apparmor denies loading modules on 14.04.5+

[dejonghb]

On an fresh installed ubuntu LTS 14.04 (results in 14.04.5 now) loading of the .so files from /usr/lib/x86_64-linux-gnu/qemu is denied by apparmor

Failed to open module: /usr/lib/x86_64-linux-gnu/qemu/block-curl.so: failed to map segment from shared object: Permission denied
Failed to open module: /usr/lib/x86_64-linux-gnu/qemu/block-rbd.so: failed to map segment from shared object: Permission denied
Failed to open module: /usr/lib/x86_64-linux-gnu/qemu/block-openvstorage.so: failed to map segment from shared object: Permission denied

where dmesg has

[Wed Aug 17 12:36:30 2016] type=1400 audit(1471430192.746:197): apparmor="DENIED" operation="file_mmap" profile="libvirt-1a44dafb-c8df-532a-8444-c052167d18ac" name="/usr/lib/x86_64-linux-gnu/qemu/block-curl.so" pid=20443 comm="qemu-system-x86" requested_mask="m" denied_mask="m" fsuid=105 ouid=0
[Wed Aug 17 12:36:30 2016] type=1400 audit(1471430192.746:198): apparmor="DENIED" operation="file_mmap" profile="libvirt-1a44dafb-c8df-532a-8444-c052167d18ac" name="/usr/lib/x86_64-linux-gnu/qemu/block-rbd.so" pid=20443 comm="qemu-system-x86" requested_mask="m" denied_mask="m" fsuid=105 ouid=0
[Wed Aug 17 12:36:30 2016] type=1400 audit(1471430192.746:199): apparmor="DENIED" operation="file_mmap" profile="libvirt-1a44dafb-c8df-532a-8444-c052167d18ac" name="/usr/lib/x86_64-linux-gnu/qemu/block-openvstorage.so" pid=20443 comm="qemu-system-x86" requested_mask="m" denied_mask="m" fsuid=105 ouid=0

Newer /etc/apparmor.d/abstractions/libvirt-qemu has (among others) following lines added:

for qemu-block-extra

/usr/lib/@{multiarch}/qemu/*.so rm,

[wimpers]

@dejonghb What should be done to tackle this ticket? Do we need to create a new QEMU build?

[dejonghb]

/etc/apparmor.d/abstractions/libvirt-qemu comes from the libvirt-bin package, which is something we provide via our apt repo and is built from https://github.com/openvstorage/libvirt (private)

Sure looks like the libvirt repo needs updating to be on par with newer ubuntu releases. No idea which upstream was used and if any ubuntisms are included or not; but @cnanakos should be able to provide more info on that.

[cnanakos]

There are no changes included besides the ones for OpenvStorage. The package is based on the one provided by the official Ubuntu packages (1.2.2-0ubuntu13.1.17).

[wimpers]

@dejonghb @cnanakos is this still relevant as we have moved to 16.04 or can we close this ticket?

[dejonghb]

If all is fine on 16.04 -- has this been checked/tested ? -- and 14.04.x is considered obsolete, no problem with closing this one.