I am having trouble with the permssions needed to create a VM with lxc.
Using qemu-system-x86_64 I am able to create a VM
sudo qemu-system-x86_64 \
-name ubuntu2,process=ubuntu2 \
-machine type=pc,accel=kvm \
-cpu host \
-smp 4,sockets=1,cores=4,threads=1 \
-m 8G \
-vga qxl \
-spice port=5930,disable-ticketing=on \
-rtc clock=host,base=localtime \
-serial none \
-parallel none \
-drive id=disk0,if=virtio,cache=none,format=raw,file=/home/admin/VMs/ubuntu.img \
-drive file=/home/admin/ISOs/ubuntu-20.04.3-desktop-amd64.iso,index=1,media=cdrom \
-net tap \
-net nic
And view it with remote-viewer:
sudo remote-viewer spice://127.0.0.1:5930
However, using the same set of commands to create a VM through LXD does not work:
echo "-name ubuntu2,process=ubuntu2 \
-machine type=pc,accel=kvm \
-cpu host \
-smp 4,sockets=1,cores=4,threads=1 \
-m 8G \
-vga qxl \
-spice port=5930,disable-ticketing=on \
-rtc clock=host,base=localtime \
-serial none \
-parallel none \
-drive id=disk0,if=virtio,cache=none,format=raw,file=/home/admin/VMs/ubuntu.img \
-drive file=/home/admin/ISOs/ubuntu-20.04.3-desktop-amd64.iso,index=1,media=cdrom \
-net tap \
-net nic" | lxc config set ubuntu2 raw.qemu -
However starting the VM after setting those permissions results in Permission denied:
~$ sudo lxc start ubuntu2
Error: Failed to run: forklimits limit=memlock:unlimited:unlimited -- /snap/lxd/21902/bin/qemu-system-x86_64 -S -name ubuntu2 -uuid 63f34fd9-8cb5-4e82-9a69-13f47ae43954 -daemonize -cpu host -nographic -serial chardev:console -nodefaults -no-user-config -sandbox on,obsolete=deny,elevateprivileges=allow,spawn=deny,resourcecontrol=deny -readconfig /var/snap/lxd/common/lxd/logs/ubuntu2/qemu.conf -spice unix=on,disable-ticketing=on,addr=/var/snap/lxd/common/lxd/logs/ubuntu2/qemu.spice -pidfile /var/snap/lxd/common/lxd/logs/ubuntu2/qemu.pid -D /var/snap/lxd/common/lxd/logs/ubuntu2/qemu.log -smbios type=2,manufacturer=Canonical Ltd.,product=LXD -runas lxd -name ubuntu2,process=ubuntu2 -machine type=pc,accel=kvm -cpu host -smp 4,sockets=1,cores=4,threads=1 -m 8G -vga qxl -spice port=5930,disable-ticketing=on -rtc clock=host,base=localtime -serial none -parallel none -drive id=disk0,if=virtio,cache=none,format=raw,file=/home/admin/VMs/ubuntu.img -drive file=/home/admin/ISOs/ubuntu-20.04.3-desktop-amd64.iso,index=1,media=cdrom -net tap -net nic: char device redirected to /dev/pts/0 (label console)
: Process exited with non-zero value 1
Try `lxc info --show-log ubuntu2` for more info
admin@virtland:~$ lxc info --show-log ubuntu2
Name: ubuntu2
Status: STOPPED
Type: virtual-machine
Architecture: x86_64
Created: 2021/11/27 18:50 EST
Last Used: 2021/11/27 18:51 EST
Log:
qemu-system-x86_64: -drive id=disk0,if=virtio,cache=none,format=raw,file=/home/admin/VMs/ubuntu.img: Could not open '/home/admin/VMs/ubuntu.img': Permission denied
I tried messing with the permissions in groups in ways that seemed likely, but it did not help:
sudo setfacl -m g:kvm:rx /home/admin
sudo setfacl -R --modify group:kvm:rwx /home/admin/VMs
sudo setfacl -R --modify group:lxd:rwx /home/admin/VMs
sudo setfacl -R --modify user:lxd:rwx /home/admin/VMs
sudo usermod -aG kvm admin
sudo usermod -aG kvm lxd
LXC info:
~$ lxc list
+-------------+---------+------+------+-----------------+-----------+
| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |
+-------------+---------+------+------+-----------------+-----------+
| lubuntu-1 | STOPPED | | | CONTAINER | 0 |
+-------------+---------+------+------+-----------------+-----------+
| mycontainer | STOPPED | | | CONTAINER | 0 |
+-------------+---------+------+------+-----------------+-----------+
| steam | STOPPED | | | CONTAINER | 0 |
+-------------+---------+------+------+-----------------+-----------+
| ubuntu2 | STOPPED | | | VIRTUAL-MACHINE | 0 |
+-------------+---------+------+------+-----------------+-----------+
| ubuntu-gui | STOPPED | | | CONTAINER | 0 |
+-------------+---------+------+------+-----------------+-----------+
| x2go-test | STOPPED | | | CONTAINER | 0 |
+-------------+---------+------+------+-----------------+-----------+
ACL permissions on the file in question:
~$ sudo getfacl -e /home/admin/VMs/ubuntu.img
getfacl: Removing leading '/' from absolute path names
# file: home/admin/VMs/ubuntu.img
# owner: admin
# group: admin
user::rw-
user:lxd:rwx #effective:rwx
group::r-- #effective:r--
group:kvm:rwx #effective:rwx
group:lxd:rwx #effective:rwx
mask::rwx
other::r--
I tried stopping and disabling apparmor too, but the error persisted.