Bug 877908
| Summary: | pool permissions have no effect | ||
|---|---|---|---|
| Product: | [Community] Virtualization Tools | Reporter: | Kamil Páral <kparal> |
| Component: | libvirt | Assignee: | Libvirt Maintainers <libvirt-maint> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | unspecified | CC: | berrange, clalancette, crobinso, dyuan, itamar, jforbes, jtomko, laine, libvirt-maint, rbalakri, veillard, xuzhang, yanyang |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-04-27 21:07:37 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
This message is a reminder that Fedora 17 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 17. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '17'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 17's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 17 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior to Fedora 17's end of life. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. Libvirt does support changing pool permissions, but you have to define the new XML, then do a 'pool-build'. pool-build is the command for any potentially destructive pool operations. And to be clear I believe libvirt has supported this for a number of years so it should be in all supported libvirt versions I have created a new pool 'test' on /test with 1000:1000 777 permissions and ran virsh pool-build test. That correctly created the dir. But if I create a new volume from virt-manager or using vol-create, it is still created with root:root 600 permissions. What am I doing wrong?
$ virsh pool-dumpxml test
<pool type='dir'>
<name>test</name>
<uuid>2e9c2f8f-a40f-43bf-a369-5200219bb0e3</uuid>
<capacity unit='bytes'>117028003840</capacity>
<allocation unit='bytes'>62224330752</allocation>
<available unit='bytes'>54803673088</available>
<source>
</source>
<target>
<path>/test</path>
<permissions>
<mode>0777</mode>
<owner>1000</owner>
<group>1000</group>
</permissions>
</target>
</pool>
$ ll -d /test
drwxrwxrwx. 2 kparal kparal 4.1k May 12 12:46 /test
$ ll /test
total 340k
-rw-------. 1 root root 1.1G May 12 12:46 zzz.qcow2
libvirt-1.2.9.3-1.fc21.x86_64
virt-manager-1.1.0-8.git310f6527.fc21.noarch
The permissions in the <pool> XML are the permissions of the directory: http://libvirt.org/formatstorage.html#StoragePoolTarget The permissions in the <volume> XML are the permissions of the volume: http://libvirt.org/formatstorage.html#StorageVolTarget Oh, I see, I cited the documentation for volumes and assumed it's meant for pools. Sorry for confusion. So, is there any way to define a default volume permissions globally, so that it's applied for any new volume created from virt-manager? Thanks for help. (In reply to Kamil Páral from comment #6) > So, is there any way to define a default volume permissions globally, so > that it's applied for any new volume created from virt-manager? Thanks for > help. No there isn't any way currently. The rule is basically: 1) If permissions specified in the XML, use those (at 'build' time for pools, create time for volumes) 2) If no perms specified when building a new directory, use 755 3) If no perms specified when building a new volume, use 600 |
Description of problem: I have adjusted the permissions of my default libvirt pool to 0777 1000:1000. # virsh pool-dumpxml default <pool type='dir'> <name>default</name> <uuid>a6f726d7-afe9-0b27-aa56-8abd32fc9781</uuid> <capacity unit='bytes'>179672104960</capacity> <allocation unit='bytes'>110910464000</allocation> <available unit='bytes'>68761640960</available> <source> </source> <target> <path>/var/lib/libvirt/images</path> <permissions> <mode>0777</mode> <owner>1000</owner> <group>1000</group> </permissions> </target> </pool> But when I create a new volume in that pool, it has 0700 0:0 : # virsh vol-create-as default abc 100M Vol abc created # ll /var/lib/libvirt/images/abc -rw------- 1 root root 104857600 Nov 19 09:34 /var/lib/libvirt/images/abc That doesn't seem to match the documentation: permissions Provides information about the default permissions to use when creating volumes. This is currently only useful for directory or filesystem based pools, where the volumes allocated are simple files. For pools where the volumes are device nodes, the hotplug scripts determine permissions. It contains 4 child elements. The mode element contains the octal permission set. The owner element contains the numeric user ID. The group element contains the numeric group ID. The label element contains the MAC (eg SELinux) label string. Since 0.4.1 http://libvirt.org/formatstorage.html Version-Release number of selected component (if applicable): libvirt-0.9.11.7-1.fc17.x86_64 libvirt-client-0.9.11.7-1.fc17.x86_64 libvirt-daemon-0.9.11.7-1.fc17.x86_64 libvirt-daemon-config-network-0.9.11.7-1.fc17.x86_64 libvirt-daemon-config-nwfilter-0.9.11.7-1.fc17.x86_64 libvirt-daemon-kvm-0.9.11.7-1.fc17.x86_64 libvirt-python-0.9.11.7-1.fc17.x86_64 python-virtinst-0.600.3-2.fc17.noarch redland-virtuoso-1.0.15-1.fc17.x86_64 virt-manager-0.9.4-2.fc17.noarch virt-manager-common-0.9.4-2.fc17.noarch virt-top-1.0.6-2.fc17.x86_64 virt-viewer-0.5.3-1.fc17.x86_64 How reproducible: always