What were you trying to do that didn't work?

Upstream issue: https://github.com/cockpit-project/cockpit-machines/issues/2011

Currently, when an user add an already-in-use RAW volume to another virtual machine, the disk is attached as a "shared writable" volume and, at the same time, such a change is scheduled for the first virtual machine also. Sharing a disk in this manner poses a significant risks as, when the two virtual machines start, they will both try to open the underlying volume and corruption will quickly happen. The only warning the user see is a yellow/orange triangle and a (small) orange statement that the disk will become shared.

Changing a disk from "writeble" to "shared writable" should be done only after explicit user consent and never be easy to accidentally trigger. virt-manager does exactly that: it asks the user if the disk should really be added to another virtual machine and, after that, does not automatically marks the disk as shared. So user not only needs to confirm the add operation, but it has to enable the "shareable" flag on both machines before allowing them to start.

Please do the same for cockpit-machines. As a side note, the add disk via "custom path" form does not automatically change the "shareable" flag, so removing this behavior from the "use existing" disk form is going to present a more consistent (and much safer) behavior.

What is the impact of this issue to you?

Disks can be unexpectedly attached to different virtual machines at the same time, leading to data corruption unless using a cluster-aware filesystem.

Please provide the package NVR for which the bug is seen:

cockpit-machines-318.1-1.el9_5.rpm

How reproducible is this bug?:

Always

Steps to reproduce

1. attach a RAW volume to a virtual machine
2. attach the same volume to another virtual machines via the "existing disk" panel
3. the volume becomes a "shareable" one
4. start the two virtual machines
5. both virtual machines access the shared disk, corrupting it
6. note that no error or warning requiring confirmation was ever shown

Expected results

Sharing a disk should require user confirmation, and the user should be in charge of changing the relative flag on both virtual machine.

Actual results

It is too easy to erroneously share a volume between multiple virtual machines.