http://bugzilla.suse.com/show_bug.cgi?id=1078498 http://bugzilla.suse.com/show_bug.cgi?id=1078498#c3 --- Comment #3 from Marcus Meissner --- I nmeeded to stop apparmor to get the functionality back. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1078498 http://bugzilla.suse.com/show_bug.cgi?id=1078498#c5 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(meissner@suse.com | |) | --- Comment #5 from Marcus Meissner --- Created attachment 758348 --> http://bugzilla.suse.com/attachment.cgi?id=758348&action=edit virtd-audit.log virtd-audit.log it shows some denys at least -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1078498 http://bugzilla.suse.com/show_bug.cgi?id=1078498#c7 James Fehlig changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(meissner@suse.com | |) --- Comment #7 from James Fehlig --- (In reply to James Fehlig from comment #6)

...

type=AVC msg=audit(1517402656.418:16535): apparmor="DENIED" operation="open" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/libvirtd" name="" pid=9072 comm="libvirtd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

This implies the libvirtd apparmor profile needs the 'attach_disconnected' flag, but the 42.3 package should already have that. For more info see https://bugzilla.opensuse.org/show_bug.cgi?id=1045158#c4

I recall someone else hitting a similar issue, which they resolved by nuking the apparmor cache dir contents and restarting apparmor. Perhaps you also need such drastic measure :-).

Marcus, is this the case? Is the cached libvirtd profile not being updated properly? I suppose you could re-parse the profile and skip the cache with apparmor_parser --skip-cache -r /etc/apparmor.d/usr.sbin.libvirtd Do you see the denial after re-parsing the profile? -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1078498 http://bugzilla.suse.com/show_bug.cgi?id=1078498#c9 James Fehlig changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |INVALID --- Comment #9 from James Fehlig --- The various libvirt apparmor profile that live in /etc/apparmor.d/ are marked %config(noreplace). Closing the bug. Please reopen if you still have problems after replacing/merging your local changes. -- You are receiving this mail because: You are on the CC list for the bug.