libvirt users - Aug 2014 - Ubuntu Trusty: failed to create VM due to permission denied

>
Hi, libvirt experts,


I used libvirt to create a VM and used backing store to a local file. It
works fine until I installed my box to Unbuntu Trusty (14.04). I got the
following errors when I tried to start the VM:

Could not open backing file: Could not open <path to my backing file>:
Permission denied



However, if I moved my image file (not base image) to default location
/var/lib/libvirt/images. It works.

It seems something related to selinux. However, my box seems not have
selinux installed at all.

Anyone knows how to fix this?

Thanks,
~Frank
>

On 08/05/2014 05:23 PM, Jianfeng Tang wrote:
> 
> However, if I moved my image file (not base image) to default location
> /var/lib/libvirt/images. It works.
> 
> It seems something related to selinux. However, my box seems not have
> selinux installed at all.
It's probably AppArmor, not SELinux; but the concepts are the same - if
you have a mandatory access control that libvirt can use, then you have
to make sure that non-default locations are permitted through your
control mechanism, in order for libvirt sVirt protections to work with
your layout.
> 
> Anyone knows how to fix this?
Sadly, I don't use AppArmor myself to offer actual advice on it.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

Thank you Eric. Yes, it looks like AppArmor caused the problem. I will
google on how to disable it.

On 8/5/14 8:27 PM, "Eric Blake" <eblake@redhat.com> wrote:
>On 08/05/2014 05:23 PM, Jianfeng Tang wrote:
>
>> 
>> However, if I moved my image file (not base image) to default location
>> /var/lib/libvirt/images. It works.
>> 
>> It seems something related to selinux. However, my box seems not have
>> selinux installed at all.
>
>It's probably AppArmor, not SELinux; but the concepts are the same - if
>you have a mandatory access control that libvirt can use, then you have
>to make sure that non-default locations are permitted through your
>control mechanism, in order for libvirt sVirt protections to work with
>your layout.
>
>> 
>> Anyone knows how to fix this?
>
>Sadly, I don't use AppArmor myself to offer actual advice on it.
>
>-- 
>Eric Blake   eblake redhat com    +1-919-301-3266
>Libvirt virtualization library http://libvirt.org
>