Re: File permissions in CIFS network filesystem pool

[Martin Kletzander via Users]

On Wed, Aug 19, 2026 at 10:58:46AM +0100, Thomas Pircher via Users wrote:

Hi,

I'm trying to use a network filesystem pool on a Samba/CIFS share.
Libvirt is configured with this pool:

  <pool type='netfs'>
    <name>netfs-default</name>
    <source>
      <host name='samba.lan.internal'/>
      <dir path='libvirt/default'/>
      <format type='cifs'/>
    </source>
    <target>
      <path>/var/lib/libvirt/images/netfs/default</path>
      <permissions>
        <mode>0755</mode>
        <owner>0</owner>
        <group>0</group>
      </permissions>
    </target>
  </pool>


The Samba share is configured with:

  [libvirt]
    comment = VM storage pool
    browseable = yes
    path = /srv/datastore/samba/libvirt/
    writeable = yes
    public = no
    guest ok = yes
    create mask = 0644
    directory mask = 0755
    force user = shared
    force group = +shared


I can create the pool in virsh. The mounted files are owned by root on
the libvirt machine. I can create and edit files as root if I access
them via shell.
However, libvirt can't start VMs. It fails to open the qcow2 file in the
network filesystem pool with "permission denied".

What libvirt does is not only access the file, but also change the
permissions on the image files in order to allow QEMU access to them.

I am not sure how CIFS/samba works WRT permissions, but I remember lot
of issues with NFS.  On the other hand I also know most of the NFS
issues are already solved.

So as root, can you change the permissions to libvirt-qemu and then
access it as the libvirt-qemu user?

The libvirt host is Debian 14 (testing). I can't see any Selinux or
Apparmor messages when the failure happens. So I believe the permissions
problem is that libvirt tries to access the files as libvirt-qemu user,
and this fails.

I have tried adding the following snippet to the network fs pool
definition, but after saving the pool, these options simply vanish from
the network fs pool definition:

  <fs:mount_opts>
    <fs:option name='uid=libvirt-qemu'/>
    <fs:option name='gid=libvirt-qemu'/>
  </fs:mount_opts>


So my question: how can I make this work? I have previously tried using
NFSv4, but ran into similar issues.
I guess I could make this work by mounting the share outside of libvirt
and then point the filesystem pool at the mounted directory. Is there a
more elegant way?

Thanks,
Thomas

signature.asc
Description: PGP signature