Bug 877908

Summary: pool permissions have no effect
Product: [Community] Virtualization Tools Reporter: Kamil Páral <kparal>
Component: libvirtAssignee: Libvirt Maintainers <libvirt-maint>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: berrange, clalancette, crobinso, dyuan, itamar, jforbes, jtomko, laine, libvirt-maint, rbalakri, veillard, xuzhang, yanyang
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-04-27 17:07:37 EDT Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Kamil Páral 2012-11-19 03:49:33 EST
Description of problem:
I have adjusted the permissions of my default libvirt pool to 0777 1000:1000.

# virsh pool-dumpxml default
<pool type='dir'>
  <name>default</name>
  <uuid>a6f726d7-afe9-0b27-aa56-8abd32fc9781</uuid>
  <capacity unit='bytes'>179672104960</capacity>
  <allocation unit='bytes'>110910464000</allocation>
  <available unit='bytes'>68761640960</available>
  <source>
  </source>
  <target>
    <path>/var/lib/libvirt/images</path>
    <permissions>
      <mode>0777</mode>
      <owner>1000</owner>
      <group>1000</group>
    </permissions>
  </target>
</pool>

But when I create a new volume in that pool, it has 0700 0:0 :
# virsh vol-create-as default abc 100M
Vol abc created

# ll /var/lib/libvirt/images/abc 
-rw------- 1 root root 104857600 Nov 19 09:34 /var/lib/libvirt/images/abc

That doesn't seem to match the documentation:
permissions
    Provides information about the default permissions to use when creating volumes. This is currently only useful for directory or filesystem based pools, where the volumes allocated are simple files. For pools where the volumes are device nodes, the hotplug scripts determine permissions. It contains 4 child elements. The mode element contains the octal permission set. The owner element contains the numeric user ID. The group element contains the numeric group ID. The label element contains the MAC (eg SELinux) label string. Since 0.4.1 
http://libvirt.org/formatstorage.html


Version-Release number of selected component (if applicable):
libvirt-0.9.11.7-1.fc17.x86_64
libvirt-client-0.9.11.7-1.fc17.x86_64
libvirt-daemon-0.9.11.7-1.fc17.x86_64
libvirt-daemon-config-network-0.9.11.7-1.fc17.x86_64
libvirt-daemon-config-nwfilter-0.9.11.7-1.fc17.x86_64
libvirt-daemon-kvm-0.9.11.7-1.fc17.x86_64
libvirt-python-0.9.11.7-1.fc17.x86_64
python-virtinst-0.600.3-2.fc17.noarch
redland-virtuoso-1.0.15-1.fc17.x86_64
virt-manager-0.9.4-2.fc17.noarch
virt-manager-common-0.9.4-2.fc17.noarch
virt-top-1.0.6-2.fc17.x86_64
virt-viewer-0.5.3-1.fc17.x86_64


How reproducible:
always
Comment 1 Fedora End Of Life 2013-07-03 19:45:18 EDT
This message is a reminder that Fedora 17 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 17. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '17'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 17's end of life.

Bug Reporter:  Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 17 is end of life. If you 
would still like  to see this bug fixed and are able to reproduce it 
against a later version  of Fedora, you are encouraged  change the 
'version' to a later Fedora version prior to Fedora 17's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 2 Cole Robinson 2015-04-27 17:07:37 EDT
Libvirt does support changing pool permissions, but you have to define the new XML, then do a 'pool-build'. pool-build is the command for any potentially destructive pool operations.
Comment 3 Cole Robinson 2015-04-27 17:08:18 EDT
And to be clear I believe libvirt has supported this for a number of years so it should be in all supported libvirt versions
Comment 4 Kamil Páral 2015-05-12 06:59:17 EDT
I have created a new pool 'test' on /test with 1000:1000 777 permissions and ran virsh pool-build test. That correctly created the dir. But if I create a new volume from virt-manager or using vol-create, it is still created with root:root 600 permissions. What am I doing wrong?

$ virsh pool-dumpxml test
<pool type='dir'>
  <name>test</name>
  <uuid>2e9c2f8f-a40f-43bf-a369-5200219bb0e3</uuid>
  <capacity unit='bytes'>117028003840</capacity>
  <allocation unit='bytes'>62224330752</allocation>
  <available unit='bytes'>54803673088</available>
  <source>
  </source>
  <target>
    <path>/test</path>
    <permissions>
      <mode>0777</mode>
      <owner>1000</owner>
      <group>1000</group>
    </permissions>
  </target>
</pool>

$ ll -d /test
drwxrwxrwx. 2 kparal kparal 4.1k May 12 12:46 /test

$ ll /test
total 340k
-rw-------. 1 root root 1.1G May 12 12:46 zzz.qcow2


libvirt-1.2.9.3-1.fc21.x86_64
virt-manager-1.1.0-8.git310f6527.fc21.noarch
Comment 5 Ján Tomko 2015-05-12 08:03:25 EDT
The permissions in the <pool> XML are the permissions of the directory:
http://libvirt.org/formatstorage.html#StoragePoolTarget
The permissions in the <volume> XML are the permissions of the volume:
http://libvirt.org/formatstorage.html#StorageVolTarget
Comment 6 Kamil Páral 2015-05-12 09:47:08 EDT
Oh, I see, I cited the documentation for volumes and assumed it's meant for pools. Sorry for confusion.

So, is there any way to define a default volume permissions globally, so that it's applied for any new volume created from virt-manager? Thanks for help.
Comment 7 Cole Robinson 2015-05-19 10:51:55 EDT
(In reply to Kamil Páral from comment #6)
> So, is there any way to define a default volume permissions globally, so
> that it's applied for any new volume created from virt-manager? Thanks for
> help.

No there isn't any way currently. The rule is basically:

1) If permissions specified in the XML, use those (at 'build' time for pools, create time for volumes)
2) If no perms specified when building a new directory, use 755
3) If no perms specified when building a new volume, use 600