Could not open '/root/CentOS-7-x86_64-Minimal-1611.iso': Permission denied

Question

An attempt to use virt-install to create a CentOS 7 guest virtual machine on a CentOS 7 host is generating the following error:

Could not open '/root/CentOS-7-x86_64-Minimal-1611.iso': Permission denied

What specific steps need to be taken to resolve this error, so that the CentOS 7 guest virtual machine can be successfully installed?

The details are as follows:

---

Steps To Reproduce The Error:

---

First, I downloaded the iso file from a centos mirror:

[root@remote-host ~]# wget http://centos.mbni.med.umich.edu/mirror/7/isos/x86_64/CentOS-7-x86_64-Minimal-1611.iso
--2017-03-13 12:52:53--  http://centos.mbni.med.umich.edu/mirror/7/isos/x86_64/CentOS-7-x86_64-Minimal-1611.iso
Resolving centos.mbni.med.umich.edu (centos.mbni.med.umich.edu)... 141.214.186.162
Connecting to centos.mbni.med.umich.edu (centos.mbni.med.umich.edu)|141.214.186.162|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 713031680 (680M) [application/octet-stream]
Saving to: ‘CentOS-7-x86_64-Minimal-1611.iso’

100%[============================================================================================================================>] 713,031,680 14.2MB/s   in 50s

2017-03-13 12:53:43 (13.5 MB/s) - ‘CentOS-7-x86_64-Minimal-1611.iso’ saved [713031680/713031680]

Next, I ran the following installation command, which resulted in the error:

[root@remote-host ~]# virt-install \
> --name centos7 \
> --ram 2048 \
> --disk path=/dev/mapper/centos-third,size=242 \
> --vcpus 1 \
> --os-type generic \
> --os-variant generic \
> --network bridge=virbr0 \
> --graphics none \
> --console pty,target_type=serial \
> --cdrom ./CentOS-7-x86_64-Minimal-1611.iso
WARNING  CDROM media does not print to the text console by default, so you likely will not see text install output. You might want to use --location. See the man page for examples of using --location with CDROM media

Starting install...
ERROR    internal error: qemu unexpectedly closed the monitor: 2017-03-13T19:58:02.701397Z qemu-kvm: -drive file=/root/CentOS-7-x86_64-Minimal-1611.iso,format=raw,if=none,id=drive-ide0-0-1,readonly=on: could not open disk image /root/CentOS-7-x86_64-Minimal-1611.iso: Could not open '/root/CentOS-7-x86_64-Minimal-1611.iso': Permission denied
Domain installation does not appear to have been successful.
If it was, you can restart your domain by running:
  virsh --connect qemu:///system start centos7
otherwise, please restart your installation.
[root@remote-host ~]#

To assess the permission problem, I reviewed the contents of the directory, as follows:

[root@remote-host ~]# ls -al
total 696356
dr-xr-x---.  4 root root      4096 Mar 13 12:52 .
dr-xr-xr-x. 24 root root      4096 Mar 13 12:00 ..
-rw-------.  1 root root      2365 Mar 12 11:14 anaconda-ks.cfg
-rw-------.  1 root root      1091 Mar 13 12:13 .bash_history
-rw-r--r--.  1 root root        18 Dec 28  2013 .bash_logout
-rw-r--r--.  1 root root       176 Dec 28  2013 .bash_profile
-rw-r--r--.  1 root root       176 Dec 28  2013 .bashrc
drwxr-xr-x.  4 root root        36 Mar 13 12:42 .cache
-rw-r--r--.  1 qemu qemu 713031680 Dec  5 15:44 CentOS-7-x86_64-Minimal-1611.iso
drwxr-xr-x.  3 root root        17 Mar 13 10:52 .config
-rw-r--r--.  1 root root       100 Dec 28  2013 .cshrc
-rw-r--r--.  1 root root       129 Dec 28  2013 .tcshrc

Though I know that root should be able to access any other user's files, I tried changing the user to root and re-running the command as follows:

[root@remote-host ~]# chown root:root CentOS-7-x86_64-Minimal-1611.iso                                                                                       [root@remote-host ~]# ls -al
total 696356
dr-xr-x---.  4 root root      4096 Mar 13 12:52 .
dr-xr-xr-x. 24 root root      4096 Mar 13 12:00 ..
-rw-------.  1 root root      2365 Mar 12 11:14 anaconda-ks.cfg
-rw-------.  1 root root      1091 Mar 13 12:13 .bash_history
-rw-r--r--.  1 root root        18 Dec 28  2013 .bash_logout
-rw-r--r--.  1 root root       176 Dec 28  2013 .bash_profile
-rw-r--r--.  1 root root       176 Dec 28  2013 .bashrc
drwxr-xr-x.  4 root root        36 Mar 13 12:42 .cache
-rw-r--r--.  1 root root 713031680 Dec  5 15:44 CentOS-7-x86_64-Minimal-1611.iso
drwxr-xr-x.  3 root root        17 Mar 13 10:52 .config
-rw-r--r--.  1 root root       100 Dec 28  2013 .cshrc
-rw-r--r--.  1 root root       129 Dec 28  2013 .tcshrc
[root@remote-host ~]# virt-install --name centos7 --ram 2048 --disk path=/dev/mapper/centos-third,size=242 --vcpus 1 --os-type generic --os-variant generic --network bridge=virbr0 --graphics none --console pty,target_type=serial --cdrom ./CentOS-7-x86_64-Minimal-1611.iso
WARNING  CDROM media does not print to the text console by default, so you likely will not see text install output. You might want to use --location. See the man page for examples of using --location with CDROM media

Starting install...
ERROR    internal error: qemu unexpectedly closed the monitor: 2017-03-13T20:06:07.525792Z qemu-kvm: -drive file=/root/CentOS-7-x86_64-Minimal-1611.iso,format=raw,if=none,id=drive-ide0-0-1,readonly=on: could not open disk image /root/CentOS-7-x86_64-Minimal-1611.iso: Could not open '/root/CentOS-7-x86_64-Minimal-1611.iso': Permission denied
Domain installation does not appear to have been successful.
If it was, you can restart your domain by running:
  virsh --connect qemu:///system start centos7
otherwise, please restart your installation.
[root@remote-host ~]#

[root@remote-host ~]# virsh --connect qemu:///system start centos7
error: failed to get domain 'centos7'
error: Domain not found: no domain with matching name 'centos7'

[root@remote-host ~]#

As you can see, I got the same error. What else needs to be done to resolve this error, so that the guest virtual machine can be installed successfully?

Answer 1

You also have SELinux enabled (which is good), but the context of the ISO may be preventing qemu from reading it, too.

Try moving the ISO to /tmp. qemu should have access to read files in /tmp if the individual file context is appropriate.

If qemu is still unable to access the ISO after you've moved it to /tmp, check out the contents of /var/log/audit/audit.log to see if any access violations were recorded there.

To view the SELinux contexts, for instance, after moving the ISO to /tmp, use ls -lZ /tmp/.

This won't tell you what the contexts should be for the program to access the file, but will show you the current context. Comparing the context of other files (that the program can already access) to this file should help you narrow down what you could set the context of this file to.

In this scenario, as long as the ISO is located in a directory that qemu has access to, you can set the context of the ISO so qemu can read it with chcon -t virt_content_t <filename>.iso

Answer 2

The directory, /root, has permissions, 0550, with owner and group owner, root. It also has an SELinux context as indicated by the . in dr-xr-x---.. Only users in the root group can read and execute files in the /root directory. Also, as long as SELinux is enforcing, then the wrong SELinux context can prevent file access. In other words, even if the directory permissions were 0777 (permitting all access to all users), the qemu user cannot read the file unless, in addition, the SELinux context has been set correctly. Use ls -lZ to show an SELinux context. The following is the default result for the /root directory.

dr-xr-x---. root root system_u:object_r:admin_home_t:s0 root

As we can see, admin_home_t is not virt_image_t or some other permitted SELinux context.

There are more ways to do it, like using an FTP or Web server, as follow.

Using a Web Server

yum install -y httpd
systemctl enable httpd
mkdir /var/www/html/centos
mount -o loop centos.iso /mnt
cp -a /mnt/. /var/www/html/centos
chcon -R --reference=/var/www/html /var/www/html/centos
firewall-cmd --permanent --add-service=http
firewall-cmd --reload
systemctl restart httpd
umount /mnt

With this, use -l http://x.x.x.x/pub/centos instead of --cdrom.

Using an FTP Server

yum install -y vsftpd
systemctl enable vsftpd
mkdir /var/ftp/pub/centos
mount -o loop centos.iso /mnt
cp -a /mnt/. /var/ftp/pub/centos
chcon -R -t public_content_t /var/ftp/
firewall-cmd --permanent --add-service=ftp
firewall-cmd --reload
systemctl restart vsftpd
umount /mnt

With this, use -l ftp://x.x.x.x/pub/centos instead of --cdrom.

In short, just get the permissions and SELinux context corrected, or use an alternate method, two of which were described above.

Answer 3

I had an error when trying to create a VM on my Centos 6.9 server (permission denied on the OS file (windows 10)), I copied the file from the dvd to a dir on the node (/virt), I checked the Context of the /etc/libvirt/qemu and changed the context of the /virt dir to what was expected:

$ ls -lZ
-rw-r--r--. root root system_u:object_r:virt_etc_t:s0  qemu.conf

$ls -lz 
drwxr-xr-x. root root system_u:object_r:virt_etc_rw_t:s0 virt

I did this by adding the context type:

semanage -a -t virt_etc_rw_t '/virt(/.*)?'

Then,

$ restorecon -RFvv /virt
127  semanage fcontext -l qemu
145  semanage fcontext -a -t virt_etc_rw_t '/virt(/.*)?'
210  history | grep semanage

[root@centos libvirt]# history | grep restore
146  restorecon -RFvv /virt

and then I was able to use the ISO file without issue.