nova currntly relys on libvirt dynmic ownwershp feature to enable qemu to access the
instance files (disk,console, config drive,...)

libvirt does not allow the file mode to be modified for these files and as a result makes them world readblae.

in some environments, this is not desirable.
while our security model assumes you prevent any access to the host files system we can harden this slightly by developing a feature in nova and or libvirt to restrict sharing to the user and group.

note that we tried to workaround this previously using umask and that broke several important features so we should not take that approach and do this properly in nova/libvirt as a feature.
https://bugzilla.redhat.com/show_bug.cgi?id=2127456