Package: libvirt-daemon-system Version: 5.0.0-4+deb10u1 Severity: important
Dear Maintainer, It seems apparmor is denying the hot attach of a NIC to a VM. While trying to attach a NIC I get: audit: type=1400 audit(1599123343.785:152): apparmor="DENIED" operation="file_receive" profile="libvirt-87dd6694-43b6-4f40-a62f-fa71525467ab" name="/dev/vhost-net" pid=16384 comm="qemu-system-x86" requested_mask="wr" denied_mask="wr" fsuid=9869 ouid=0 After investigating I found that adding '/dev/vhost-net rw,' to '/etc/apparmor.d/abstractions/libvirt-qemu' fixes the issue. Looking at the Ubuntu version of this file it seems that more hotplugging is not working. They have added: # for vhost-net/vsock/scsi hotplug (LP: #1815910) /dev/vhost-net rw, /dev/vhost-vsock rw, /dev/vhost-scsi rw, Could this be added to the package? Regards, Sander Klein -- System Information: Debian Release: 10.5 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.19.0-10-amd64 (SMP w/2 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8) Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages libvirt-daemon-system depends on: ii adduser 3.118 ii debconf [debconf-2.0] 1.5.71 ii gettext-base 0.19.8.1-9 ii iptables 1.8.2-4 ii libacl1 2.2.53-4 ii libapparmor1 2.13.2-10 ii libaudit1 1:2.8.4-3 ii libblkid1 2.33.1-0.1 ii libc6 2.28-10 ii libcap-ng0 0.7.9-2 ii libdbus-1-3 1.12.20-0+deb10u1 ii libdevmapper1.02.1 2:1.02.155-3 ii libgnutls30 3.6.7-4+deb10u5 ii libnl-3-200 3.4.0-1 ii libnl-route-3-200 3.4.0-1 ii libnuma1 2.0.12-1 ii libselinux1 2.8-1+b1 ii libvirt-clients 5.0.0-4+deb10u1 ii libvirt-daemon 5.0.0-4+deb10u1 ii libvirt0 5.0.0-4+deb10u1 ii libxml2 2.9.4+dfsg1-7+b3 ii libyajl2 2.1.0-3 ii logrotate 3.14.0-4 ii lsb-base 10.2019051400 ii policykit-1 0.105-25 Versions of packages libvirt-daemon-system recommends: ii dmidecode 3.2-1 ii dnsmasq-base [dnsmasq-base] 2.80-1 ii iproute2 4.20.0-2 ii parted 3.2-25 Versions of packages libvirt-daemon-system suggests: ii apparmor 2.13.2-10 pn auditd <none> ii nfs-common 1:1.3.4-2.5+deb10u1 pn open-iscsi <none> pn pm-utils <none> pn radvd <none> ii systemd 241-7~deb10u4 pn systemtap <none> pn zfsutils <none> -- Configuration Files: /etc/libvirt/nwfilter/allow-arp.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-arp.xml' /etc/libvirt/nwfilter/allow-dhcp-server.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-dhcp-server.xml' /etc/libvirt/nwfilter/allow-dhcp.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-dhcp.xml' /etc/libvirt/nwfilter/allow-incoming-ipv4.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-incoming-ipv4.xml' /etc/libvirt/nwfilter/allow-ipv4.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-ipv4.xml' /etc/libvirt/nwfilter/clean-traffic-gateway.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/clean-traffic-gateway.xml' /etc/libvirt/nwfilter/clean-traffic.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/clean-traffic.xml' /etc/libvirt/nwfilter/no-arp-ip-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-arp-ip-spoofing.xml' /etc/libvirt/nwfilter/no-arp-mac-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-arp-mac-spoofing.xml' /etc/libvirt/nwfilter/no-arp-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-arp-spoofing.xml' /etc/libvirt/nwfilter/no-ip-multicast.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-ip-multicast.xml' /etc/libvirt/nwfilter/no-ip-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-ip-spoofing.xml' /etc/libvirt/nwfilter/no-mac-broadcast.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-mac-broadcast.xml' /etc/libvirt/nwfilter/no-mac-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-mac-spoofing.xml' /etc/libvirt/nwfilter/no-other-l2-traffic.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-other-l2-traffic.xml' /etc/libvirt/nwfilter/no-other-rarp-traffic.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-other-rarp-traffic.xml' /etc/libvirt/nwfilter/qemu-announce-self-rarp.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/qemu-announce-self-rarp.xml' /etc/libvirt/nwfilter/qemu-announce-self.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/qemu-announce-self.xml' /etc/libvirt/qemu.conf [Errno 13] Permission denied: '/etc/libvirt/qemu.conf' /etc/libvirt/qemu/networks/default.xml [Errno 13] Permission denied: '/etc/libvirt/qemu/networks/default.xml' -- debconf information: libvirt-daemon-system/id_warning: true
