File permissions in CIFS network filesystem pool
Hi, I'm trying to use a network filesystem pool on a Samba/CIFS share. Libvirt is configured with this pool: <pool type='netfs'> <name>netfs-default</name> <source> <host name='samba.lan.internal'/> <dir path='libvirt/default'/> <format type='cifs'/> </source> <target> <path>/var/lib/libvirt/images/netfs/default</path> <permissions> <mode>0755</mode> <owner>0</owner> <group>0</group> </permissions> </target> </pool> The Samba share is configured with: [libvirt] comment = VM storage pool browseable = yes path = /srv/datastore/samba/libvirt/ writeable = yes public = no guest ok = yes create mask = 0644 directory mask = 0755 force user = shared force group = +shared I can create the pool in virsh. The mounted files are owned by root on the libvirt machine. I can create and edit files as root if I access them via shell. However, libvirt can't start VMs. It fails to open the qcow2 file in the network filesystem pool with "permission denied". The libvirt host is Debian 14 (testing). I can't see any Selinux or Apparmor messages when the failure happens. So I believe the permissions problem is that libvirt tries to access the files as libvirt-qemu user, and this fails. I have tried adding the following snippet to the network fs pool definition, but after saving the pool, these options simply vanish from the network fs pool definition: <fs:mount_opts> <fs:option name='uid=libvirt-qemu'/> <fs:option name='gid=libvirt-qemu'/> </fs:mount_opts> So my question: how can I make this work? I have previously tried using NFSv4, but ran into similar issues. I guess I could make this work by mounting the share outside of libvirt and then point the filesystem pool at the mounted directory. Is there a more elegant way? Thanks, Thomas
On Wed, Aug 19, 2026 at 10:58:46AM +0100, Thomas Pircher via Users wrote:
Hi,
I'm trying to use a network filesystem pool on a Samba/CIFS share. Libvirt is configured with this pool:
<pool type='netfs'> <name>netfs-default</name> <source> <host name='samba.lan.internal'/> <dir path='libvirt/default'/> <format type='cifs'/> </source> <target> <path>/var/lib/libvirt/images/netfs/default</path> <permissions> <mode>0755</mode> <owner>0</owner> <group>0</group> </permissions> </target> </pool>
The Samba share is configured with:
[libvirt] comment = VM storage pool browseable = yes path = /srv/datastore/samba/libvirt/ writeable = yes public = no guest ok = yes create mask = 0644 directory mask = 0755 force user = shared force group = +shared
I can create the pool in virsh. The mounted files are owned by root on the libvirt machine. I can create and edit files as root if I access them via shell. However, libvirt can't start VMs. It fails to open the qcow2 file in the network filesystem pool with "permission denied".
What libvirt does is not only access the file, but also change the permissions on the image files in order to allow QEMU access to them. I am not sure how CIFS/samba works WRT permissions, but I remember lot of issues with NFS. On the other hand I also know most of the NFS issues are already solved. So as root, can you change the permissions to libvirt-qemu and then access it as the libvirt-qemu user?
The libvirt host is Debian 14 (testing). I can't see any Selinux or Apparmor messages when the failure happens. So I believe the permissions problem is that libvirt tries to access the files as libvirt-qemu user, and this fails.
I have tried adding the following snippet to the network fs pool definition, but after saving the pool, these options simply vanish from the network fs pool definition:
<fs:mount_opts> <fs:option name='uid=libvirt-qemu'/> <fs:option name='gid=libvirt-qemu'/> </fs:mount_opts>
So my question: how can I make this work? I have previously tried using NFSv4, but ran into similar issues. I guess I could make this work by mounting the share outside of libvirt and then point the filesystem pool at the mounted directory. Is there a more elegant way?
Thanks, Thomas
Martin Kletzander via Users wrote:
What libvirt does is not only access the file, but also change the permissions on the image files in order to allow QEMU access to them.
Hi Marin, thanks for the reply. I made sure that the user has rw permissions also on the mounted directory, not just the files. The problem remains, the file system is mounted with the "wrong" uid on the libvirt host.
I am not sure how CIFS/samba works WRT permissions, but I remember lot of issues with NFS. On the other hand I also know most of the NFS issues are already solved.
Is this somewhere written down? When I was experimenting with NFS (v4.2) for this setup, I had to solve a lot of issues and make sure UID and GID of the files were carefully synchronised between NFS server and libvirt host, and still would not be able to launch a VM using an image from the network fs pool. That was my reason to try CIFS next, as there you have a better separation of user IDs between CIFS server and client.
So as root, can you change the permissions to libvirt-qemu and then access it as the libvirt-qemu user?
If I understand you correctly, you suggest to start the filesystem pool from virsh, then change the owner of the (mounted) files to libvirt-qemu, and then start the VM? This does not work, unfortunately. I can run the chown command recursively on the mounted filesystem, but after the command completes, the files are still owned by root:root, i.e. the user that mounted the drive. I made sure that the mount point is owned by libvirt-qemu before starting the pool, but that also does not make any difference. What I would like to have is some meachanism that would allow me to specify the uid=libvirt-qemu and gid=libvirt-qemu mount options for the CIFS drive, but was not able to, as described in the previous post. Thanks, Thomas
participants (2)
-
Martin Kletzander -
Thomas Pircher