I am trying to run my virtual machines in virt-manager using SDL as my display, rather than a spice server.

The VMs boot flawlessly with spice but when I switch its display to SDL I get the following error:

Error starting domain: internal error: cannot load AppArmor profile 'libvirt-32963ecb-fd2f-454c-93a6-c818af618ba4'`
Traceback (most recent call last):
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 65, in cb_wrapper
    callback(asyncjob, *args, **kwargs)
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 101, in tmpcb
    callback(*args, **kwargs)
  File "/usr/share/virt-manager/virtManager/object/libvirtobject.py", line 57, in newfn
    ret = fn(self, *args, **kwargs)
  File "/usr/share/virt-manager/virtManager/object/domain.py", line 1329, in startup
  File "/usr/lib/python3/dist-packages/libvirt.py", line 1353, in create
    raise libvirtError('virDomainCreate() failed')
libvirt.libvirtError: internal error: cannot load AppArmor profile 'libvirt-32963ecb-fd2f-454c-93a6-c818af618ba4'

The directory that contains 'libvirt-32963ecb-fd2f-454c-93a6-c818af618ba4' looks like this:

/etc/apparmor.d/libvirt$ ls -l

-rw-r--r-- 1 root root 293 Dec 26 00:21 libvirt-04e1e00e-eb6c-4b5a-b04d-87769a1a5d2d
-rw-r--r-- 1 root root 293 Jan  1 17:41 libvirt-072dbf37-2bb3-4ddc-b87b-f10d3fd3049e
-rw-r--r-- 1 root root 293 Jan  1 17:37 libvirt-2b6671ef-6184-4b22-88bc-ca532d45d170
-rw-r--r-- 1 root root 293 Jan  3 22:03 libvirt-32963ecb-fd2f-454c-93a6-c818af618ba4
-rw-r--r-- 1 root root 293 Jan  1 19:35 libvirt-6c092a74-1ef9-4c97-8f6c-be22eda71193
-rw-r--r-- 1 root root 293 Dec 26 00:20 libvirt-915f59ee-3a52-4eb1-a43e-35be01a41b16
-rw-r--r-- 1 root root 581 Dec 26 00:20 libvirt-915f59ee-3a52-4eb1-a43e-35be01a41b16.files
-rw-r--r-- 1 root root 293 Jan  1 19:50 libvirt-c871c97c-92ef-4c23-b75a-8fab2e8678e3
-rw-r--r-- 1 root root 342 Jan 15  2021 TEMPLATE.lxc
-rw-r--r-- 1 root root 192 Jan 15  2021 TEMPLATE.qemu

and 'libvirt-32963ecb-fd2f-454c-93a6-c818af618ba4':

# This profile is for the domain whose UUID matches this file.

#include <tunables/global>

profile libvirt-32963ecb-fd2f-454c-93a6-c818af618ba4 flags=(attach_disconnected) {
  #include <abstractions/libvirt-qemu>
  #include <libvirt/libvirt-32963ecb-fd2f-454c-93a6-c818af618ba4.files>


I noticed the directory doesn't contain 'ibvirt-32963ecb-fd2f-454c-93a6-c818af618ba4.files' as the file suggests, but I am not sure how to go about generating that.

I've tried reinstalling both the QEMU/KVM/libvirt stack and Apparmor with no success.

Any pointers would be helpful here as I've kind of hit a dead end.

Thanks :)

  • Libvirt-32963ecb-fd2f-454c-93a6-c818af618ba4 is left around in case you want to add per-guest rules. The 'libvirt-32963ecb-fd2f-454c-93a6-c818af618ba4.files' is generated on the fly when starting the guest based on its configuration. This suggests that it creates a broken apparmor file which then fails to load. You can trial and error that by dumping the guest xml virsh dumpxml name > guest.xml and then calling it directly sudo /usr/lib/libvirt/virt-aa-helper -r -d -u 'libvirt-32963ecb-fd2f-454c-93a6-c818af618ba4' < guest.xml - that will print to console what it would add to that file. Jan 23, 2023 at 11:35


You must log in to answer this question.

Browse other questions tagged .