Live Migration Failure With Error "Unable to find security driver for model apparmor"

Problem

The live migration of an instance is failing with the following error observed in the /var/log/pf9/ostackhost.log.

ERROR nova.virt.libvirt.driver [...] [instance: 927bc3fc-d4da-4bd3-b871-9f125f478fd0] Live Migration failure: unsupported configuration: Unable to find security driver for model apparmor: libvirt.libvirtError: unsupported configuration: Unable to find security driver for model apparmor

Environment

• Platform9 Managed OpenStack - All versions.
• Nova
• Libvirt
• AppArmor

Cause

The live migration is failing because the libvirt profile was not loaded in AppArmor.

Resolution

1. Run the following command to check if the libvirt__profile is loaded in AppArmor.

$ sudo aa-status

apparmor module is loaded.

0 profiles are loaded.

0 profiles are in enforce mode.

0 profiles are in complain mode.

0 processes have profiles defined.

0 processes are in enforce mode.

0 processes are in complain mode.

0 processes are unconfined but have a profile defined.

2. Run the following commands to add the libvirt profiles to AppArmor.

# sudo aa-complain /etc/apparmor.d/usr.sbin.libvirtd

# sudo aa-enforce /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper

3. Restart the libvirtd service.

# service libvirtd restart