2

我在新的 Ubuntu 20.04 主机 (libvirtd (libvirt) 6.0.0) 上有一个新的 VM，由于 AppArmor 拒绝对 VM 磁盘的读取访问而无法启动。磁盘定义如下：

<disk type='volume' device='disk'>
  <driver name='qemu' type='qcow2'/>
  <source pool='default' volume='awesome.qcow2'/>
  <target dev='vda' bus='virtio'/>
  <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
</disk>
<disk type='file' device='cdrom'>
  <driver name='qemu' type='raw'/>
  <source file='/var/lib/libvirt/images/ubuntu-20.04.1-live-server-amd64.iso'/>
  <target dev='hda' bus='sata'/>
  <readonly/>
  <address type='drive' controller='0' bus='0' target='0' unit='0'/>
</disk>

在 VM 启动期间，它失败并显示以下消息：

error: Failed to start domain playground
error: internal error: qemu unexpectedly closed the monitor: 2020-09-06T20:25:32.047663Z qemu-system-x86_64: -blockdev {"driver":"file","filename":"/var/lib/libvirt/images/awesome.qcow2","node-name":"libvirt-2-storage","auto-read-only":true,"discard":"unmap"}: Could not open '/var/lib/libvirt/images/awesome.qcow2': Permission denied

权限是正确的，我已经通过禁用 AppArmor 进行了验证，并且内核日志中还打印了以下内容：

[10757.098291] audit: type=1400 audit(1599423932.042:131): apparmor="DENIED" operation="open" profile="libvirt-b68582b8-0f35-4298-afd8-45c89ff3cbaa" name="/var/lib/libvirt/images/awesome.qcow2" pid=8654 comm="qemu-system-x86" requested_mask="r" denied_mask="r" fsuid=64055 ouid=64055

查看virt-aa-helperin生成的配置文件/etc/apparmor.d/libvirt/（在 VM 启动时），我可以看到以下内容：

# DO NOT EDIT THIS FILE DIRECTLY. IT IS MANAGED BY LIBVIRT.
  "/var/log/libvirt/**/playground.log" w,
  "/var/lib/libvirt/qemu/domain-playground/monitor.sock" rw,
  "/var/lib/libvirt/qemu/domain-17-playground/*" rw,
  "/run/libvirt/**/playground.pid" rwk,
  "/run/libvirt/**/*.tunnelmigrate.dest.playground" rw,
  "/var/lib/libvirt/images/ubuntu-20.04.1-live-server-amd64.iso" rk,
  "/dev/vhost-net" rw,
  "/var/lib/libvirt/qemu/domain-17-playground/{,**}" rwk,
  "/var/lib/libvirt/qemu/channel/target/domain-17-playground/{,**}" rwk,
  "/var/lib/libvirt/qemu/domain-17-playground/master-key.aes" rwk,
  "/dev/net/tun" rwk,

由于某种原因，磁盘的路径丢失，而 ISO 已正确添加。我可以在以下位置看到默认池的路径/etc/apparmor.d/usr.lib.libvirt.virt-aa-helper：

[...]
@{HOME}/ r,
@{HOME}/** r,
/var/lib/libvirt/images/ r,
/var/lib/libvirt/images/** r,
# nova base images (LP: #907269)
/var/lib/nova/images/** r,
[...]

我怀疑卷中的磁盘文件应该有一个条目。为什么不virt-aa-helper加呢？

4

1 回答 1

1

这似乎是 Ubuntu 中 libvirt 包中已确认的错误：https ://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1677398

于 2020-09-07T08:30:44.293 回答