apparmor is basically stopping libvirt hosts from running.
The reporting is pretty terrible, I'm not sure what file it is trying to
find. The only thing in the logs is the audit lines.

Removing those /etc/apparmor.d/libvirt/libvirt* files fixed the problem
I suspect the zero length file is the problem.

virsh # start Webserver
error: Failed to start domain Webserver
error: internal error: Process exited prior to exec: libvirt:  error : unable to set AppArmor profile 'libvirt-fe259d01-e56e-6523-f3d0-2e8f26a843e4' for '/usr/bin/kvm': No such file or directory

$ ls -l /etc/apparmor.d/libvirt/
total 12
-rw-r--r-- 1 root root   0 Feb 10 21:08 libvirt-fe259d01-e56e-6523-f3d0-2e8f26a843e4
-rw-r--r-- 1 root root 582 Feb 11 09:30 libvirt-fe259d01-e56e-6523-f3d0-2e8f26a843e4.files
-rw-r--r-- 1 root root 342 Sep 19 04:24 TEMPLATE.lxc
-rw-r--r-- 1 root root 192 Sep 19 04:24 TEMPLATE.qemu

Kernel log:
[ 3395.875800] audit: type=1400 audit(1518301842.322:35): apparmor="DENIED" operation="change_profile" info="label not found" error=-2 profile="/usr/sbin/libvirtd" name="libvirt-fe259d01-e56e-6523-f3d0-2e8f26a843e4" pid=25196 comm="libvirtd"

Hi!

Craig Small:

Ouch.

Indeed, something went wrong when dynamically generating the profile.
I'm reassigning to the package that ships virt-aa-helper.
What version of libvirt-daemon-system do you have?

Cheers,

I am currently running 4.0.0-2 but I'm not sure if that was the version
that created the file.
The strange thing is I have had apparmor running for months and that
virtual host for a year or more, so I'm not sure why it happened now.

 - Craig
-- 
Craig Small             https://dropbear.xyz/     csmall at : dropbear.xyz
Debian GNU/Linux        https://www.debian.org/   csmall at : debian.org
Mastodon: @smallsees@social.dropbear.xyz             Twitter: @smallsees
GPG fingerprint:      5D2F B320 B825 D939 04D2  0519 3938 F96B DF50 FEA5

Control: tag -1 + unreproducible

Hi Craig,

did this problem happen again? If it ever does, please share the
output of "sudo journalctl -u libvirtd.service" and the relevant
file timestamps.

I'm using libvirt + AppArmor heavily and have never seen it myself :/

Cheers,

Dear Maintainer,

this happened yesterday again. It is most likely related to a restart
of the host system.

After removing the apparmor.d profiles with zero length, the vm started as expected.

The bug report asks about the output of "sudo journalctl -u libvirtd.service" and the relevant
file timestamps:

Okt 22 18:06:47 h2700532 libvirtd[723]: Domain id=11 name='sambaDC' uuid=07fbaa3b-d6e8-494f-89e3-6802ee0cff16 is tainted: custom-argv
Okt 22 18:06:48 h2700532 libvirtd[723]: Child quit during startup handshake: Eingabe-/Ausgabefehler
Okt 22 18:06:48 h2700532 libvirtd[723]: internal error: Process exited prior to exec: libvirt:  error : unable to set AppArmor profile 'libvirt-07fbaa3b-d6e8-494f-89e3
Okt 23 08:22:43 h2700532 libvirtd[723]: Domain id=12 name='vpnServer' uuid=b3279270-c20e-4aa6-9f8d-48859775e71e is tainted: custom-argv
Okt 23 08:22:43 h2700532 libvirtd[723]: Child quit during startup handshake: Eingabe-/Ausgabefehler
Okt 23 08:22:43 h2700532 libvirtd[723]: internal error: Process exited prior to exec: libvirt:  error : unable to set AppArmor profile 'libvirt-b3279270-c20e-4aa6-9f8d
Okt 23 08:22:43 h2700532 libvirtd[723]: Failed to open file '/sys/class/net/vnet11/operstate': Datei oder Verzeichnis nicht gefunden
Okt 23 08:22:43 h2700532 libvirtd[723]: unable to read: /sys/class/net/vnet11/operstate: Datei oder Verzeichnis nicht gefunden