1

I am using the terraform libvirt provider and I am failing to start a VM. I have a drive mounted at a folder within /home/dude/vmPool/, and I have tried setting acl from looking at this issue which looks similar. I have also tried editing /etc/libvirt/qemu.conf and setting user=root, group=root which doesn't seem to help. I have noticed that the VM image gets created as root while the cloudinit iso is created as my user, I believe internally genisoimage is used by the provider but I have no idea how that affects the domain not being created. It fails with the following error: error: Failed to start domain ubuntu-terraform error: internal error: process exited while connecting to monitor: 2018-12-06T14:14:22.519784Z qemu-system-x86_64: -drive file=/home/dude/vmPool/kvm.kthw.test/ubuntu-qcow2,format=qcow2,if=none,id=drive-virtio-disk0: Could not open '/home/dude/vmPool/kvm.kthw.test/ubuntu-qcow2': Permission denied

I am using Ubuntu 18.04:

uname -a
Linux kvm-host 4.15.0-42-generic #45-Ubuntu SMP Thu Nov 15 19:32:57 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Distributor ID: Ubuntu
Description:    Ubuntu 18.04.1 LTS
Release:        18.04
Codename:       bionic
Improve this question
1
1

It is a known issue in terraform libvirt. Please refer to :https://github.com/dmacvicar/terraform-provider-libvirt/commit/22f096d9

Improve this answer
0

this sounds like an apparmor path violation due to using an uncommon path. Please verify checking dmesg when triggering the issue if you see a deny message.

Then as a resolution please follow this document on using uncommon paths

TL;DR:

  • use a common path
  • add a local apparmor override to allow your path
Improve this answer
1
  • I ended up disabling and removing apparmor entirely as it seemed to have issues even with using the default pool (/var/lib/libvirt/images). From the log messages, it seemed the start capabilites were not included in libvirt profile – driftavalii Dec 10 '18 at 15:01
0

I faced the same problem, and after some investigation terraform doesn't use dot for resource identifiers. So AppArmor only grants this image 

/etc/apparmor.d/usr.lib.libvirt.virt-aa-helper

file names:

...
/**.img r,
/**.raw r,
/**.qcow{,2} r,
/**.qed r,
/**.vmdk r,
/**.[iI][sS][oO] r,
/**/disk{,.*} r,
...

My terraform uses -qcow as name for each resource, so adding this to the list solved my problem:

/**-qcow{,2} r,
Improve this answer
1
  • Also using as name propery of volume '<file>.qcow' or any AppArmor valid image names for libvirt solves the permission problem. – Securez Mar 2 '20 at 22:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.