I'm attempting to create a directory that is fully available to both the host and guest systems of a virt-manager/libvirt/QEMU/KVM virtual machine, with read, write and execute permissions for non-root users of both systems. Both OSes are Debian - the host is Wheezy, the guest, Jessie. I have been mostly successful, with one exception - files created within the guest OS and the shared directory are unavilable to non-root users on the host system.
The problem that I am running into is that when creating new files within the shared directory in the guest OS, virt-manager/libvirt creates them with their permissions set to 700 (full access for owner - in this case, a user called
libvirt-qemu, and no permissions whatsoever for any other users or groups). Essentially, this is equivalent to the libvirt-qemu user's session umask being set to 077. This makes these files inaccessible to the host's non-root users.
The solution that I am trying to implement is to have both the
libvirt-qemu user and the relevant other users on the host OS all belong to an additional new, secondary user group called
vmshares, and have the shared directory owned by the
vmshares group, with the SGID bit set to have all of its contents to also be owned by
vmshares - which should accomplish what I want. However, I cannot seem to get virt-manager to create new files within the host shared directory with any umask except 077, when I need it to be using 007, so that these files also grant full permissions to members of the
I have tried creating a new file, /etc/pam.d/libvirt with the following contents, to implement the umask policy for the libvirt-qemu user:
libvirtd session requisite pam_umask.so umask=0007
I have also attempted to create a
.profile file in /var/lib/libvirt/ with just the following line:
I have also tried adding that line near the top of the libvirt-bin init script in /etc/init.d/libvirt-bin.
virt-manager/libvirt seems to ignore all of these completely.
Please, how can I accomplish my goal of having a fully usable shared directory on both the host and guest systems?