Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: When starting a domain using kernel/initrd only, i've noticed some weird behaviour where libvirt is messing with the ownership of the static images. Version-Release number of selected component (if applicable): 1.1.1-0ubuntu8.5 How reproducible: Always Steps to Reproduce: Define a kernel/initrd-only domain, permissions are correct before starting the domain. $ ls -lah tftpboot/vmlinuz tftpboot/initramfs.cpio.gz -rw-rw-r-- 1 eerihug eerihug 11M feb 11 08:53 tftpboot/initramfs.cpio.gz -rw-rw-r-- 1 eerihug eerihug 4,4M feb 11 08:53 tftpboot/vmlinuz Now, after the domain is started, libvirt changes ownership to libvirt-qemu:kvm $ virsh start Node1 Domain Node1 started $ ls -lah tftpboot/vmlinuz tftpboot/initramfs.cpio.gz -rw-rw-r-- 1 libvirt-qemu kvm 11M feb 11 08:53 tftpboot/initramfs.cpio.gz -rw-rw-r-- 1 libvirt-qemu kvm 4,4M feb 11 08:53 tftpboot/vmlinuz And when the domain is later destroyed, they are claimed by root:root $ virsh destroy Node1 Domain Node1 destroyed $ ls -lah tftpboot/vmlinuz tftpboot/initramfs.cpio.gz -rw-rw-r-- 1 root root 11M feb 11 08:53 tftpboot/initramfs.cpio.gz -rw-rw-r-- 1 root root 4,4M feb 11 08:53 tftpboot/vmlinuz The initial 664 permission should be enough, and there's no reason for libvirt to mess with the ownership of the static images. libvirt version: 1.1.1-0ubuntu8.5 HW used: x86_64 on Intel Core i7-2600 Hypervisor: KVM KVM domain logfile for Node1: 2014-02-11 09:38:08.102+0000: starting up LC_ALL=C PATH=/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/sbin:/bin /usr/bin/kvm -name Node1 -S -machine pc-0.14,accel=kvm,usb=off -m 1024 -realtime mlock=off -smp 8,sockets=8,cores=1,threads=1 -uuid 37aed156-6a00-4116-87e9-11ab953a6e8e -nographic -no-user-config -nodefaults -chardev socket, id=charmonitor,path=/var/lib/libvirt/qemu/Node1.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown -kernel / home/eerihug/lab/tftpboot/vmlinuz -initrd /home/eerihug/lab/tftpboot/initramfs.cpio.gz -append console=ttyS0,115200 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -netdev tap,fd=24, id=hostnet0 -device e1000,netdev=hostnet0,id=net0,mac=02:00:00:de:ad:01,bus=pci.0,addr=0x8 -chardev pty,id=charserial0 -device isa-serial, chardev=charserial0,id=serial0 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x6 W: kvm binary is deprecated, please use qemu-system-x86_64 instead char device redirected to /dev/pts/5 (label charserial0) qemu: terminating on signal 15 from pid 1160 2014-02-11 09:38:55.606+0000: shutting down Additional info, showing the chown's $sudo strace -f -p $(pgrep libvirtd) -o strace-log [...] grep chown strace.log 3062 read(5, "chown dac_override dac_read_sear"..., 8143) = 379 1161 chown("/home/eerihug/lab/tftpboot/vmlinuz", 117, 125) = 0 1161 chown("/home/eerihug/lab/tftpboot/initramfs.cpio.gz", 117, 125) = 0 3108 read(5, "chown dac_override dac_read_sear"..., 8143) = 379 1164 chown("/home/eerihug/lab/tftpboot/vmlinuz", 0, 0) = 0 1164 chown("/home/eerihug/lab/tftpboot/initramfs.cpio.gz", 0, 0) = 0 Actual results: Permissions are messed up by libvirt Expected results: libvirt should _not_ change permissions of static images Additional info:
This could potentially be a duplicate of bug: 885410 but i raise this anyway since that is specific to ISO's.
We _do_ need to chown kernel/initrd in some cases, to ensure the qemu emulator running as unprivileged qemu:qemu can access the files. However there's possible improvements here like we shouldn't chown the files if we know qemu will be able to access them in their present state. This is tracked in https://bugzilla.redhat.com/show_bug.cgi?id=842831 *** This bug has been marked as a duplicate of bug 842831 ***