Bug 908007

Summary: virt-manager: Unable to migrate guest: unsupported configuration: Unable to find security driver for label apparmor
Product: [openSUSE] openSUSE Tumbleweed Reporter: Martin Pluskal <mpluskal>
Component: BasesystemAssignee: Cédric Bosdonnat <cbosdonnat>
Status: RESOLVED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Normal    
Priority: P5 - None CC: carnold, jfehlig, mpluskal
Version: 201412*   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Bug Depends on:    
Bug Blocks: 908008    
Attachments: virt-manager --debug

Description Martin Pluskal 2014-12-02 14:53:40 UTC
Created attachment 615639 [details]
virt-manager --debug

When trying to migrate vm via virt-manager between machines with opensuse-factorty, following error is raised:

Unable to migrate guest: unsupported configuration: Unable to find security driver for label apparmor

Traceback (most recent call last):
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 89, in cb_wrapper
    callback(asyncjob, *args, **kwargs)
  File "/usr/share/virt-manager/virtManager/migrate.py", line 547, in _async_migrate
    vm.migrate(dstconn, migrate_uri, rate, live, secure, unsafe, meter=meter)
  File "/usr/share/virt-manager/virtManager/domain.py", line 1446, in migrate
    self._backend.migrate(destconn, flags, newname, interface, rate)
  File "/usr/lib64/python2.7/site-packages/libvirt.py", line 1458, in migrate
    if ret is None:raise libvirtError('virDomainMigrate() failed', dom=self)
libvirtError: unsupported configuration: Unable to find security driver for label apparmor
Comment 1 Charles Arnold 2014-12-02 16:07:43 UTC
Jim,
Is this issue addressed with recent libvirt fixes for migration?
Comment 2 James Fehlig 2014-12-02 16:24:03 UTC
(In reply to Charles Arnold from comment #1)
> Jim,
> Is this issue addressed with recent libvirt fixes for migration?

No, but might be related to recent changes in the security driver configuration.  Cedric, can you take a look?
Comment 3 Cédric Bosdonnat 2014-12-03 13:33:41 UTC
(In reply to James Fehlig from comment #2)
> (In reply to Charles Arnold from comment #1)
> > Jim,
> > Is this issue addressed with recent libvirt fixes for migration?
> 
> No, but might be related to recent changes in the security driver
> configuration.  Cedric, can you take a look?

That really looks like the default changes for qemu security driver could fix that. Do you have the following change in your libvirt installations? 

> Tue Nov 18 17:21:55 UTC 2014 - cbosdonnat@suse.com
>
> - Remove security_driver = "none" in qemu config. This completely
>  disabled all security drivers instead of probing them.
> - Changed default value of QEMU's security_default_confined to 0 to
>  keep QEMU domains unconfined by default.

In any case, it would be good to check /etc/libvirt/qemu.conf file to:
  * not have the line security_driver = "none"
  * have security_default_confined = 0 or 0 set as a default value for it.
Comment 4 Martin Pluskal 2014-12-03 14:10:48 UTC
(In reply to Cédric Bosdonnat from comment #3)
> (In reply to James Fehlig from comment #2)
> > (In reply to Charles Arnold from comment #1)
> > > Jim,
> > > Is this issue addressed with recent libvirt fixes for migration?
> > 
> > No, but might be related to recent changes in the security driver
> > configuration.  Cedric, can you take a look?
> 
> That really looks like the default changes for qemu security driver could
> fix that. Do you have the following change in your libvirt installations? 
> 
> > Tue Nov 18 17:21:55 UTC 2014 - cbosdonnat@suse.com
> >
> > - Remove security_driver = "none" in qemu config. This completely
> >  disabled all security drivers instead of probing them.
> > - Changed default value of QEMU's security_default_confined to 0 to
> >  keep QEMU domains unconfined by default.
Well I can not reproduce issue with packages from Virtualization project on obs, so I guess that Factory was just too old.
> 
> In any case, it would be good to check /etc/libvirt/qemu.conf file to:
>   * not have the line security_driver = "none"
>   * have security_default_confined = 0 or 0 set as a default value for it.
Nope

We can probably close this issue.
Comment 5 James Fehlig 2014-12-03 15:04:45 UTC
Thanks Martin.  I'm going to close this now so I can also close #908008, which depends on it.