{"id":2992,"date":"2019-07-10T19:47:06","date_gmt":"2019-07-10T18:47:06","guid":{"rendered":"https:\/\/kudzia.eu\/b\/?p=2992"},"modified":"2025-08-30T06:02:41","modified_gmt":"2025-08-30T05:02:41","slug":"error-internal-error-unable-to-execute-qemu-command-transaction-could-not-create-file-permission-denied-when-creating-a-snapshot-under-kvm","status":"publish","type":"post","link":"https:\/\/kudzia.eu\/b\/2019\/07\/error-internal-error-unable-to-execute-qemu-command-transaction-could-not-create-file-permission-denied-when-creating-a-snapshot-under-kvm\/","title":{"rendered":"&#8220;error: internal error: unable to execute QEMU command &#8216;transaction&#8217;: Could not create file: Permission denied&#8221; when creating a snapshot under KVM"},"content":{"rendered":"<p>debian buster brings apparmor. apparmor brings problems &#8211; eg it&#8217;s too restrictive for libvirt KVM guests and does not allow KVM to create snapshot-related files in VM&#8217;s folders.<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nroot@virt1:~# virsh snapshot-create-as --domain rtr0b -name backup-rtr0 --no-metadata --atomic --disk-only --diskspec vda,snapshot=external --diskspec vdb,snapshot=external\r\nerror: internal error: unable to execute QEMU command &#039;transaction&#039;: Could not create file: Permission denied\r\n<\/pre>\n<p>so far i did not find a clean and generic way to address it so i had to disable apparmor for libvirt by adding <i>security_driver = &#8220;none&#8221;<\/i> in \/etc\/libvirt\/qemu.conf ; vm-specific solutions that i&#8217;ve found are described <a href=\"https:\/\/askubuntu.com\/questions\/741035\/disabling-apparmor-for-kvm\">here<\/a> and <a href=\"https:\/\/unix.stackexchange.com\/questions\/435837\/how-to-configure-apparmor-so-that-kvm-can-start-guest-that-has-a-backing-file-ch\">here<\/a>.<\/p>\n<p>i hope to eventually find a proper way of relaxing security settings so apparmor is still on for libvirt yet snapshot files can be created.<\/p>\n<p>relevant debian bug report: <a href=\"https:\/\/bugs.debian.org\/cgi-bin\/bugreport.cgi?bug=932456\">https:\/\/bugs.debian.org\/cgi-bin\/bugreport.cgi?bug=932456<\/a><\/p>\n<p>&nbsp;<\/p>\n<p><strong>2025-08-30<\/strong>: this issue affects also Debian Trixie \/ 13. workaround &#8211; setting <i>security_driver = &#8220;none&#8221;<\/i> \u00a0for qemu and rebooting the server still works. but it&#8217;s not pretty. related bugs:<\/p>\n<ul>\n<li><a href=\"https:\/\/gitlab.com\/libvirt\/libvirt\/-\/issues\/622\">https:\/\/gitlab.com\/libvirt\/libvirt\/-\/issues\/622<\/a><\/li>\n<li><a href=\"https:\/\/gitlab.com\/libvirt\/libvirt\/-\/issues\/806\">https:\/\/gitlab.com\/libvirt\/libvirt\/-\/issues\/806<\/a><\/li>\n<li><a href=\"https:\/\/bugs.debian.org\/cgi-bin\/bugreport.cgi?bug=932456\">https:\/\/bugs.debian.org\/cgi-bin\/bugreport.cgi?bug=932456<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>debian buster brings apparmor. apparmor brings problems &#8211; eg it&#8217;s too restrictive for libvirt KVM guests and does not allow KVM to create snapshot-related files in VM&#8217;s folders. root@virt1:~# virsh snapshot-create-as &#8211;domain rtr0b -name backup-rtr0 &#8211;no-metadata &#8211;atomic &#8211;disk-only &#8211;diskspec vda,snapshot=external &#8211;diskspec vdb,snapshot=external error: internal error: unable to execute QEMU command &#039;transaction&#039;: Could not create file: [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17,51],"tags":[103,28,105,49],"class_list":["post-2992","post","type-post","status-publish","format-standard","hentry","category-tech","category-unimportant","tag-apparmor","tag-debian","tag-debian-buster","tag-kvm"],"_links":{"self":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts\/2992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/comments?post=2992"}],"version-history":[{"count":7,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts\/2992\/revisions"}],"predecessor-version":[{"id":3801,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts\/2992\/revisions\/3801"}],"wp:attachment":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/media?parent=2992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/categories?post=2992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/tags?post=2992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}