Re: [libvirt-users] error : Failed to switch root mount into slave mode: Permission denied
On 26.02.2017 18:29, Kyle Peterson wrote:
libvirt-3.0.0
When attemping to create a virtual machine I receive the error "error : Failed to
switch root mount into slave mode: Permission denied”.
I’m attempting to run qemu/libvirt/virt-manager in an Arch Linux lxc container on a
Ubuntu 16.04 host. The host uses zfs for its containers. The arch container is set up as
a priveleged container. I do already have kvm/qemu/libvirt working in a Ubuntu container.
The reason for the arch container is because I want to try a newer version of
qemu/libvirt.
I’m not finding anything on google about this error message. Any way to get around it?
Hey,
with 3.0.0 release qemu domains are started under a namespace too
(because of the error message I assume you're trying to start a qemu
domain). So far, every domain has its own /dev managed by libvirt. There
were two reasons for it:
a) avoid relabelling race with udev
b) enhance security as only configured devices are created in the namespace.
Therefore, when starting new qemu domain, libvirt calls
unshare(CLONE_NEWNS) and then tries to remount the root "/" into slave
mode so that all mounts from the master (= parent ns) are visible in the
namespace but not vice versa. Since you mention Ubuntu - could it be
that it is AppArmor that is denying the operation? Because frankly, I've
read some bug reports that AppArmor was denying libvirt to create a new
namespace but I'm no AppArmor expert and I don't know how to fix it.
There is a workaround too, just set:
namespaces = []
in qemu.conf, restart libvirtd and you should be all set.
BTW, the 3.1.0-rc1 release is out and it contains a lot of qemu
namespace fixes. So you might try that.
Michal