Setting umask of libvirt/virt-manager for proper permissions in a directory shared by host and guest

Question

I'm attempting to create a directory that is fully available to both the host and guest systems of a virt-manager/libvirt/QEMU/KVM virtual machine, with read, write and execute permissions for non-root users of both systems. Both OSes are Debian - the host is Wheezy, the guest, Jessie. I have been mostly successful, with one exception - files created within the guest OS and the shared directory are unavilable to non-root users on the host system.

The problem that I am running into is that when creating new files within the shared directory in the guest OS, virt-manager/libvirt creates them with their permissions set to 700 (full access for owner - in this case, a user called libvirt-qemu, and no permissions whatsoever for any other users or groups). Essentially, this is equivalent to the libvirt-qemu user's session umask being set to 077. This makes these files inaccessible to the host's non-root users.

The solution that I am trying to implement is to have both the libvirt-qemu user and the relevant other users on the host OS all belong to an additional new, secondary user group called vmshares, and have the shared directory owned by the vmshares group, with the SGID bit set to have all of its contents to also be owned by vmshares - which should accomplish what I want. However, I cannot seem to get virt-manager to create new files within the host shared directory with any umask except 077, when I need it to be using 007, so that these files also grant full permissions to members of the vmshares group.

I have tried creating a new file, /etc/pam.d/libvirt with the following contents, to implement the umask policy for the libvirt-qemu user:

libvirtd session requisite pam_umask.so umask=0007

I have also attempted to create a .profile file in /var/lib/libvirt/ with just the following line:

umask 007

I have also tried adding that line near the top of the libvirt-bin init script in /etc/init.d/libvirt-bin.

virt-manager/libvirt seems to ignore all of these completely.

Please, how can I accomplish my goal of having a fully usable shared directory on both the host and guest systems?

Answer 1

I realize this is a very old post but I just recently solved this exact problem by submitting patches to libvirt. Starting in libvirt v6.10, you'll be able to specify the "fmode" and "dmode" options on 9pfs shares which control the default host permissions on files and directories, respectively.

If you can't run v6.10, I found a workaround using the qemu:commandline feature of libvirt's XML domain to pass the raw QEMU flags. I wrote a blog post about how to do this but the quick version is to put something like

<commandline xmlns="http://libvirt.org/schemas/domain/qemu/1.0">
  <arg value="-fsdev"/>
  <arg value="local,security_model=mapped,id=fsdev-fs0,path=/path/to/share,fmode=0644,dmode=0755"/>
  <arg value="-device"/>
  <arg value="virtio-9p-pci,id=fs0,fsdev=fsdev-fs0,mount_tag=sharename,bus=pci.6,addr=0x0"/>
</commandline>

into your domain XML as a child of "domain." The blog post goes into more detail about the values but you may need to tweak fsdev-fs0, fs0, and sharename to fit your domain.