[Bug 1665698] Re: /etc/qemu-ifup not allowed by apparmor

[ChristianEhrhardt]

The function the upstream fix relates to in Openstack is:
def set_vif_host_backend_ethernet_config(conf, tapname):
    """Populate a LibvirtConfigGuestInterface instance
    with host backend details for an externally configured
    host device.

Before the change it was part of "get_config(self, instance, network, mapping)" in
"class LibvirtOpenVswitchDriver(LibvirtBaseVIFDriver)"

I'm not sure but does that imply it might trigger in any openvswitch setup?
Some of our tests should have had the same then.
I'll rerun some of those later to be sure.


The libvirt change on the other hand "only" changes to NOT refuse guests right away that have a script= attribute set. See the referred bug for details.
Now it does no more refuse to start those - that should (tm) not cause the issue. Maybe it really is the openstack commit you referred to (causing it to fallback to the default).
But as I said I'd wonder if that commit is active in your Software stack at all.

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/1665698

Title:
  /etc/qemu-ifup not allowed by apparmor

Status in Ubuntu Cloud Archive:
  Incomplete
Status in libvirt package in Ubuntu:
  Incomplete

Bug description:
  I have VMs failing to start with 2017-02-17 15:38:44.458 264015 ERROR
  nova.compute.manager [instance: 0c97ab16-2d30-43fa-b0e4-a064a842b5ed]
  libvirtError: internal error: process exited while connecting to
  monitor: 2017-02-17T15:38:43.907222Z qemu-system-x86_64: -netdev
  tap,ifname=tapf34ef99e-18,id=hostnet0,vhost=on,vhostfd=28: network
  script /etc/qemu-ifup failed with status 256

  Log excerpt:
  http://cdn.pasteraw.com/b3tw4cjefomfi3e9k09hvodrfun85z

  Seems to be that /etc/qemu-ifup is being blocked by apparmor:
  type=AVC msg=audit(1487347189.015:28536): apparmor="DENIED" operation="exec" profile="libvirt-4a03fea7-e966-48e4-80ac-aa138db67243" name="/etc/qemu-ifup" pid=285438 comm="qemu-system-x86" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
  type=PATH msg=audit(1487347189.015:28536): item=0 name="/etc/qemu-ifup" inode=66403 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL

  root at ubuntu-trusty-5773:/etc/apparmor.d/abstractions# cat /etc/apparmor.d/libvirt/libvirt-4a03fea7-e966-48e4-80ac-aa138db67243
  #
  # This profile is for the domain whose UUID matches this file.
  #

  #include <tunables/global>

  profile libvirt-4a03fea7-e966-48e4-80ac-aa138db67243 {
    #include <abstractions/libvirt-qemu>
    #include <libvirt/libvirt-4a03fea7-e966-48e4-80ac-aa138db67243.files>

  }
  root at ubuntu-trusty-5773:/etc/apparmor.d/abstractions# cat /etc/apparmor.d/libvirt/libvirt-4a03fea7-e966-48e4-80ac-aa138db67243.files
  # DO NOT EDIT THIS FILE DIRECTLY. IT IS MANAGED BY LIBVIRT.
    "/var/log/libvirt/**/instance-00000008.log" w,
    "/var/lib/libvirt/qemu/domain-instance-00000008/monitor.sock" rw,
    "/var/run/libvirt/**/instance-00000008.pid" rwk,
    "/run/libvirt/**/instance-00000008.pid" rwk,
    "/var/run/libvirt/**/*.tunnelmigrate.dest.instance-00000008" rw,
    "/run/libvirt/**/*.tunnelmigrate.dest.instance-00000008" rw,
    "/var/lib/nova/instances/4a03fea7-e966-48e4-80ac-aa138db67243/console.log" rw,
    "/var/lib/nova/instances/4a03fea7-e966-48e4-80ac-aa138db67243/console.log" rw,
    # for qemu guest agent channel
    owner "/var/lib/libvirt/qemu/channel/target/domain-instance-00000008/**" rw,
    /dev/vhost-net rw,

  root at ubuntu-trusty-5773:/etc/apparmor.d/abstractions# dpkg -S libvirt-qemu
  libvirt-bin: /etc/apparmor.d/abstractions/libvirt-qemu

  root at ubuntu-trusty-5773:/etc/apparmor.d/abstractions# dpkg -l libvirt-bin
  Desired=Unknown/Install/Remove/Purge/Hold
  | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
  |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
  ||/ Name                                      Version                   Architecture              Description
  +++-=========================================-=========================-=========================-=======================================================================================
  ii  libvirt-bin                               1.3.1-1ubuntu10.6~cloud0  amd64                     programs for the libvirt library

  
  Seeing identical behavior on Xenial
  ubuntu at ubuntu-xenial-5165:~$ dpkg -l libvirt-bin
  Desired=Unknown/Install/Remove/Purge/Hold
  | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
  |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
  ||/ Name                                      Version                   Architecture              Description
  +++-=========================================-=========================-=========================-=======================================================================================
  ii  libvirt-bin                               1.3.1-1ubuntu10.8         amd64                     programs for the libvirt library

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1665698/+subscriptions