Virt-manager changes .iso file permissions

Q&A
1

When trying to use virt-manager to create a virtual machine, virt-manager changes .iso file permissions, owner to qemu and group to qemu then fails to create a VM. Can anyone tell me why this is happening?

sudo cat alpinelinux3.21.log
2025-04-08 22:10:00.324+0000: starting up libvirt version: 11.1.0, qemu version: 9.1.1, kernel: 6.13.8-1555.native, hostname: sara
LC_ALL=C
PATH=/usr/local/bin:/usr/bin
USER=root
HOME=/var/lib/libvirt/qemu/domain-2-alpinelinux3.21
XDG_DATA_HOME=/var/lib/libvirt/qemu/domain-2-alpinelinux3.21/.local/share
XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain-2-alpinelinux3.21/.cache
XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain-2-alpinelinux3.21/.config
/usr/bin/qemu-system-x86_64
-name guest=alpinelinux3.21,debug-threads=on
-S
-object ‘{“qom-type”:“secret”,“id”:“masterKey0”,“format”:“raw”,“file”:“/var/lib/libvirt/qemu/domain-2-alpinelinux3.21/master-key.aes”}’
-blockdev ‘{“driver”:“file”,“filename”:“/usr/share/qemu/edk2-x86_64-secure-code.fd”,“node-name”:“libvirt-pflash0-storage”,“auto-read-only”:true,“discard”:“unmap”}’
-blockdev ‘{“node-name”:“libvirt-pflash0-format”,“read-only”:true,“driver”:“raw”,“file”:“libvirt-pflash0-storage”}’
-blockdev ‘{“driver”:“file”,“filename”:“/var/lib/libvirt/qemu/nvram/alpinelinux3.21_VARS.fd”,“node-name”:“libvirt-pflash1-storage”,“read-only”:false}’
-machine pc-q35-9.1,usb=off,vmport=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-storage,hpet=off,acpi=on
-accel kvm
-cpu host,migratable=on
-global driver=cfi.pflash01,property=secure,value=on
-m size=2097152k
-object ‘{“qom-type”:“memory-backend-ram”,“id”:“pc.ram”,“size”:2147483648}’
-overcommit mem-lock=off
-smp 4,sockets=4,cores=1,threads=1
-uuid d6e887d6-7a2c-435f-b1ed-63d2b831603f
-no-user-config
-nodefaults
-chardev socket,id=charmonitor,fd=33,server=on,wait=off
-mon chardev=charmonitor,id=monitor,mode=control
-rtc base=utc,driftfix=slew
-global kvm-pit.lost_tick_policy=delay
-no-shutdown
-global ICH9-LPC.disable_s3=1
-global ICH9-LPC.disable_s4=1
-boot strict=on
-device ‘{“driver”:“pcie-root-port”,“port”:16,“chassis”:1,“id”:“pci.1”,“bus”:“pcie.0”,“multifunction”:true,“addr”:“0x2”}’
-device ‘{“driver”:“pcie-root-port”,“port”:17,“chassis”:2,“id”:“pci.2”,“bus”:“pcie.0”,“addr”:“0x2.0x1”}’
-device ‘{“driver”:“pcie-root-port”,“port”:18,“chassis”:3,“id”:“pci.3”,“bus”:“pcie.0”,“addr”:“0x2.0x2”}’
-device ‘{“driver”:“pcie-root-port”,“port”:19,“chassis”:4,“id”:“pci.4”,“bus”:“pcie.0”,“addr”:“0x2.0x3”}’
-device ‘{“driver”:“pcie-root-port”,“port”:20,“chassis”:5,“id”:“pci.5”,“bus”:“pcie.0”,“addr”:“0x2.0x4”}’
-device ‘{“driver”:“pcie-root-port”,“port”:21,“chassis”:6,“id”:“pci.6”,“bus”:“pcie.0”,“addr”:“0x2.0x5”}’
-device ‘{“driver”:“pcie-root-port”,“port”:22,“chassis”:7,“id”:“pci.7”,“bus”:“pcie.0”,“addr”:“0x2.0x6”}’
-device ‘{“driver”:“pcie-root-port”,“port”:23,“chassis”:8,“id”:“pci.8”,“bus”:“pcie.0”,“addr”:“0x2.0x7”}’
-device ‘{“driver”:“pcie-root-port”,“port”:24,“chassis”:9,“id”:“pci.9”,“bus”:“pcie.0”,“multifunction”:true,“addr”:“0x3”}’
-device ‘{“driver”:“pcie-root-port”,“port”:25,“chassis”:10,“id”:“pci.10”,“bus”:“pcie.0”,“addr”:“0x3.0x1”}’
-device ‘{“driver”:“pcie-root-port”,“port”:26,“chassis”:11,“id”:“pci.11”,“bus”:“pcie.0”,“addr”:“0x3.0x2”}’
-device ‘{“driver”:“pcie-root-port”,“port”:27,“chassis”:12,“id”:“pci.12”,“bus”:“pcie.0”,“addr”:“0x3.0x3”}’
-device ‘{“driver”:“pcie-root-port”,“port”:28,“chassis”:13,“id”:“pci.13”,“bus”:“pcie.0”,“addr”:“0x3.0x4”}’
-device ‘{“driver”:“pcie-root-port”,“port”:29,“chassis”:14,“id”:“pci.14”,“bus”:“pcie.0”,“addr”:“0x3.0x5”}’
-device ‘{“driver”:“qemu-xhci”,“p2”:15,“p3”:15,“id”:“usb”,“bus”:“pci.2”,“addr”:“0x0”}’
-device ‘{“driver”:“virtio-serial-pci”,“id”:“virtio-serial0”,“bus”:“pci.3”,“addr”:“0x0”}’
-blockdev ‘{“driver”:“file”,“filename”:“/var/lib/libvirt/images/alpinelinux3.21.qcow2”,“node-name”:“libvirt-2-storage”,“auto-read-only”:true,“discard”:“unmap”}’
-blockdev ‘{“node-name”:“libvirt-2-format”,“read-only”:false,“discard”:“unmap”,“driver”:“qcow2”,“file”:“libvirt-2-storage”,“backing”:null}’
-device ‘{“driver”:“virtio-blk-pci”,“bus”:“pci.4”,“addr”:“0x0”,“drive”:“libvirt-2-format”,“id”:“virtio-disk0”,“bootindex”:2}’
-blockdev ‘{“driver”:“file”,“filename”:“/home/clbase/Downloads/ISOfiles/alpine-virt-3.21.3-x86_64.iso”,“node-name”:“libvirt-1-storage”,“read-only”:true}’
-device ‘{“driver”:“ide-cd”,“bus”:“ide.0”,“drive”:“libvirt-1-storage”,“id”:“sata0-0-0”,“bootindex”:1}’
-netdev ‘{“type”:“tap”,“fd”:“34”,“vhost”:true,“vhostfd”:“36”,“id”:“hostnet0”}’
-device ‘{“driver”:“virtio-net-pci”,“netdev”:“hostnet0”,“id”:“net0”,“mac”:“52:54:00:8c:21:7f”,“bus”:“pci.1”,“addr”:“0x0”}’
-chardev pty,id=charserial0
-device ‘{“driver”:“isa-serial”,“chardev”:“charserial0”,“id”:“serial0”,“index”:0}’
-chardev socket,id=charchannel0,fd=31,server=on,wait=off
-device ‘{“driver”:“virtserialport”,“bus”:“virtio-serial0.0”,“nr”:1,“chardev”:“charchannel0”,“id”:“channel0”,“name”:“org.qemu.guest_agent.0”}’
-chardev spicevmc,id=charchannel1,name=vdagent
-device ‘{“driver”:“virtserialport”,“bus”:“virtio-serial0.0”,“nr”:2,“chardev”:“charchannel1”,“id”:“channel1”,“name”:“com.redhat.spice.0”}’
-device ‘{“driver”:“usb-tablet”,“id”:“input0”,“bus”:“usb.0”,“port”:“1”}’
-audiodev ‘{“id”:“audio1”,“driver”:“spice”}’
-spice port=5900,addr=127.0.0.1,disable-ticketing=on,image-compression=off,seamless-migration=on
-device ‘{“driver”:“qxl-vga”,“id”:“video0”,“max_outputs”:1,“ram_size”:67108864,“vram_size”:67108864,“vram64_size_mb”:0,“vgamem_mb”:16,“bus”:“pcie.0”,“addr”:“0x1”}’
-device ‘{“driver”:“ich9-intel-hda”,“id”:“sound0”,“bus”:“pcie.0”,“addr”:“0x1b”}’
-device ‘{“driver”:“hda-duplex”,“id”:“sound0-codec0”,“bus”:“sound0.0”,“cad”:0,“audiodev”:“audio1”}’
-global ICH9-LPC.noreboot=off
-watchdog-action reset
-chardev spicevmc,id=charredir0,name=usbredir
-device ‘{“driver”:“usb-redir”,“chardev”:“charredir0”,“id”:“redir0”,“bus”:“usb.0”,“port”:“2”}’
-chardev spicevmc,id=charredir1,name=usbredir
-device ‘{“driver”:“usb-redir”,“chardev”:“charredir1”,“id”:“redir1”,“bus”:“usb.0”,“port”:“3”}’
-device ‘{“driver”:“virtio-balloon-pci”,“id”:“balloon0”,“bus”:“pci.5”,“addr”:“0x0”}’
-object ‘{“qom-type”:“rng-random”,“id”:“objrng0”,“filename”:“/dev/urandom”}’
-device ‘{“driver”:“virtio-rng-pci”,“rng”:“objrng0”,“id”:“rng0”,“bus”:“pci.6”,“addr”:“0x0”}’
-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny
-msg timestamp=on
char device redirected to /dev/pts/1 (label charserial0)
2025-04-08T22:10:00.401742Z qemu-system-x86_64: -blockdev {“driver”:“file”,“filename”:“/home/clbase/Downloads/ISOfiles/alpine-virt-3.21.3-x86_64.iso”,“node-name”:“libvirt-1-storage”,“read-only”:true}: Could not open ‘/home/clbase/Downloads/ISOfiles/alpine-virt-3.21.3-x86_64.iso’: Permission denied
2025-04-08 22:10:00.452+0000: shutting down, reason=failed

2

Please let me know if this is not the place to ask this question.

3

if you believe this to be a bug in CL’s implementation, you may file a bug report on the github GitHub · Where software is built

4

Would joining the qemu group help?

sudo usermod -aG qemu “your user name”

5

After adding my user to groups kvm and qemu, running

getent group | grep qemu

Shows 2 instances of groups kvm and qemu, one with the user and one without. File /etc/group is very sparse and only shows the groups with the user included. It seems that that usermod changes are added to /etc/passwd instead of the hidden file of group definitions.

6

Due to the stateless setup of Clear Linux, there is also a group and passwd file in /usr/share/defaults/etc.
These files have the entries for the core system and installed bundles.

getent reads from both these locations (files and altfiles).
The instances without the user are from /usr/share/defaults/etc/group. This was created when the bundle was installed.
The instances with the user are from /etc/group. This was the result of a user action.