add a method to probe the permission as qemu user

Now we need to check the 'qemu' user can open an iso files.

This patch is used to check 'qemu' user has permission to open a file.

Test this patch:
$ mkdir -p a/b/c
$ touch a/b/c/f
$ chmod o-x a/b/c
$ sudo PYTHONPATH=src python -c '
from kimchi.utils import probe_file_permission_as_user
print probe_file_permission_as_user("a/b/c/f", "qemu")'

It will return False
change another user, it may return True

Signed-off-by: ShaoHe Feng <shaohef@linux.vnet.ibm.com>
Signed-off-by: Royce Lv <lvroyce@linux.vnet.ibm.com>
qemu user tests: probe the username of qemu process started by libvirt

We want to fix the searchable permission for qemu user.
But we should find the username of qemu process firstly.

searchable permission is a known problem.
We have discussed several times on IRC.

Royce reports the qemu username is different on different distros

Zhou Zheng Sheng gives a better way to find the qemu process ID

Signed-off-by: ShaoHe Feng <shaohef@linux.vnet.ibm.com>
Signed-off-by: Zhou Zheng Sheng <zhshzhou@linux.vnet.ibm.com>
Don't allow templates to be created with ISOs that won't be usable.

qemu can't use an ISO if it has no search permission on the directories
containing the file.
Return an error explaning this, and suggest the way to fix it.

http://libvirt.org/drvqemu.html#securitydac
In the "session" instance, the POSIX users/groups model restricts QEMU
virtual machines (and libvirtd in general) to only have access to
resources with the same user/group ID as the client application. There
is no finer level of configuration possible for the "session" instances.

If QEMU virtual machines from the "system" instance are being run as
non-root, there will be greater restrictions on what host resources the
QEMU process will be able to access. The libvirtd daemon will attempt to
manage permissions on resources to minimise the likelihood of
unintentional security denials

Any files/devices used as guest disk images must be accessible to
the user/group ID that QEMU guests are configured to run as. The
libvirtd daemon will automatically set the ownership of the file/device
path to the correct user/group ID. Applications / administrators must be
aware though that the parent directory permissions may still deny
access. The directories containing disk images must either have their
ownership set to match the user/group configured for QEMU, or their UNIX
file permissions must have the 'execute/search' bit enabled for
'others'.

The simplest option is the latter one, of just enabling the
'execute/search' bit. For any directory to be used for storing disk
images, this can be achieved by running the following command on the
directory itself, and any parent directories

    chmod o+x /path/to/directory

    In particular note that if using the "system" instance and
attempting to store disk images in a user home directory, the default
permissions on $HOME are typically too restrictive to allow access.

Signed-off-by: Christy Perez <christy@linux.vnet.ibm.com>
Signed-off-by: ShaoHe Feng <shaohef@linux.vnet.ibm.com>
probe iso permission: update test case

Update test_model.py

The src/kimchi/API.json says the cdrom is require for templates_create.

Signed-off-by: ShaoHe Feng <shaohef@linux.vnet.ibm.com>