5

I'm attempting to create a directory that is fully available to both the host and guest systems of a virt-manager/libvirt/QEMU/KVM virtual machine, with read, write and execute permissions for non-root users of both systems. Both OSes are Debian - the host is Wheezy, the guest, Jessie. I have been mostly successful, with one exception - files created within the guest OS and the shared directory are unavilable to non-root users on the host system.

The problem that I am running into is that when creating new files within the shared directory in the guest OS, virt-manager/libvirt creates them with their permissions set to 700 (full access for owner - in this case, a user called libvirt-qemu, and no permissions whatsoever for any other users or groups). Essentially, this is equivalent to the libvirt-qemu user's session umask being set to 077. This makes these files inaccessible to the host's non-root users.

The solution that I am trying to implement is to have both the libvirt-qemu user and the relevant other users on the host OS all belong to an additional new, secondary user group called vmshares, and have the shared directory owned by the vmshares group, with the SGID bit set to have all of its contents to also be owned by vmshares - which should accomplish what I want. However, I cannot seem to get virt-manager to create new files within the host shared directory with any umask except 077, when I need it to be using 007, so that these files also grant full permissions to members of the vmshares group.

I have tried creating a new file, /etc/pam.d/libvirt with the following contents, to implement the umask policy for the libvirt-qemu user:

libvirtd session requisite pam_umask.so umask=0007

I have also attempted to create a .profile file in /var/lib/libvirt/ with just the following line:

umask 007

I have also tried adding that line near the top of the libvirt-bin init script in /etc/init.d/libvirt-bin.

virt-manager/libvirt seems to ignore all of these completely.

Please, how can I accomplish my goal of having a fully usable shared directory on both the host and guest systems?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.