Bug 1063710 - libvirt chowns static kernel/initrd images
Summary: libvirt chowns static kernel/initrd images
Keywords:
Status: CLOSED DUPLICATE of bug 842831
Alias: None
Product: Virtualization Tools
Classification: Community
Component: libvirt
Version: unspecified
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Libvirt Maintainers
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-02-11 10:05 UTC by Erik Hugne
Modified: 2016-04-10 17:48 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2016-04-10 17:48:47 UTC
Embargoed:


Attachments (Terms of Use)

Description Erik Hugne 2014-02-11 10:05:48 UTC
Description of problem:
When starting a domain using kernel/initrd only, i've noticed some weird
behaviour where libvirt is messing with the ownership of the static images.


Version-Release number of selected component (if applicable):
1.1.1-0ubuntu8.5

How reproducible:
Always

Steps to Reproduce:
Define a kernel/initrd-only domain, permissions are correct before starting
the domain.
 $ ls -lah tftpboot/vmlinuz tftpboot/initramfs.cpio.gz
 -rw-rw-r-- 1 eerihug eerihug  11M feb 11 08:53 tftpboot/initramfs.cpio.gz
 -rw-rw-r-- 1 eerihug eerihug 4,4M feb 11 08:53 tftpboot/vmlinuz
 
Now, after the domain is started, libvirt changes ownership to 
libvirt-qemu:kvm
 
$ virsh start Node1
 Domain Node1 started
 
$ ls -lah tftpboot/vmlinuz tftpboot/initramfs.cpio.gz 
 -rw-rw-r-- 1 libvirt-qemu kvm  11M feb 11 08:53 tftpboot/initramfs.cpio.gz
 -rw-rw-r-- 1 libvirt-qemu kvm 4,4M feb 11 08:53 tftpboot/vmlinuz
 

And when the domain is later destroyed, they are claimed by root:root
$ virsh destroy Node1
 Domain Node1 destroyed
 
$ ls -lah tftpboot/vmlinuz tftpboot/initramfs.cpio.gz 
 -rw-rw-r-- 1 root root  11M feb 11 08:53 tftpboot/initramfs.cpio.gz
 -rw-rw-r-- 1 root root 4,4M feb 11 08:53 tftpboot/vmlinuz
 
The initial 664 permission should be enough, and there's no reason for 
libvirt to mess with the ownership of the static images.
 
libvirt version: 1.1.1-0ubuntu8.5
HW used: x86_64 on Intel Core i7-2600
Hypervisor: KVM 
KVM domain logfile for Node1:
 2014-02-11 09:38:08.102+0000: starting up
 LC_ALL=C PATH=/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/sbin:/bin /usr/bin/kvm -name Node1 -S -machine pc-0.14,accel=kvm,usb=off -m 1024 -realtime   mlock=off -smp 8,sockets=8,cores=1,threads=1 -uuid 37aed156-6a00-4116-87e9-11ab953a6e8e -nographic -no-user-config -nodefaults -chardev socket,               id=charmonitor,path=/var/lib/libvirt/qemu/Node1.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown -kernel /   home/eerihug/lab/tftpboot/vmlinuz
 -initrd /home/eerihug/lab/tftpboot/initramfs.cpio.gz -append console=ttyS0,115200 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -netdev tap,fd=24,     id=hostnet0 -device e1000,netdev=hostnet0,id=net0,mac=02:00:00:de:ad:01,bus=pci.0,addr=0x8 -chardev pty,id=charserial0 -device isa-serial,                    chardev=charserial0,id=serial0 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x6
 W: kvm binary is deprecated, please use qemu-system-x86_64 instead
 char device redirected to /dev/pts/5 (label charserial0)
 qemu: terminating on signal 15 from pid 1160
 2014-02-11 09:38:55.606+0000: shutting down
 
Additional info, showing the chown's
 $sudo strace -f -p $(pgrep libvirtd) -o strace-log
 [...]
 grep chown strace.log 
 3062  read(5, "chown dac_override dac_read_sear"..., 8143) = 379 
 1161  chown("/home/eerihug/lab/tftpboot/vmlinuz", 117, 125) = 0 
 1161  chown("/home/eerihug/lab/tftpboot/initramfs.cpio.gz", 117, 125) = 0 
 3108  read(5, "chown dac_override dac_read_sear"..., 8143) = 379 
 1164  chown("/home/eerihug/lab/tftpboot/vmlinuz", 0, 0) = 0 
 1164  chown("/home/eerihug/lab/tftpboot/initramfs.cpio.gz", 0, 0) = 0 



Actual results:
Permissions are messed up by libvirt

Expected results:
libvirt should _not_ change permissions of static images

Additional info:

Comment 1 Erik Hugne 2014-02-11 10:20:06 UTC
This could potentially be a duplicate of bug: 885410
but i raise this anyway since that is specific to ISO's.

Comment 2 Cole Robinson 2016-04-10 17:48:47 UTC
We _do_ need to chown kernel/initrd in some cases, to ensure the qemu emulator running as unprivileged qemu:qemu can access the files. However there's possible improvements here like we shouldn't chown the files if we know qemu will be able to access them in their present state. This is tracked in https://bugzilla.redhat.com/show_bug.cgi?id=842831

*** This bug has been marked as a duplicate of bug 842831 ***


Note You need to log in before you can comment on or make changes to this bug.