Public bug reported:
This is similar to
https://bugs.launchpad.net/ubuntu/+source/passt/+bug/2154379 but now
libvirtd cannot send signals to passt on Ubuntu 26.04 when VM is
stopped:
kernel: audit: type=1400 audit(1793749636.263:332): apparmor="DENIED"
operation="signal" class="signal" profile="passt" pid=1706 comm="rpc-libvirtd"
requested_mask="receive" denied_mask="receive" signal=term peer="libvirtd"
kernel: audit: type=1400 audit(1793749636.263:331): apparmor="DENIED"
operation="signal" class="signal" profile="libvirtd" pid=1706
comm="rpc-libvirtd" requested_mask="send" denied_mask="send" signal=term
peer="passt"
libvirtd[1706]: Failed to terminate process 8846 with SIGTERM: Permission denied
Reproduce:
0) If you need kvm then add your user to kvm group, do not add your user to
libvirt group
1) You need to connect to libvirt in session mode (usually qemu:///session)
2) Create some VM
3) Enable passt backend for user-mode networking (<backend type="passt"/>) and
forward some port:
<interface type="user">
<mac address="52:54:00:00:00:00"/>
<model type="virtio"/>
<backend type="passt"/>
<portForward proto="tcp">
<range start="8080" to="80"/>
</portForward>
<address type="pci" domain="0x0000" bus="0x01" slot="0x00" function="0x0"/>
</interface>
4) start VM
5) stop VM
6) if you start VM again it will fail because tcp port is in use by previous
instance of passt
The previous passt instance wasn't stopped due to apparmor.
Versions:
passt 0.0~git20260120.386b5f5-1
libvirt-daemon 12.0.0-1ubuntu5.5
apparmor 5.0.2-0ubuntu1~26.04.1
** Affects: apparmor
Importance: Undecided
Status: New
** Affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
** Affects: libvirt (Ubuntu)
Importance: Undecided
Status: New
** Affects: passt (Ubuntu)
Importance: Undecided
Status: New
** Also affects: apparmor
Importance: Undecided
Status: New
** Also affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
** Also affects: libvirt (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172904
Title:
pasta is not allowed to receive signals from libvirt due to apparmor
To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/2172904/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
