt".

Thank you.

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2009-11-05:

#9

The apparmor profile in Ubuntu works around the upstream bug, which lacks the proper functionality. Look in your /var/log/kern.log, you are probably trying to save the file outside of the allowed location. See /etc/apparmor.d/abstractions/libvirt-qemu for details.

Basically, you can write state files in your home directory if you own them. If this does not fit your workflow, please update /etc/apparmor.d/abstractions/libvirt-qemu for the location(s) you want to give write access until this functionality is properly implemented in libvirt itself.

Revision history for this message

Norio Suzuki (nosuz) wrote on 2009-11-06:

#10

Thank you for your advice.

I was able to save VM's state file under my own HOME directory.

I also tried to modify the apparmor configuration file(/etc/apparmor.d/abstractions/libvirt-qemu) and was able to make state files in where specified by the configuration file.

Revision history for this message

In Red Hat Bugzilla #532654, IBM (ibm-redhat-bugs) wrote on 2009-11-06:

#20

------- Comment From <email address hidden> 2009-11-06 06:51 EDT-------
Hello Anoop,

I verified the issue, after the patch was applied. This patch solves the write permission for the qemu user while saving the guest, and the guest saves properly. The issue is now resolved.

Thanks for the patch.
Santwana

Revision history for this message

In Red Hat Bugzilla #532654, Andrew (andrew-redhat-bugs) wrote on 2009-11-10:

#21

I have seen this problem, too. Are there any plans for when this patch will be included in the RPMs for Fedora 12? Thanks.

Revision history for this message

In Red Hat Bugzilla #532654, Daniel (daniel-redhat-bugs) wrote on 2009-11-11:

#22

Created attachment 369012
Fix save & restore with unprivileged guests, and SELinux

When running qemu:///system instance, libvirtd runs as root, but QEMU may optionally be configured to run non-root. When then saving a guest to a state file, the file is initially created as root, and thus QEMU cannot write to it. It is also missing labelling required to allow access via SELinux. This patch fixes those issues.

http://www.redhat.com/archives/libvir-list/2009-November/msg00376.html

Revision history for this message

In Red Hat Bugzilla #532654, Daniel (daniel-redhat-bugs) wrote on 2009-11-11:

#23

*** Bug 529363 has been marked as a duplicate of this bug. ***

Bug Watch Updater (bug-watch-updater) on 2009-11-12

Changed in libvirt (Fedora):
status:	In Progress → Invalid

Jamie Strandboge (jdstrand) on 2009-11-12

Changed in libvirt (Fedora):
status:	Invalid → Unknown

Revision history for this message

In Red Hat Bugzilla #532654, Bug (bug-redhat-bugs) wrote on 2009-11-16:

#24

This bug appears to have been reported against 'rawhide' during the Fedora 12 development cycle.
Changing version to '12'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Revision history for this message

In Red Hat Bugzilla #532654, Mark (mark-redhat-bugs) wrote on 2009-11-19:

#25

Sounds like we also need:

http://www.redhat.com/archives/libvir-list/2009-November/msg00640.html

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2010-03-31:

#11

I have developed a proper fix for this for Lucid as part of the security-lucid-libvirt-apparmor-devel blueprint. As such, I added a Lucid task and marked In Progress.

Changed in libvirt (Ubuntu Karmic):
importance:	Undecided → High
status:	New → Fix Released
assignee:	nobody → Jamie Strandboge (jdstrand)
Changed in libvirt (Ubuntu Lucid):
status:	Fix Released → In Progress
milestone:	ubuntu-9.10 → ubuntu-10.04-beta-2

Revision history for this message

Chris Bainbridge (chris-bainbridge) wrote on 2010-04-01:

#12

Is bug #523148 related to apparmor?

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2010-04-01:

#13

Seems unrelated. Check kern.log for denials to be sure.

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2010-04-02:

#14

I'm going to unmilestone this since it mostly depends on bug #553737. If that bug is fixed, I can add my upstream work to it, otherwise this may have to wait until lucid+1.

Changed in libvirt (Ubuntu Lucid):
milestone:	ubuntu-10.04-beta-2 → none

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2010-04-05:

#15

Changes are too big for Lucid. This will be fixed in Maverick and upstream libvirt 0.7.8.

Changed in libvirt (Ubuntu Lucid):
status:	In Progress → Won't Fix
Changed in libvirt (Ubuntu):
status:	In Progress → Triaged
milestone:	none → later

Revision history for this message

In Red Hat Bugzilla #532654, Fedora (fedora-redhat-bugs) wrote on 2010-05-18:

#26

libvirt-0.7.1-16.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/libvirt-0.7.1-16.fc12

Revision history for this message

In Red Hat Bugzilla #532654, Fedora (fedora-redhat-bugs) wrote on 2010-05-19:

#27

libvirt-0.7.1-16.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
su -c 'yum --enablerepo=updates-testing update libvirt'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/libvirt-0.7.1-16.fc12

Revision history for this message

In Red Hat Bugzilla #532654, Fedora (fedora-redhat-bugs) wrote on 2010-05-28:

#28

libvirt-0.7.1-16.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.

Jamie Strandboge (jdstrand) on 2010-06-16

Changed in libvirt (Ubuntu Maverick):
status:	Triaged → In Progress
milestone:	later → maverick-alpha-2

Revision history for this message

Launchpad Janitor (janitor) wrote on 2010-06-16:

#16

Download full text (8.5 KiB)

This bug was fixed in the package libvirt - 0.8.1-2ubuntu1

---------------
libvirt (0.8.1-2ubuntu1) maverick; urgency=low

  * Merge from debian unstable. Remaining changes:
    - Fixes:
      LP: #522845
      LP: #553737
      LP: #520386
    - debian/control:
      + Build-Depends on qemu-kvm, not qemu
      + Build-Depends on open-iscsi-utils, not open-iscsi
      + Build-Depends on libxml2-utils
      + Build-Depends on libapparmor-dev and Suggests apparmor
      + Bump bridge-utils, dnsmasq-base, netcat-openbsd, and iptables
        to Depends of libvirt-bin
      + Drop qemu-kvm and qemu to Suggests
      + We call libxen-dev libxen3-dev, so change all references
      + Rename Vcs-* to XS-Debian-Vcs-*
    - debian/libvirt-bin.postinst:
      + rename the libvirt group to libvirtd
      + add each admin user to the libvirtd group
      + reload apparmor profiles
    - debian/libvirt-bin.postrm:
      + rename the libvirt group to libvirtd
      + remove apparmor symlinks on purge
    - debian/README.Debian: add AppArmor section based on the upstream
      documentation
    - debian/rules:
      + update DEB_DH_INSTALLINIT_ARGS for upstart
      + add DEB_MAKE_CHECK_TARGET := check
      + use --with-apparmor
      + copy apparmor and apport hook to debian/tmp
    - add debian/libvirt-bin.upstart
    - debian/libvirt-bin.dirs: add /etc/apparmor.d/abstractions,
      /etc/apparmor.d/disable, /etc/apparmor.d/force-complain,
      /etc/apparmor.d/libvirt, /etc/cron.daily and
      /usr/share/apport/package-hooks
    - add debian/libvirt-bin.cron.daily
    - add debian/libvirt-bin.apport
    - debian/libvirt-bin.install: install apparmor profiles, abstractions
      and apport hook
    - debian/apparmor:
      - add TEMPLATE
      - add libvirt-qemu abstraction
      - add usr.lib.libvirt.virt-aa-helper
      - add usr.sbin.libvirtd
    - debian/patches/series:
      + don't apply 0002-qemu-disable-network.diff.patch
      + don't apply 0005-Terminate-nc-on-EOF.patch. Use
        9010-autodetect-nc-params.patch instead
      + 9000-delayed_iff_up_bridge.patch (refreshed)
      + 9001-dont_clobber_existing_bridges.patch
      + 9002-better_default_uri_virsh.patch (updated)
      + 9004-better-default-arch.patch
      + 9005-libvirtd-group-name.patch
      + 9006-increase-unix-socket-timeout.patch (refreshed)
      + 9007-default-config-test-case.patch (updated)
      + 9008-fix-daemon-conf-ftbfs.patch (rewritten)
      + 9009-run-as-root-by-default.patch (refreshed)
      + 9010-autodetect-nc-params.patch (refreshed, formerly 9015)
      + 9011-dont-disable-ipv6.patch (updated)
  * Dropped following packaging changes, no longer required with upgrades
    from Lucid:
    - debian/control:
      + versioned Conflicts/Replaces to libvirt0 for libvirt0-dbg
      + remove Build-Depends on libcap-ng-dev
    - debian/libvirt-bin.postinst: virt-aa-helper profile migration to
      /usr/lib/libvirt
    - debian/libvirt-bin.preinst: added to force complain on certain
      upgrades
  * Dropped the following patches, included upstream:
    - 0010-Use-base-16-for-product-vendor.patch
    - 9003-increase-logoutput-timeout.patch
    - 9010-apparmor-ftbfs...

This bug was fixed in the package libvirt - 0.8.1-2ubuntu1

---------------
libvirt (0.8.1-2ubuntu1) maverick; urgency=low

* Merge from debian unstable. Remaining changes:
    - Fixes:
      LP: #522845
      LP: #553737
      LP: #520386
    - debian/control:
      + Build-Depends on qemu-kvm, not qemu
      + Build-Depends on open-iscsi-utils, not open-iscsi
      + Build-Depends on libxml2-utils
      + Build-Depends on libapparmor-dev and Suggests apparmor
      + Bump bridge-utils, dnsmasq-base, netcat-openbsd, and iptables
        to Depends of libvirt-bin
      + Drop qemu-kvm and qemu to Suggests
      + We call libxen-dev libxen3-dev, so change all references
      + Rename Vcs-* to XS-Debian-Vcs-*
    - debian/libvirt-bin.postinst:
      + rename the libvirt group to libvirtd
      + add each admin user to the libvirtd group
      + reload apparmor profiles
    - debian/libvirt-bin.postrm:
      + rename the libvirt group to libvirtd
      + remove apparmor symlinks on purge
    - debian/README.Debian: add AppArmor section based on the upstream
      documentation
    - debian/rules:
      + update DEB_DH_INSTALLINIT_ARGS for upstart
      + add DEB_MAKE_CHECK_TARGET := check
      + use --with-apparmor
      + copy apparmor and apport hook to debian/tmp
    - add debian/libvirt-bin.upstart
    - debian/libvirt-bin.dirs: add /etc/apparmor.d/abstractions,
      /etc/apparmor.d/disable, /etc/apparmor.d/force-complain,
      /etc/apparmor.d/libvirt, /etc/cron.daily and
      /usr/share/apport/package-hooks
    - add debian/libvirt-bin.cron.daily
    - add debian/libvirt-bin.apport
    - debian/libvirt-bin.install: install apparmor profiles, abstractions
      and apport hook
    - debian/apparmor:
      - add TEMPLATE
      - add libvirt-qemu abstraction
      - add usr.lib.libvirt.virt-aa-helper
      - add usr.sbin.libvirtd
    - debian/patches/series:
      + don't apply 0002-qemu-disable-network.diff.patch
      + don't apply 0005-Terminate-nc-on-EOF.patch. Use
        9010-autodetect-nc-params.patch instead
      + 9000-delayed_iff_up_bridge.patch (refreshed)
      + 9001-dont_clobber_existing_bridges.patch
      + 9002-better_default_uri_virsh.patch (updated)
      + 9004-better-default-arch.patch
      + 9005-libvirtd-group-name.patch
      + 9006-increase-unix-socket-timeout.patch (refreshed)
      + 9007-default-config-test-case.patch (updated)
      + 9008-fix-daemon-conf-ftbfs.patch (rewritten)
      + 9009-run-as-root-by-default.patch (refreshed)
      + 9010-autodetect-nc-params.patch (refreshed, formerly 9015)
      + 9011-dont-disable-ipv6.patch (updated)
  * Dropped following packaging changes, no longer required with upgrades
    from Lucid:
    - debian/control:
      + versioned Conflicts/Replaces to libvirt0 for libvirt0-dbg
      + remove Build-Depends on libcap-ng-dev
    - debian/libvirt-bin.postinst: virt-aa-helper profile migration to
      /usr/lib/libvirt
    - debian/libvirt-bin.preinst: added to force complain on certain
      upgrades
  * Dropped the following patches, included upstream:
    - 0010-Use-base-16-for-product-vendor.patch
    - 9003-increase-logoutput-timeout.patch
    - 9010-apparmor-ftbfs.patch
    - 9011-node_device_driver.patch
    - 9012-dont-crash-on-restart.patch
    - 9013-apparmor-dont-clear-caps.patch
    - 9014-apparmor-remove-unloaded-profile-is-not-fatal.patch
    - 9016-disk-cache-setting-xml.patch
    - 9018-fix-pty-console.patch
    - 9019-apparmor-fix-xauth.patch
    - 9020-apparmor-fix-backingstore.patch
    - 9021-apparmor-fix-hostdev.patch
    - 9022-dont-leak-log-fd.path.patch
    - 9023-virt-pki-validate_fixes.patch
    - 9024-free-memory-for-invalid-devices.patch (use
      0008-Fix-leaks-in-udev-device-add-remove.patch from Debian)
  * debian/apparmor/usr.lib.libvirt.virt-aa-helper: allow access to ecryptfs
    files (LP: #591769)
  * debian/patches/9012-fix-nodeinfotest-ftbfs.patch: fix FTBFS in
    nodeinfotest. Drop in 0.8.2.
  * debian/patches/9013-apparmor-lp457716.patch: properly support/save and
    restore (LP: #457716). Drop in 0.8.2.
  * debian/apparmor/libvirt-qemu: remove workaround for LP: #457716
  * don't create and run ebtables script in /tmp:
    - debian/apparmor/usr.sbin.libvirt: allow ixr to /var/lib/libvirt/virtd*
      for new ebtables functionality added in 0.8.0
    - debian/patches/9014-move-ebtables-script.patch: update
      nwfilter_ebiptables_driver.c /var/lib/libvirt to use /var/lib/libvirt
      instead of /tmp

libvirt (0.8.1-2) unstable; urgency=low

* [41aea79] Drop patchsys-quilt since this package is 3.0 (quilt) now.
    (Closes: #577919)
  * [978e3c9] libvirt-bin.init: export PATH. (Closes: #584333)
  * [e4f0869] virt-xml-validate needs xmllint from libxml2-utils.
    (Closes: #584869)
  * [bba6d72] New patch 0008-Fix-leaks-in-udev-device-add-remove.patch:
    Fix leaks in udev device add/remove. (Closes: #582965) - thanks to
    Nigel Jones for forwarding this

libvirt (0.8.1-1) unstable; urgency=low

* [647cbd6] Imported Upstream version 0.8.1
        * fixes spurious syslog messages (Closes: #565275)
        * sysfs USB class parsing (Closes: #579208)
        * virsh honors $VISUAL (Closes: #574415)
  * [fecd1b9] Update libvirt symbols to 0.8.1
  * [3e58e0b] Drop patches merged upstream:
        * 0007-nwfilter-Don-t-crash-if-driverState-NULL.patch
        * 0008-Ignore-empty-type-statement-in-disk-element.patch
  * [561ab2e] New patch:
        * 0007-patch-qemuMonitorTextGetMigrationStatus-to-intercept.patch:
          make qemuMonitorTextGetMigrationStatus to intercept unknown
          command 'info migrate' (Closes: #574272) - thanks to Andreas Bießmann
  * [aeda8ea] Enanble macvtap support

libvirt (0.8.0-2) unstable; urgency=low

* [70fbcb6] New patch 0007-nwfilter-Don-t-crash-if-driverState- NULL.patch
    nwfilter: Don't crash if driverState == NULL (Closes: #577728)
  * [d7d1abd] New patch 0008-Ignore-empty-type-statement-in-disk-
    element.patch Ignore empty type statement in disk element
    (Closes: #578347)

libvirt (0.8.0-1) unstable; urgency=low

* Imported Upstream version 0.8.0
  * Drop patches.
  * Update libvirt0 symbols.
  * Switch to new source format 3.0 (quilt).

libvirt (0.7.7-4) unstable; urgency=low

[ Guido Günther ]
  * [cf4919c] Recommend either qemu-kvm or qemu

[ Laurent Léonard ]
  * [1b12f02] Change libparted1.8-dev build dependency to libparted0- dev.
    (Closes: #574906)

libvirt (0.7.7-3) unstable; urgency=low

* The "fix all those crashes" release
  * [f74e13a] Explicitly disable hal (Closes: #574177)
  * [21ef92b] New patch 0009-security-Set-permissions-for-kernel- initrd.patch
    security: Set permissions for kernel/initrd (Closes: #574241) - thanks to
    Cole Robinson
  * [b69d3cc] Revert "Enable NUMA support" since it breaks the python
    bindings.
  * [5f2ca4a] New patch 0010-Don-t-crash-without-a-security-driver.patch Don't
    crash without a security driver (Closes: #574359)

libvirt (0.7.7-2) unstable; urgency=low

[ Guido Günther ]
  * [b350683] Enable parallel build
  * [b2a6aab] Enable NUMA support
  * [13274cf] New patch 0007-Work-around-broken-linux-socket.h.patch
    Work around broken linux/socket.h

[ Laurent Léonard ]
  * [3c12caf] qemu: Fix USB by product with security enabled.

libvirt (0.7.7-1) unstable; urgency=low

* [f944460] Imported Upstream version 0.7.7
  * [bd457cc] Redo patches.
  * [098d1d3] Update libvirt0 symbols.

libvirt (0.7.6-2) unstable; urgency=low

* [72790fc] Drop hal dependency We're using udev for device enumeration.
  * [ce225c4][11cc6e9] New patch
    0006-Don-t-drop-caps-when-exec-ing-qemu.patch: Don't drop caps when
    exec'ing qemu. Instead of disabling libcap-ng better exclude this one exec
    so we get the additional security for the rest of the calls. Makes
    interface type="network" work again. (Closes: #565767)

libvirt (0.7.6-1) unstable; urgency=low

* [0229557] Imported Upstream version 0.7.6
  * [6fdc00b] Drop patches.
  * [1b0670b] Update libvirt0 symbols.

libvirt (0.7.5-6) unstable; urgency=low

[ Laurent Léonard ]
  * [a3b98c9] Don't free an uninitalized pointer in update_driver_name()
    (Closes: #565983) - thanks to Matthias Bolte
  * [719976d] Handle only official releases in debian/watch.
  * [83902d9] Bump Standards-Version to 3.8.4.

[ Guido Günther ]
  * [959640d] New patch 0011-Fix-parsing-of-info-chardev-line-
    endings.patch Fix parsing of 'info chardev' line endings (Closes:
    #567818) - thanks to Matthew Booth

[ Laurent Léonard ]
  * [0b2a9dd] Add $remote_fs to Required-Start and Required-Stop in
    libvirt-bin init script.
 -- Jamie Strandboge <jamie@ubuntu.com>   Wed, 16 Jun 2010 14:22:39 -0500

Changed in libvirt (Ubuntu Maverick):
status:	In Progress → Fix Released

Revision history for this message

In Red Hat Bugzilla #532654, IBM (ibm-redhat-bugs) wrote on 2010-10-06:

#29

Created attachment 451893
strace o/p

------- Comment (attachment only) From <email address hidden> 2010-10-06 09:20 EDT-------

Bug Watch Updater (bug-watch-updater) on 2017-10-27

Changed in libvirt (Fedora):
importance:	Unknown → High
status:	Unknown → Fix Released

Ubuntu
libvirt package

apparmor denies save and restore

Bug Description

Related branches

Duplicates of this bug

Other bug subscribers

Bug attachments

Remote bug watches

	Status	Importance	Assigned to	Milestone
libvirt (Fedora)	Fix Released	High	redhat-bugs #532654
libvirt (Ubuntu)	Fix Released	High	Jamie Strandboge	Ubuntu maverick-alpha-2
Karmic	Fix Released	High	Jamie Strandboge
Lucid	Won't Fix	High	Jamie Strandboge
Maverick	Fix Released	High	Jamie Strandboge	Ubuntu maverick-alpha-2

Ubuntulibvirt package

apparmor denies save and restore

Bug Description

Related branches

Duplicates of this bug

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
libvirt package