Instance Creation Failing: "Could not open backing file"

Problem

• Instance creation is failing with the following error.

None

Could not open backing file: Could not open '/opt/pf9/data/instances/_base/[UUID]': Permission denied

• AppArmor is installed/enabled on the hypervisor.

Environment

• Platform9 Managed OpenStack - All Versions

• Nova

• Libvirt

• AppArmor

Cause

The default AppArmor profile for Libvirt does not include access to the instance storage path; thus, the I/O request is blocked.

Resolution

1. Append the following lines to the AppArmor configuration at /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper.

None

/opt/pf9/data/instances/_base/** r,  /opt/pf9/data/instances/** rw,

1. Parse the updated rules.

None

# apparmor_parser -r /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper

Additional Information

Debian – #892431 AppArmor denies access for libvirt to nova instances directory