I'm attempting to create a directory that is fully available to both the host and guest systems of a virt-manager/libvirt/QEMU/KVM virtual machine, with read, write and execute permissions for non-root users of both systems. Both OSes are Debian - the host is Wheezy, the guest, Jessie. I have been mostly successful, with one exception - files created within the guest OS and the shared directory are unavilable to non-root users on the host system.
The problem that I am running into is that when creating new files within the shared directory in the guest OS, virt-manager/libvirt creates them with their permissions set to 700 (full access for owner - in this case, a user called libvirt-qemu
, and no permissions whatsoever for any other users or groups). Essentially, this is equivalent to the libvirt-qemu user's session umask being set to 077. This makes these files inaccessible to the host's non-root users.
The solution that I am trying to implement is to have both the libvirt-qemu
user and the relevant other users on the host OS all belong to an additional new, secondary user group called vmshares
, and have the shared directory owned by the vmshares
group, with the SGID bit set to have all of its contents to also be owned by vmshares
- which should accomplish what I want. However, I cannot seem to get virt-manager to create new files within the host shared directory with any umask except 077, when I need it to be using 007, so that these files also grant full permissions to members of the vmshares
group.
I have tried creating a new file, /etc/pam.d/libvirt with the following contents, to implement the umask policy for the libvirt-qemu user:
libvirtd session requisite pam_umask.so umask=0007
I have also attempted to create a .profile
file in /var/lib/libvirt/ with just the following line:
umask 007
I have also tried adding that line near the top of the libvirt-bin init script in /etc/init.d/libvirt-bin.
virt-manager/libvirt seems to ignore all of these completely.
Please, how can I accomplish my goal of having a fully usable shared directory on both the host and guest systems?