[Bug 2079806] Re: qemu-bridge-helper denied by apparmor on oracular

[Sergio Durigan Junior]

OK, just a bit more context here.

I was able to start the VM after setting the suid bit on
/usr/libexec/qemu/qemu-bridge-helper.  This is something users have been
expected to do for many years on Debian-like systems now, because we
conscientiously ship this helper *without* the suid bit set.

The apparmor deny message I mentioned before:

[  182.228244] audit: type=1400 audit(1725680469.378:136):
apparmor="DENIED" operation="open" class="file"
profile="libvirtd//qemu_bridge_helper" name="/sys/devices/system/node/"
pid=1292 comm="qemu-bridge-hel" requested_mask="r" denied_mask="r"
fsuid=0 ouid=0

still shows up even after the VM has been successfully started, which
means it's not a critical problem and can be fixed later.

** Changed in: libvirt (Ubuntu)
       Status: In Progress => Fix Committed

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/2079806

Title:
  qemu-bridge-helper denied by apparmor on oracular

Status in libvirt package in Ubuntu:
  Fix Committed
Status in libvirt package in Debian:
  New

Bug description:
  I just upgraded from noble to oracular and my libvirt domains (using
  qemu:///session + qemu-bridge-helper for the network) can't start
  anymore.

  $ virsh start ubuntu-nvmeotcp-poc-target
  error: Failed to start domain 'ubuntu-nvmeotcp-poc-target'
  error: /usr/lib/qemu/qemu-bridge-helper --use-vnet --br=pocbr0 --fd=32: failed to communicate with bridge helper: : Transport endpoint is not connected

  [162559.444684] audit: type=1400 audit(1725612671.214:6873):
  apparmor="DENIED" operation="file_mmap" class="file"
  profile="libvirtd//qemu_bridge_helper" name="/usr/bin/dash" pid=699975
  comm="qemu-bridge-hel" requested_mask="r" denied_mask="r" fsuid=1000
  ouid=0

  After switching to AA complain mode, the domains can start again:

  $ sudo aa-complain /etc/apparmor.d/usr.sbin.libvirtd 
  skipping disabled profile usr.sbin.squid
  skipping disabled profile usr.bin.firefox
  Setting /etc/apparmor.d/usr.sbin.libvirtd to complain mode.

  $ virsh start ubuntu-nvmeotcp-poc-target
  Domain 'ubuntu-nvmeotcp-poc-target' started

  
  [162838.572654] audit: type=1400 audit(1725612950.342:6955): apparmor="ALLOWED" operation="file_mmap" class="file" profile="libvirtd//qemu_bridge_helper" name="/usr/bin/dash" pid=700572 comm="qemu-bridge-hel" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
  [162838.573199] audit: type=1400 audit(1725612950.342:6956): apparmor="ALLOWED" operation="exec" class="file" profile="libvirtd//qemu_bridge_helper" name="/usr/bin/sleep" pid=700574 comm="qemu-bridge-hel" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="libvirtd//qemu_bridge_helper//null-/usr/bin/sleep"
  [162838.573204] audit: type=1400 audit(1725612950.342:6957): apparmor="ALLOWED" operation="file_inherit" class="file" profile="libvirtd//qemu_bridge_helper//null-/usr/bin/sleep" name="/dev/null" pid=700574 comm="sleep" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=0
  [162838.573207] audit: type=1400 audit(1725612950.343:6958): apparmor="ALLOWED" operation="file_inherit" class="net" profile="libvirtd" pid=700574 comm="sleep" family="unix" sock_type="stream" protocol=0 requested="send receive" denied="send receive" addr=none peer_addr=none peer="libvirtd//qemu_bridge_helper//null-/usr/bin/sleep"
  [162838.573271] audit: type=1400 audit(1725612950.343:6959): apparmor="ALLOWED" operation="file_mmap" class="file" profile="libvirtd//qemu_bridge_helper//null-/usr/bin/sleep" name="/usr/bin/sleep" pid=700574 comm="sleep" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
  [162838.573277] audit: type=1400 audit(1725612950.343:6960): apparmor="ALLOWED" operation="file_mmap" class="file" profile="libvirtd//qemu_bridge_helper//null-/usr/bin/sleep" name="/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2" pid=700574 comm="sleep" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
  [162838.573340] audit: type=1400 audit(1725612950.343:6961): apparmor="ALLOWED" operation="open" class="file" profile="libvirtd//qemu_bridge_helper//null-/usr/bin/sleep" name="/etc/ld.so.cache" pid=700574 comm="sleep" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
  [162838.573345] audit: type=1400 audit(1725612950.343:6962): apparmor="ALLOWED" operation="getattr" class="file" profile="libvirtd//qemu_bridge_helper//null-/usr/bin/sleep" name="/etc/ld.so.cache" pid=700574 comm="sleep" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/2079806/+subscriptions