Bug 1783255

Summary:	<nvram> auto-creation does not honour permissions defined in libvirtd.conf
Product:	[Community] Virtualization Tools	Reporter:	Mark Zealey <m>
Component:	libvirt	Assignee:	khanicov
Status:	CLOSED NEXTRELEASE	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	am, khanicov, libvirt-maint, madko
Target Milestone:	---	Keywords:	Upstream
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	libvirt-7.4.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-06-17 10:47:00 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mark Zealey 2019-12-13 12:58:43 UTC

Description of problem: <nvram> auto-creation does not honour permissions defined in libvirtd.conf


Version-Release number of selected component (if applicable): libvirt-4.5.0-23.el7_7.1.x86_64


How reproducible: Always


Steps to Reproduce:
1. Set libvirtd.conf to have user = XXX and group = XXX where XXX is non-root and qemu.conf to have dynamic_ownership = 0
2. virsh create a domain with <nvram> component which instantiates from a template


Actual results:

It has created the file but given it root permissions. 

error: Failed to create domain from XML
error: internal error: qemu unexpectedly closed the monitor: 2019-12-13T14:52:42.059479Z qemu-kvm: -drive file=.../OVMF_VARS.fd,if=pflash,format=raw,unit=1: Could not open '.../OVMF_VARS.fd': Permission denied


Expected results:

The template file should be correctly instantiated owned by the user/group specified in libvirtd.conf rather than root.root. This is the case of eg block operations while running so no idea why it's not being applied to nvram created from a template.

Additional info:

Setting dynamic_ownership = 1 fixes this but messes up other permissions in other parts of the system.

Comment 1 khanicov 2021-05-21 11:43:16 UTC

Patches proposed on the list:
https://listman.redhat.com/archives/libvir-list/2021-May/msg00647.html

Comment 2 khanicov 2021-05-21 16:20:02 UTC

Merged upstream as:

gbcdaa91a27 qemu: Use qemuDomainOpenFile() in qemuPrepareNVRAM()

v7.3.0-252-gbcdaa91a27