cannot launch instances due to AppArmor profile of qemu-img

[bboozzoo]

Trying to launch Ubuntu Core with Multipass on Arch. Exact version:

$ snap list multipass    
Name       Version                  Rev   Tracking  Publisher   Notes
multipass  0.10.0-dev.125+gb83c589  1443  edge      canonical✓  classic

Launch fails (note there's no actual output from qemu-img):

$ multipass launch core       
launch failed: Cannot read image format: qemu-img failed (program: qemu-img; error: Process crashed) with output:
                                                                                        

There's a denial from AppArmor followed by segfault in dmesg:

[  +0.003430] audit: type=1400 audit(1576165492.211:2585): apparmor="DENIED" 
operation="file_mmap" profile="multipass.qemu-img"
name="/var/lib/snapd/snap/multipass/1425/usr/bin/qemu-img" pid=650244
 comm="qemu-img" requested_mask="rm" denied_mask="rm" fsuid=0 ouid=0
[  +0.000006] audit: type=1701 audit(1576165492.211:2586): auid=4294967295
 uid=0 gid=0 ses=4294967295 subj==multipass.qemu-img (enforce) 
pid=650244 comm="qemu-img" 
exe="/var/lib/snapd/snap/multipass/1425/usr/bin/qemu-img" sig=11 res=1

Can I configure multipass to not use AppArmor profiles for the tools/VMs it runs?

[Saviq]

Hi @bboozzoo, yes you can, just make sure DISABLE_APPARMOR is set - but that will stop working when we move to strict.

What we should do is actually fix the qemu-img profile so that it works for you, too!

[bboozzoo]

I've trued running qemu-img manually with what-would-be the profile generated by multipass and got:

$ sudo aa-exec -p multipass.qemu-img -- /var/lib/snapd/snap/multipass/1425/usr/bin/qemu-img 
/var/lib/snapd/snap/multipass/1425/usr/bin/qemu-img: error while loading shared libraries: libnettle.so.6: cannot open shared object file: No such file or directory

On Arch and Fedora, /snap is a symlink to /var/lib/snapd/snap, so that needs to be accounter for in the profile. I've edited the profile to be like this:

#include <tunables/global>
profile multipass.qemu-img flags=(attach_disconnected) {
  #include <abstractions/base>
  # binary and its libs
  /{,var/lib/snapd/}snap/multipass/1425/usr/bin/qemu-img ixr,
  /{,var/lib/snapd/}snap/multipass/1425/{usr/,}lib/@{multiarch}/{,**/}*.so* rm,

  # CLASSIC ONLY: need to specify required libs from core snap
  /{,var/lib/snapd/}snap/core18/*/{,usr/}lib/@{multiarch}/{,**/}*.so* rm,

  # Subdirectory containing disk image(s)
  /var/snap/multipass/common/** rwk,
}

Seems to work now:

$ sudo apparmor_parser -r ./multipass.qemu-img.profile
$ sudo aa-exec -p multipass.qemu-img -- /var/lib/snapd/snap/multipass/1425/usr/bin/qemu-img 
qemu-img: Not enough arguments
Try 'qemu-img --help' for more information

[Saviq]

Thanks @bboozzoo, we'll get that in asap :)