I am trying to run custom build qemu with libvirt. However, every time it fails due to apparmor permission.

dmesg shows that:

[   82.818348] audit: type=1400 audit(1563507497.685:181): apparmor="DENIED" operation="exec" profile="libvirt-ec642fe5-8e5c-4d4a-ada7-b8562396d477" name="/home/probir/Downloads/qemu/qemu_kognizance/qemu_pinning/build_static/x86_64-softmmu/qemu-system-x86_64" pid=2235 comm="libvirtd" requested_mask="x" denied_mask="x" fsuid=64055 ouid=1000

How can I instruct apparmor to allow custom-built qemu-system-x86_64?


It detects that it has to run under the qemu profile (libvirt instructs things to recognize that). The profile for that is in /etc/apparmor.d/abstractions/libvirt-qemu.

In newer versions of Ubuntu you will have /etc/apparmor.d/local/abstractions/libvirt-qemu which will take your overrides to avoid conflicts on packaging upgrades. In earler versions you still need to modify /etc/apparmor.d/abstractions/libvirt-qemu directly.

A rule for the deny that you see would be

/home/probir/Downloads/qemu/qemu_kognizance/qemu_pinning/build_static/x86_64-softmmu/qemu-system-x86_64 rmix,

If you need more rules read the apparmor rules guide and the links from there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.