adrahon/vagrant-kvm — pull request #125 by miurahr (2014-01-04 11:49:08+00:00)
Title: Share /vagrant with VirtFS(p9) by KVM/QEMU without root privilege

Now we can provide a QEMU/KVM native file share method, because Vagrant 1.4+ changes its internal middleware and extend synced_folders abstraction,
(This change causes current vagrant-kvm(0.1.4) not working, because NFS middleware was removed.)

This pull request provide virtfs(p9) share for Linux guest and change default share from nfs to virtfs.
Unfortunately there are no Windows driver for p9fs on virtio. Who want to use Windows guest with vagrant-kvm should wait CIFS/SMB share support by Vagrant project , use NFS driver for Windows or use VirtualBox.

There are several issues with VirtFS and libvirt.

1. libvirt don't keep virtfs share xml definition. Once suspending a guest VM, it does not make share.
It can be observed through files at /etc/libvirt/qemu/ and compare with template/libvirt-domain.erb file.

2. libvirt don't care about security framework for virtfs share.
It makes QEMU/KVM share denied by host OS's security framework such as AppArmor(ubuntu) and SELinux(fedora). This cause a security error on host OS when guest OS access to /vagrant.
You may see a following in 'ls -l /'
????????? ? ?? ?? ? ? ? /vagrant

It is because host OS's security framework denied to access /vagrant directory entry.

There is a way to escape this problem. User can add definitions to AppArmor and/or SELinux by hand.
For example, in AppArmor, add following lines in /etc/apparmor.d/abstractions/libvirt-qemu

/home/foo/boo rw,
/home/foo/boo** rw,

here is foo/boo is a drectory Vagrantfile exist. and then

aa-complain /etc/apparmor.d/libvirt/libvirt-xxxx-xxxx-xxxx-xxxx-xxxxxxxxx

Now here is a file that is made by libvirt automatically when `vagrant up`

These 2 problems are enough reason to put this pull request on the talble until libvirt project fixes it.

I'd like to leave comments here about a progress in libvirt development.