Re: libvirt dynamic file ownership

[Martin Kletzander <mkletzan@xxxxxxxxxx>]

On Mon, Mar 23, 2020 at 10:03:13AM -0500, Joe Muro wrote:
> Hi Martin, thanks for the explanation. Now I understand why libvirt doesn't
> revert the file permissions back to the original. I am running these VMs on
> an isolated test machine, so I'll disable dynamic file ownership and make
> sure libvirt has access to image files.

Or access the disks only using libvirt and friends ;)

Also, is there no upgrade for the libvirt package?  Maybe I don't exactly
remember if anything else is needed.  Adding Michal to Cc since he'll know more.

> Sorry about the message formatting. I modified settings on my client,
> hopefully it sends plaintext now. (I'll switch to personal email going
> forward, as the choice of email clients at work is limited.)

No problem, you couldn't know unless you specifically looked for it, don't worry
about it ;)

> -Joe
>
>
>
> From:	Martin Kletzander <mkletzan@xxxxxxxxxx>
> To:	Joe Muro <joemuro@xxxxxxxxxx>
> Cc:	libvirt-users@xxxxxxxxxx
> Date:	03/20/2020 04:01 PM
> Subject:	[EXTERNAL] Re: libvirt dynamic file ownership
>
>
>
> On Fri, Mar 20, 2020 at 03:38:36PM +0000, Joe Muro wrote:
> > Hi,
>
> Hi, could you please configure your client to send plaintext version as
> well?
> We mainly prefer plaintext on this list ;-)
>
> > I am trying to understand libvirt dynamic ownership behavior. I have a VM
> that
> > uses a qcow2 image with the following permissions:
> >
> > $ ll t257kvxg-10-20-101-40.qcow2
> > -rw-r--r-- 1 jmuro libvirt 2279079936 Mar 20 11:10
> t257kvxg-10-20-101-40.qcow2
> > When I start the domain the permissions are changed:
> >
> > $ virsh start t257kvxg-10-20-101-40
> > Domain t257kvxg-10-20-101-40 started
> > $ ll t257kvxg-10-20-101-40.qcow2
> > -rw-r--r-- 1 libvirt-qemu libvirt 2279079936 Mar 20 11:18
> > t257kvxg-10-20-101-40.qcow2
> >
> > This is expected behavior based on the settings in /etc/libvirt/qemu.conf:
> >
> > user = "libvirt-qemu"
> > group = "libvirt"
> > # Whether libvirt should dynamically change file ownership
> > # to match the configured user/group above. Defaults to 1.
> > # Set to 0 to disable file ownership changes.
> > #dynamic_ownership = 1
> >
> > However, when I shutdown the domain, the file permissions revert to root.
> >
> > $ ll t257kvxg-10-20-101-40.qcow2
> > -rw-r--r-- 1 root root 2282749952 Mar 20 11:20 t257kvxg-10-20-101-40.qcow2
> >
> > I expect libvirt to revert the file permissions back to the original.
> > Otherwise, a regular user would lose ownership of the image file. FWIW: I
> am
> > starting the domain as a non-root user under qemu:///system
>
> This has always been the case because the original information is lost
> (which is
> actually not that easy to store properly, race-free, etc.) and the safest
> way to
> make sure nobody accesses the disks (e.g. another domain running under
> libvirt-qemu:libvirt, that would get exploited) is to just change it to
> root:root.  Michal finally managed to make this work, in limited cases, but
> I
> think it landed in 6.1.0, I'm not sure.
>
> Anyway, there are some workarounds you can do:
>
>  a) set relabel=no for the disk in the XML (and make sure the VM will be
> able to
>     access it),
>
>  b) set relabel=no for the whole domain (and make sure the VM will be able
> to
>     access everything), or
>
>  c) if worse comes to worse, just disable the whole dynamic ownership and
> handle
>     it yourself
>
> If possible, try upgrading libvirt and checking if that helps.
>
> > I am running on Ubuntu 20.04 LTS (Focal Fossa) with the following libvirt
> > level:
> >
> > libvirt-clients/focal,now 6.0.0-0ubuntu5 s390x [installed]
> > libvirt-daemon-driver-qemu/focal,now 6.0.0-0ubuntu5 s390x
> [installed,automatic]
> > libvirt-daemon-driver-storage-rbd/focal,now 6.0.0-0ubuntu5 s390x
> > [installed,automatic]
> > libvirt-daemon-system-systemd/focal,now 6.0.0-0ubuntu5 s390x
> > [installed,automatic]
> > libvirt-daemon-system/focal,now 6.0.0-0ubuntu5 s390x [installed]
> > libvirt-daemon/focal,now 6.0.0-0ubuntu5 s390x [installed]
> > libvirt-glib-1.0-0/focal,now 2.0.0-2 s390x [installed,automatic]
> > libvirt0/focal,now 6.0.0-0ubuntu5 s390x [installed,automatic]
> > python3-libvirt/focal,now 6.0.0-0ubuntu3 s390x [installed]
> >
> > Thanks
> >
> > -Joe
> [attachment "signature.asc" deleted by Joe Muro/Poughkeepsie/IBM]

Attachment: signature.asc
Description: PGP signature