This always runs when a real disk is used, so add something like the following
to your guest xml in libvirt:
<disk type='block' device='disk'>
<driver name='qemu' type='raw'/>
<source dev='/dev/sdb'/>
<target dev='vdc' bus='virtio'/>
</disk>
And you get:
[954547.646002] audit: type=1400 audit(1509697037.925:33): apparmor="DENIED"
operation="open" profile="libvirt-98160a65-f0e0-4bec-9b22-8573950cfb0e"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:03:00.0/host0/port-0:3/end_device-0:3/target0:0:2/0:0:2:0/block/sdb/queue/max_segments"
pid=30375 comm="qemu-system-x86" requested_mask="r" denied_mask="r"
fsuid=64055 ouid=0
[954547.646052] audit: type=1400 audit(1509697037.925:34): apparmor="DENIED"
operation="open" profile="libvirt-98160a65-f0e0-4bec-9b22-8573950cfb0e"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:03:00.0/host0/port-0:3/end_device-0:3/target0:0:2/0:0:2:0/block/sdb/queue/max_segments"
pid=30375 comm="qemu-system-x86" requested_mask="r" denied_mask="r"
fsuid=64055 ouid=0
The suggested rule doesn't apply, as that is a symlink that is not traversed
but directly opened:
/sys/dev/block/*/queue/max_segments r,
Instead this works:
/sys/devices/**/block/*/queue/max_segments
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1729626
Title:
AppArmor denies access to /sys/block/*/queue/max_segments
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1729626/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
