On Fri, Jul 26, 2013 at 10:24:52AM +0400, Yury Goltsov wrote: > Hello. > I am trying to 'passthrough' the part of host filesystem to kvm guest. > libvirt xml: > <filesystem type='mount' accessmode='passthrough'> > <source dir='/var/guests/mail-var'/> > <target dir='mail-var'/> > </filesystem> > kvm is started from root. > > After mounting in guest > mount -t 9p mail-var /mnt -o trans=virtio,version=9p2000.L > or > mount -t 9p www-var /mnt -o trans=virtio > if I try to make file or directory in guest, I have problem with permissions: > ruser@www:~# ls -ld /mnt/ruser/ > drwxr-xr-x 2 ruser www-data 4096 May 28 13:13 /mnt/ruser/ > ruser@www:~# ls -ld /mnt/tmp/ > drwxrwxrwx 2 root root 4096 Jul 26 09:01 /mnt/tmp/ > > root@www:~# touch /mnt/tmp/file1 > OK: > root@www:~# touch /mnt/ruser/file2 > touch: cannot touch `/mnt/ruser/file2': Permission denied > > root@www:~# su ruser > ruser@www:~$ touch /mnt/ruser/file3 > touch: cannot touch `/mnt/ruser/file3': Permission denied > ruser@www:~$ touch /mnt/tmp/file4 > touch: setting times of `/mnt/tmp/file4': No such file or directory > > I have read in documentation, that in "passthrough" security model, > files are stored using the same credentials as they are created on the guest (like NFS3). > > Suggest me, please, what is it: > I do something wrong, or I must update qemu-kvm or/and libvirt to recent version, > or I need to find other solution for sharing host filesystem? You have to remember that the QEMU processes on the host is running as qemu:qemu by default, without any capabilities. So with passthrough mode, the guest will see all the correct user/group owners, but it will still not be able to write to arbitrary files. It'll only be able to write stuff which is owned qemu:qemu, or has global write permission (like /tmp does in your example) Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

After adding the line clear_emulator_capabilities = 0 to the file /etc/libvirt/qemu.conf the results of file system operations are the expected color.