Bug 668692

Rebases of the two upstream commits noted below have been posted to rhvirt-patches:


commit d596c6dc9b64ca0c910a87127de72ed2ef47b692
Author: Laine Stump <laine>
Date:   Thu Dec 23 01:44:02 2010 -0500

    new virSetUIDGID() utility function
    
commit f42cf7cb7902196382a65e5316c974a5c2106401
Author: Laine Stump <laine>
Date:   Tue Dec 21 15:34:41 2010 -0500

    Replace setuid/setgid/initgroups with virSetUIDGID()

Sorry for comment 7,Setps same as bug 64406. 
Issue reproduce on build libvirt-0.8.1-27.el6_0.6.x86_64:

steps:
1, setup a NFS server with exports configuration as follows
/tmp/nfstest  *(rw,root_squash)

2, copy a guest image file into the shared fold. Using chmod+chown to set the
access right ,ownership and groupship of the image file to (otheruser):kvm, the
other user
shouldn't be qemu.

# chown 500:36  http_test.qcow2
# chmod 755 http_test.qcow2

3, In the client machine, mount the NFS shared folder, then, try to boot up a
guest which use the image file as its OS disk.


[reproducer]
# virsh start test
error: Failed to start domain test
error: internal error Process exited while reading console log output: char
device redirected to /dev/pts/8
qemu: could not open disk image /mnt/http_test.qcow2: Permission denied

You're doing ``chmod 755 http_test.qcow2'' which means qemu (a member of kvm group) will only be able to read or execute the image while it most likely wants to open that file in rw mode. You should rather do ``chmod 664 http_test.qcow2'' (or 775 if you want the execute permission as well).

Moving back to ON_QA per comment 9.

Setps same as bug 664406 comment 10. 
Verified it build libvirt-0.8.1-27.el6_0.6.x86_64:

steps:
On NFS Server:
1.Make a NFS share path, and use chmod to change it have all permissions.
# mkdir /tmp/nfstest

2.Setup a NFS server with exports configuration as follows.
/tmp/nfstest  *(rw,root_squash)

3.Copy a guest image file into the shared fold. Using chmod+chown to set the
access right ,ownership and groupship of the image file to (otheruser):kvm, the
other user
shouldn't be qemu.

# chown 500:36  rhel61.img
# chmod 664 rhel61.img
# ll -Z rhel61.img 
-rw-rw-r--. ken kvm unconfined_u:object_r:user_tmp_t:s0 rhel61.img


On clinet:

4. In the client machine, mount the NFS shared folder, then, try to boot up a
guest which use the image file as its OS disk.

# mount -o vers=3 10.66.4.210:/tmp/nfstest/ /mnt

5.# virsh start vm2
Domain vm2 started

the ownership wasn't changed by qemu , and it kept kvm group .
# ll -Z /mnt/
-rw-rw-r--. zpeng kvm system_u:object_r:nfs_t:s0       rhel61.img 

So set bug status to VERIFIED

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0479.html