I'm trying to pass through a physical optical drive to a KVM guest.

Here is how I have the device defined in XML:

<controller type='scsi' index='0' model='virtio-scsi'/>
    <hostdev mode='subsystem' type='scsi'>
        <adapter name='scsi_host4'/>
        <address type='scsi' bus='0' target='0' unit='0'/>
  <address type='drive' controller='0' bus='0' target='0' unit='0'/>

Unfortunately, when I try to boot the VM, I get this error:

drive file=/dev/sg0,if=none,id=drive-hostdev0,readonly=on: Could not open '/dev/sg0': Permission denied

How can I fix this?

  • Is it a normal file perm that gives you permission denied or is is the apparmor confinement of the guests that blocks you. Check dmesg while you are attaching this and if it reports an apparmor deny. – Christian Ehrhardt May 11 '18 at 6:10

First you should check if it is AppArmor that is blocking your device:

dmesg | grep /dev/sg0

If you see a message similar to:

[159883.682167] audit: type=1400 audit(1534114680.047:392): apparmor="DENIED" operation="file_lock" profile="libvirt-40d3ad0d-0574-4823-ae7d-eaf38afa7fb6" name="/dev/sg0"

Then it is being locked by AppArmor. If the profile field looks like above with the domain's identifier located after profile= portion then it is a dynamically created profile created by KVM after the domain starts as part of KVM's integration with AppArmor.

You can allow access to some or all your SCSI devices for your KVM hosts by editing the template file usually located at /etc/apparmor.d/libvirt. You should see A TEMPLATE.qemu file which is used as the basis for the dynamically created AppArmor profiles. You can whitelist the device(s) in this file or edit the file pointed at by the include listed in the template file which is usually /etc/apparmor.d/abstractions/libvirt-qemu. To whitelist, just add your entries on their own lines to the file like so:

For read:

/dev/sg* rk,

For read/write:

/dev/sg* rwk,

If you are using the GUI to edit the SCSI devices in the domain, you may notice that the devices don't show up correctly in the GUI. For example, if you are trying to pass through an optical drive it may not show that media is in the drive even if some is present. You will want to whilelist these devices to the KVM service as well by adding similar entries to the /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper file and then tell AppArmor to reload configs:

service apparmor reload

If the SCSI devices are symlinked, you may need to add those symlinked devices to your whitelist as well. The AppArmor errors will let you know if this is the case as you will see updated errors as you whitelist devices for read or write if you don't have them all covered.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.