[PATCH 5/8] base_image: relax base image permissions

Base images created by virt-builder have default root:root 600
permissions which prevent the systemd services from reading them.
We want to let others and systemd services be able to read these
base images.

Generated-by: Claude AI
Signed-off-by: Luis Chamberlain <[email protected]>
---
 .../roles/base_image/tasks/base-image.yml      | 18 ++++++++++++++++++
 .../roles/base_image/tasks/custom-image.yml    |  6 ++++--
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/playbooks/roles/base_image/tasks/base-image.yml b/playbooks/roles/base_image/tasks/base-image.yml
index d1f99a77..fc022649 100644
--- a/playbooks/roles/base_image/tasks/base-image.yml
+++ b/playbooks/roles/base_image/tasks/base-image.yml
@@ -72,6 +72,24 @@
   when:
     - not libvirt_uri_system|bool
 
+- name: Set proper ownership on base image for rcloud access (system libvirt)
+  become: true
+  become_method: ansible.builtin.sudo
+  ansible.builtin.file:
+    path: "{{ base_image_pathname }}"
+    owner: root
+    group: "{{ libvirt_qemu_group | default('libvirt-qemu') }}"
+    mode: "0640"
+  when:
+    - libvirt_uri_system|bool
+
+- name: Set proper permissions on base image (user libvirt)
+  ansible.builtin.file:
+    path: "{{ base_image_pathname }}"
+    mode: "0644"
+  when:
+    - not libvirt_uri_system|bool
+
 - name: Clean up the virt-builder command file
   ansible.builtin.file:
     path: "{{ command_file.path }}"
diff --git a/playbooks/roles/base_image/tasks/custom-image.yml b/playbooks/roles/base_image/tasks/custom-image.yml
index 121fa112..75c48e8f 100644
--- a/playbooks/roles/base_image/tasks/custom-image.yml
+++ b/playbooks/roles/base_image/tasks/custom-image.yml
@@ -347,11 +347,13 @@
     - custom_image_stat.stat.exists or custom_image_download is changed
     - custom_image != base_image_pathname
 
-- name: Set proper permissions on base image
+- name: Set proper ownership on base image for rcloud access
   become: true
   become_method: ansible.builtin.sudo
   ansible.builtin.file:
     path: "{{ base_image_pathname }}"
-    mode: "u=rw,g=r,o=r"
+    owner: root
+    group: "{{ libvirt_qemu_group | default('libvirt-qemu') }}"
+    mode: "0640"
   when:
     - custom_image_stat.stat.exists or custom_image_download is changed
-- 
2.51.0