Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #858583 > unrolled thread

Bug#878203: AA breaks libvirt when running with kernel 4.13

Back to article view | Back to linux.debian.bugs.dist

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Bug#878203: AA breaks libvirt when running with kernel 4.13 Guido Günther <agx@sigxcpu.org> - 2017-10-23 18:00 +0200
    Bug#878203: AA breaks libvirt when running with kernel 4.13 Michael Biebl <biebl@debian.org> - 2017-10-23 18:30 +0200
      Bug#878203: AA breaks libvirt when running with kernel 4.13 Guido Günther <agx@sigxcpu.org> - 2017-10-23 18:40 +0200
        Bug#878203: AA breaks libvirt when running with kernel 4.13 Michael Biebl <biebl@debian.org> - 2017-10-23 18:50 +0200
          Bug#878203: AA breaks libvirt when running with kernel 4.13 Guido Günther <agx@sigxcpu.org> - 2017-10-23 21:00 +0200

#858583 — Bug#878203: AA breaks libvirt when running with kernel 4.13

Hi,
On Wed, Oct 11, 2017 at 02:10:01AM +0200, Michael Biebl wrote:
> Package: apparmor
> Version: 2.11.0-11
> Severity: serious
> 
> After the kernel upgrade from 4.12 to 4.13 my KVM/libvirt instances
> failed to start:
> Okt 10 19:24:44 pluto libvirtd[673]: 2017-10-10 17:24:44.404+0000: 797: error : virProcessRunInMountNamespace:1159 : internal error: child reported: Kernel does not provide mount namespace: Permission denied
> 
> Disabling AppArmor made libvirt work again.
> There seems to be an incompatibility between the 4.13 kernel and
> AppArmor. Please reassign if you think this is a bug in the kernel.
> 
> I've decided to mark this as RC, as breaking KVM is a rather severe
> regression which needs to be fixed for buster.
> 
> A quick internet search turns up
> https://forums.opensuse.org/showthread.php/527394-KVM-guest-will-not-start-with-latest-version-of-kernel
> and following that
> https://www.redhat.com/archives/libvir-list/2017-September/msg00546.html

I can't reproduce this here with 4.13.0-1-amd64 and
libvirt-daemon-system 3.8.0-3.
 -- Guido

[toc] | [next] | [standalone]

#858587

[Multipart message — attachments visible in raw view] — view raw

Am 23.10.2017 um 17:49 schrieb Guido Günther:

> I can't reproduce this here with 4.13.0-1-amd64 and
> libvirt-daemon-system 3.8.0-3.
>  -- Guido
> 
linux-image-4.13.0-1-amd64 4.13.4-2
libvirt-daemon-system 3.8.0-3

This is what I get when I *shut down* a VM in virt-manager:
$ journalctl -f | grep DENIED
Okt 23 18:20:31 pluto audit[8603]: AVC apparmor="DENIED"
operation="open" profile="libvirt-4e5a8920-a2a1-4c6b-b7f1-528c20878cdd"
name="/proc/718/cmdline" pid=8603 comm="qemu-system-x86"
requested_mask="r" denied_mask="r" fsuid=114 ouid=0
Okt 23 18:20:31 pluto kernel: audit: type=1400 audit(1508775631.299:55):
apparmor="DENIED" operation="open"
profile="libvirt-4e5a8920-a2a1-4c6b-b7f1-528c20878cdd"
name="/proc/718/cmdline" pid=8603 comm="qemu-system-x86"
requested_mask="r" denied_mask="r" fsuid=114 ouid=0


-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

[toc] | [prev] | [next] | [standalone]

#858589

Hi,
On Mon, Oct 23, 2017 at 06:22:10PM +0200, Michael Biebl wrote:
> Am 23.10.2017 um 17:49 schrieb Guido Günther:
> 
> > I can't reproduce this here with 4.13.0-1-amd64 and
> > libvirt-daemon-system 3.8.0-3.
> >  -- Guido
> > 
> linux-image-4.13.0-1-amd64 4.13.4-2
> libvirt-daemon-system 3.8.0-3
> 
> This is what I get when I *shut down* a VM in virt-manager:
> $ journalctl -f | grep DENIED
> Okt 23 18:20:31 pluto audit[8603]: AVC apparmor="DENIED"
> operation="open" profile="libvirt-4e5a8920-a2a1-4c6b-b7f1-528c20878cdd"
> name="/proc/718/cmdline" pid=8603 comm="qemu-system-x86"
> requested_mask="r" denied_mask="r" fsuid=114 ouid=0
> Okt 23 18:20:31 pluto kernel: audit: type=1400 audit(1508775631.299:55):
> apparmor="DENIED" operation="open"
> profile="libvirt-4e5a8920-a2a1-4c6b-b7f1-528c20878cdd"
> name="/proc/718/cmdline" pid=8603 comm="qemu-system-x86"
> requested_mask="r" denied_mask="r" fsuid=114 ouid=0

I can produce this msg on shutdown (I assumed it to be on VM start) but
what does break?
 -- Guido

> 
> 
> -- 
> Why is it that all of the instruments seeking intelligent life in the
> universe are pointed away from Earth?
> 

[toc] | [prev] | [next] | [standalone]

#858592

[Multipart message — attachments visible in raw view] — view raw

Am 23.10.2017 um 18:28 schrieb Guido Günther:
> Hi,
> On Mon, Oct 23, 2017 at 06:22:10PM +0200, Michael Biebl wrote:
>> Am 23.10.2017 um 17:49 schrieb Guido Günther:

>> This is what I get when I *shut down* a VM in virt-manager:
>> $ journalctl -f | grep DENIED
>> Okt 23 18:20:31 pluto audit[8603]: AVC apparmor="DENIED"
>> operation="open" profile="libvirt-4e5a8920-a2a1-4c6b-b7f1-528c20878cdd"
>> name="/proc/718/cmdline" pid=8603 comm="qemu-system-x86"
>> requested_mask="r" denied_mask="r" fsuid=114 ouid=0
>> Okt 23 18:20:31 pluto kernel: audit: type=1400 audit(1508775631.299:55):
>> apparmor="DENIED" operation="open"
>> profile="libvirt-4e5a8920-a2a1-4c6b-b7f1-528c20878cdd"
>> name="/proc/718/cmdline" pid=8603 comm="qemu-system-x86"
>> requested_mask="r" denied_mask="r" fsuid=114 ouid=0
> 
> I can produce this msg on shutdown (I assumed it to be on VM start) but
> what does break?

No idea. I don't see any immediate breakage related to those denials.


-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

[toc] | [prev] | [next] | [standalone]

#858610

control: severity -1 minor
control: retitle -1 apparmor logs /proc/<pid>/cmdline denials on vm shutdown

Hi,
On Mon, Oct 23, 2017 at 06:41:04PM +0200, Michael Biebl wrote:
> Am 23.10.2017 um 18:28 schrieb Guido Günther:
> > Hi,
> > On Mon, Oct 23, 2017 at 06:22:10PM +0200, Michael Biebl wrote:
> >> Am 23.10.2017 um 17:49 schrieb Guido Günther:
> 
> >> This is what I get when I *shut down* a VM in virt-manager:
> >> $ journalctl -f | grep DENIED
> >> Okt 23 18:20:31 pluto audit[8603]: AVC apparmor="DENIED"
> >> operation="open" profile="libvirt-4e5a8920-a2a1-4c6b-b7f1-528c20878cdd"
> >> name="/proc/718/cmdline" pid=8603 comm="qemu-system-x86"
> >> requested_mask="r" denied_mask="r" fsuid=114 ouid=0
> >> Okt 23 18:20:31 pluto kernel: audit: type=1400 audit(1508775631.299:55):
> >> apparmor="DENIED" operation="open"
> >> profile="libvirt-4e5a8920-a2a1-4c6b-b7f1-528c20878cdd"
> >> name="/proc/718/cmdline" pid=8603 comm="qemu-system-x86"
> >> requested_mask="r" denied_mask="r" fsuid=114 ouid=0
> > 
> > I can produce this msg on shutdown (I assumed it to be on VM start) but
> > what does break?
> 
> No idea. I don't see any immediate breakage related to those denials.

Ahh...I didn't see your comment in

    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878203#25

and intrigeri's

    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878203#30

and the bug title sounded alarming. It's harmless but should be fixed
though.

Cheers,
 -- Guido

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web