Public bug reported:
I configured virt-manager/libvirt to store VM disks in this directory:
/run/media/myuser/VM-DRIVE/QUEMU-VMS/
The directory is on a separate ext4 drive. Other VMs stored on the same
drive work normally.
An OpenWrt VM was working normally from this location. I then created a
backup of its disk image and attached the backup image to the VM as an
additional disk:
openwrt-25.12.4-x86-64-generic-ext4-combined-efi.Failsafe-Backup
After attaching the backup, the VM failed to start with:
Could not open '...Failsafe-Backup': Permission denied
The error presented by virt-manager/libvirt appeared to be a generic
QEMU permission error. However, normal Unix permissions were not the
problem. The file was readable by the libvirt QEMU account:
sudo -u libvirt-qemu test -r <file>
This returned successfully.
The kernel log showed that AppArmor was denying virt-aa-helper:
apparmor="DENIED" operation="open" class="file"
profile="virt-aa-helper"
name="/run/media/myuser/VM-DRIVE/QUEMU-VMS/openwrt-25.12.4-x86-64-generic-ext4-combined-efi.Failsafe-Backup"
requested_mask="r" denied_mask="r"
The VM started successfully after adding a local AppArmor rule
permitting reads from:
/run/media/myuser/VM-DRIVE/QUEMU-VMS/
Expected behavior:
- virt-manager/libvirt should either automatically handle AppArmor
authorization for a custom storage directory, or
- display a clear error stating that AppArmor blocked the path and identify the
affected file.
Actual behavior:
- virt-manager accepted the custom path and attached the disk;
- the VM failed to start;
- the error was reported as a generic QEMU "Permission denied";
- the AppArmor cause was only discoverable by inspecting the kernel audit log.
***
Distribution: Kubuntu 26.04.1
Desktop environment: KDE Plasma 6.6
virt-manager version: 5.1.0
libvirt version: 12.0.0
QEMU version: 10.2.1 (Debian 1:10.2.1+ds-1ubuntu3.2)
AppArmor version/status: 5.0.2
Filesystem: ext4
Storage path: /run/media/myuser/VM-DRIVE/QUEMU-VMS/
**To Reproduce**
1. Configure virt-manager/libvirt to use a custom storage directory on an ext4
filesystem:
`/run/media/myuser/VM-DRIVE/QUEMU-VMS/`
2. Create or open a VM whose primary disk image is stored in that directory.
3. Confirm that the VM starts successfully.
4. Create a backup copy of the VM disk image in the same directory:
`openwrt-25.12.4-x86-64-generic-ext4-combined-efi.Failsafe-Backup`
5. Attach the backup image to the same VM as an additional virtual disk.
6. Start the VM.
7. The VM fails to start with:
`Could not open ...Failsafe-Backup: Permission denied`
8. Inspect the kernel log:
`sudo journalctl -k --since "5 minutes ago" | grep -i -E
'apparmor|denied|virt-aa-helper'`
9. The log shows that AppArmor denied `virt-aa-helper` access to the backup
image.
**System**
- Distribution: Kubuntu 26.04.1
- Desktop environment: KDE Plasma 6.6
- virt-manager version: 5.1.0
- libvirt version: 12.0.0
- QEMU version: 10.2.1 (Debian 1:10.2.1+ds-1ubuntu3.2)
- AppArmor version/status: 5.0.2
- Filesystem: ext4
- Storage path: `/run/media/myuser/VM-DRIVE/QUEMU-VMS/`
**Additional context**
The original VM disk worked before the backup image was attached. Other
VMs stored on the same ext4 drive continued to work.
The file was readable by the libvirt QEMU account:
sudo -u libvirt-qemu test -r <backup-file>
The problem was resolved by adding this AppArmor local rule:
/run/media/myuser/VM-DRIVE/QUEMU-VMS/ r,
/run/media/myuser/VM-DRIVE/QUEMU-VMS/** r,
This suggests that the problem is related to AppArmor authorization for
the custom storage path, rather than ordinary Unix file permissions.
The failure is difficult to diagnose because virt-manager/libvirt
reports a generic QEMU permission error instead of identifying that
AppArmor blocked `virt-aa-helper`.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: libvirt-daemon-system 12.0.0-1ubuntu5.3
ProcVersionSignature: Ubuntu 7.0.0-34.34-generic 7.0.14
Uname: Linux 7.0.0-34-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Thu Sep 24 20:31:24 2026
InstallationDate: Installed on 2025-12-31 (267 days ago)
InstallationMedia: Kubuntu 25.10 "Questing Quokka" - Release amd64 (20251007)
SourcePackage: libvirt
UpgradeStatus: Upgraded to resolute on 2026-05-14 (132 days ago)
** Affects: libvirt (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2168412
Title:
AppArmor blocks virt-aa-helper for an attached disk in a custom
storage path, producing an opaque QEMU permission error
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/2168412/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
