Live Migration Failure With Error "Unable to find security driver for model apparmor"

Problem

The live migration of an instance is failing with the following error observed in the /var/log/pf9/ostackhost.log.

None

ERROR nova.virt.libvirt.driver [...] [instance: 927bc3fc-d4da-4bd3-b871-9f125f478fd0] Live Migration failure: unsupported configuration: Unable to find security driver for model apparmor: libvirt.libvirtError: unsupported configuration: Unable to find security driver for model apparmor

Environment

• Platform9 Managed OpenStack - All versions.

• Nova

• Libvirt

• AppArmor

Cause

The live migration is failing because the libvirt profile was not loaded in AppArmor.

Resolution

1. Run the following command to check if the libvirt__profile is loaded in AppArmor.

None

$ sudo aa-status
apparmor module is loaded.
0 profiles are loaded.
0 profiles are in enforce mode.
0 profiles are in complain mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

1. Run the following commands to add the libvirt profiles to AppArmor.

None

# sudo aa-complain /etc/apparmor.d/usr.sbin.libvirtd
# sudo aa-enforce /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper

1. Restart the libvirtd service.

None

# service libvirtd restart