[libvirt-users] trouble after upgrading from 3.0.0 to 3.1.0

[Michal Privoznik]

On 03/14/2017 05:03 PM, Michael Ströder wrote:
> Michal Privoznik wrote:
>> On 03/14/2017 10:51 AM, Michael Ströder wrote:
>>> HI!
>>>
>>> After the last OS update (openSUSE Tumbleweed) with libvirt being updated from 3.0.0 to
>>> 3.1.0 starting the VMs (qemu-kvm) does not work anymore:
>>>
>>> error: internal error: child reported: Kernel does not provide mount namespace:
>>> Permission denied
>>
>> Hey, this is definitely a libvirt bug. Since 3.1.0 libvirt spawns each
>> qemu in its own mount namespace so that it can have private /dev mount.
>> I've heard that there are some issues with AppArmor - is that what are
>> you using?
> 
> Hmm, yes. I was using AppArmor. Disabling it helped. I will point the author of the
> AppArmor profiles in this direction.

Yeah, I still know that AppArmor is preventing our namespaces code from
working properly. Unfortunately, I don't know much about it, and
certainly not enough to fix it. But maybe I can find somebody who does.

> 
>> Meanwhile, you can disable namespaces by setting:
>>
>>   namespaces=[]
>>
>> in qemu.conf.
> 
> Only setting this did not help.

Have you restarted libvirtd afterwards? Maybe I should have written that
explicitly instead of assuming it. Also, this is meant as a temporary
workaround. Disabling namespaces does not enable the full security
features. Ideally, users would use namespaces without even noticing it.

Michal