[Pkg-libvirt-maintainers] Bug#969457: libvirt-daemon-system: Cannot hot attach NIC

[Sander Klein]

Package: libvirt-daemon-system
Version: 5.0.0-4+deb10u1
Severity: important

Dear Maintainer,

It seems apparmor is denying the hot attach of a NIC to a VM. While trying
to attach a NIC I get:

audit: type=1400 audit(1599123343.785:152): apparmor="DENIED" operation="file_receive" profile="libvirt-87dd6694-43b6-4f40-a62f-fa71525467ab" name="/dev/vhost-net" pid=16384 comm="qemu-system-x86" requested_mask="wr" denied_mask="wr" fsuid=9869 ouid=0

After investigating I found that adding '/dev/vhost-net rw,' to
'/etc/apparmor.d/abstractions/libvirt-qemu' fixes the issue.

Looking at the Ubuntu version of this file it seems that more hotplugging
is not working. They have added:

  # for vhost-net/vsock/scsi hotplug (LP: #1815910)
  /dev/vhost-net rw,
  /dev/vhost-vsock rw,
  /dev/vhost-scsi rw,

Could this be added to the package?

Regards,

Sander Klein



-- System Information:
Debian Release: 10.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-10-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libvirt-daemon-system depends on:
ii  adduser                3.118
ii  debconf [debconf-2.0]  1.5.71
ii  gettext-base           0.19.8.1-9
ii  iptables               1.8.2-4
ii  libacl1                2.2.53-4
ii  libapparmor1           2.13.2-10
ii  libaudit1              1:2.8.4-3
ii  libblkid1              2.33.1-0.1
ii  libc6                  2.28-10
ii  libcap-ng0             0.7.9-2
ii  libdbus-1-3            1.12.20-0+deb10u1
ii  libdevmapper1.02.1     2:1.02.155-3
ii  libgnutls30            3.6.7-4+deb10u5
ii  libnl-3-200            3.4.0-1
ii  libnl-route-3-200      3.4.0-1
ii  libnuma1               2.0.12-1
ii  libselinux1            2.8-1+b1
ii  libvirt-clients        5.0.0-4+deb10u1
ii  libvirt-daemon         5.0.0-4+deb10u1
ii  libvirt0               5.0.0-4+deb10u1
ii  libxml2                2.9.4+dfsg1-7+b3
ii  libyajl2               2.1.0-3
ii  logrotate              3.14.0-4
ii  lsb-base               10.2019051400
ii  policykit-1            0.105-25

Versions of packages libvirt-daemon-system recommends:
ii  dmidecode                    3.2-1
ii  dnsmasq-base [dnsmasq-base]  2.80-1
ii  iproute2                     4.20.0-2
ii  parted                       3.2-25

Versions of packages libvirt-daemon-system suggests:
ii  apparmor    2.13.2-10
pn  auditd      <none>
ii  nfs-common  1:1.3.4-2.5+deb10u1
pn  open-iscsi  <none>
pn  pm-utils    <none>
pn  radvd       <none>
ii  systemd     241-7~deb10u4
pn  systemtap   <none>
pn  zfsutils    <none>

-- Configuration Files:
/etc/libvirt/nwfilter/allow-arp.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-arp.xml'
/etc/libvirt/nwfilter/allow-dhcp-server.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-dhcp-server.xml'
/etc/libvirt/nwfilter/allow-dhcp.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-dhcp.xml'
/etc/libvirt/nwfilter/allow-incoming-ipv4.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-incoming-ipv4.xml'
/etc/libvirt/nwfilter/allow-ipv4.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/allow-ipv4.xml'
/etc/libvirt/nwfilter/clean-traffic-gateway.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/clean-traffic-gateway.xml'
/etc/libvirt/nwfilter/clean-traffic.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/clean-traffic.xml'
/etc/libvirt/nwfilter/no-arp-ip-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-arp-ip-spoofing.xml'
/etc/libvirt/nwfilter/no-arp-mac-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-arp-mac-spoofing.xml'
/etc/libvirt/nwfilter/no-arp-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-arp-spoofing.xml'
/etc/libvirt/nwfilter/no-ip-multicast.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-ip-multicast.xml'
/etc/libvirt/nwfilter/no-ip-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-ip-spoofing.xml'
/etc/libvirt/nwfilter/no-mac-broadcast.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-mac-broadcast.xml'
/etc/libvirt/nwfilter/no-mac-spoofing.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-mac-spoofing.xml'
/etc/libvirt/nwfilter/no-other-l2-traffic.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-other-l2-traffic.xml'
/etc/libvirt/nwfilter/no-other-rarp-traffic.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/no-other-rarp-traffic.xml'
/etc/libvirt/nwfilter/qemu-announce-self-rarp.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/qemu-announce-self-rarp.xml'
/etc/libvirt/nwfilter/qemu-announce-self.xml [Errno 13] Permission denied: '/etc/libvirt/nwfilter/qemu-announce-self.xml'
/etc/libvirt/qemu.conf [Errno 13] Permission denied: '/etc/libvirt/qemu.conf'
/etc/libvirt/qemu/networks/default.xml [Errno 13] Permission denied: '/etc/libvirt/qemu/networks/default.xml'

-- debconf information:
  libvirt-daemon-system/id_warning: true