On 21.03.2014 18:52, Jim Fehlig wrote: Yes and no. It's both intentional and bug in our code. I was going to suggest to use: <domain> ... <devices> ... <disk> ... <source> <seclabel model='dac' relabel='no'/> </source> </disk> </devices> </domain> But I've tried it out and found a bug [1]. After fixing it, I found out that the DAC driver doesn't care about relabel='no' at all. So I've posted second patch [2]. Moreover, I've got a patch set floating around that learns libvirt to remember the original owner of chowned files [3]. Michal 1: https://www.redhat.com/archives/libvir-list/2014-March/msg01446.html 2: https://www.redhat.com/archives/libvir-list/2014-March/msg01450.html 3: https://www.redhat.com/archives/libvir-list/2014-March/msg00826.html