virt-aa-helper 不会在 AppArmor 生成的规则中添加存储池路径

Question

我在新的 Ubuntu 20.04 主机 (libvirtd (libvirt) 6.0.0) 上有一个新的虚拟机，由于 AppArmor 拒绝读取虚拟机磁盘而无法启动。磁盘定义如下：

<disk type='volume' device='disk'>
  <driver name='qemu' type='qcow2'/>
  <source pool='default' volume='awesome.qcow2'/>
  <target dev='vda' bus='virtio'/>
  <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
</disk>
<disk type='file' device='cdrom'>
  <driver name='qemu' type='raw'/>
  <source file='/var/lib/libvirt/images/ubuntu-20.04.1-live-server-amd64.iso'/>
  <target dev='hda' bus='sata'/>
  <readonly/>
  <address type='drive' controller='0' bus='0' target='0' unit='0'/>
</disk>

VM 启动期间失败并显示以下消息：

error: Failed to start domain playground
error: internal error: qemu unexpectedly closed the monitor: 2020-09-06T20:25:32.047663Z qemu-system-x86_64: -blockdev {"driver":"file","filename":"/var/lib/libvirt/images/awesome.qcow2","node-name":"libvirt-2-storage","auto-read-only":true,"discard":"unmap"}: Could not open '/var/lib/libvirt/images/awesome.qcow2': Permission denied

权限正确，我已通过禁用 AppArmor 进行验证，并且内核日志中打印了以下内容：

[10757.098291] audit: type=1400 audit(1599423932.042:131): apparmor="DENIED" operation="open" profile="libvirt-b68582b8-0f35-4298-afd8-45c89ff3cbaa" name="/var/lib/libvirt/images/awesome.qcow2" pid=8654 comm="qemu-system-x86" requested_mask="r" denied_mask="r" fsuid=64055 ouid=64055

查看virt-aa-helper在/etc/apparmor.d/libvirt/中生成的配置文件（虚拟机启动时），我可以看到以下内容：

# DO NOT EDIT THIS FILE DIRECTLY. IT IS MANAGED BY LIBVIRT.
  "/var/log/libvirt/**/playground.log" w,
  "/var/lib/libvirt/qemu/domain-playground/monitor.sock" rw,
  "/var/lib/libvirt/qemu/domain-17-playground/*" rw,
  "/run/libvirt/**/playground.pid" rwk,
  "/run/libvirt/**/*.tunnelmigrate.dest.playground" rw,
  "/var/lib/libvirt/images/ubuntu-20.04.1-live-server-amd64.iso" rk,
  "/dev/vhost-net" rw,
  "/var/lib/libvirt/qemu/domain-17-playground/{,**}" rwk,
  "/var/lib/libvirt/qemu/channel/target/domain-17-playground/{,**}" rwk,
  "/var/lib/libvirt/qemu/domain-17-playground/master-key.aes" rwk,
  "/dev/net/tun" rwk,

由于某种原因，磁盘路径丢失，而正确添加了 ISO。我可以在 /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper:

中看到默认池的路径

[...]
@{HOME}/ r,
@{HOME}/** r,
/var/lib/libvirt/images/ r,
/var/lib/libvirt/images/** r,
# nova base images (LP: #907269)
/var/lib/nova/images/** r,
[...]

我怀疑卷中的磁盘文件应该有一个条目。为什么 virt-aa-helper 不添加它？

Answer 1

这似乎是 Ubuntu 中 libvirt 包中已确认的错误：https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1677398

virt-aa-helper 不会在 AppArmor 生成的规则中添加存储池路径

virt-aa-helper doesn't add path for storage pool in AppArmor generated rules

qemu

libvirt

apparmor

virsh