diff --git a/defaults/main.yml b/defaults/main.yml
index b1996705..f82aba0d 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -286,6 +286,9 @@ nova_wsgi_processes: "{{ [[ansible_processor_vcpus|default(1), 1] | max * 2, nov
 nova_wsgi_buffer_size: 65535
 
 ## Nova libvirt
+# Warning: If nova_libvirt_inject_key or nova_libvirt_inject_password are enabled for Ubuntu compute hosts
+# then the kernel will be made readable to nova user (a requirement for libguestfs).
+# See Launchpad bugs 1507915 (Nova), 759725 (Ubuntu), and http://libguestfs.org/guestfs-faq.1.html
 nova_libvirt_inject_key: False
 # inject partition options:
 #  -2 => disable, -1 => inspect (libguestfs only), 0 => not partitioned, >0 => partition number
diff --git a/files/nova_kernel_permissions.sh b/files/nova_kernel_permissions.sh
new file mode 100644
index 00000000..00808715
--- /dev/null
+++ b/files/nova_kernel_permissions.sh
@@ -0,0 +1,20 @@
+#/bin/sh
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -e
+version="$1"
+if [ -z "$version" ]; then
+  exit 0
+fi
+exec dpkg-statoverride --update --add root nova 0640 "/boot/vmlinuz-${version}"
diff --git a/tasks/nova_compute_kvm.yml b/tasks/nova_compute_kvm.yml
index efd1db56..594833e7 100644
--- a/tasks/nova_compute_kvm.yml
+++ b/tasks/nova_compute_kvm.yml
@@ -33,6 +33,12 @@
     - nova-config
     - nova-kvm
 
+- name: Set kernel permissions to enable libguestfs features (Ubuntu)
+  include: nova_kernel_permissions.yml
+  when:
+    - ansible_distribution == 'Ubuntu'
+    - nova_libvirt_inject_key | bool or nova_libvirt_inject_password | bool
+
 - name: Set libvirtd config
   template:
     src: libvirtd.conf.j2
diff --git a/tasks/nova_kernel_permissions.yml b/tasks/nova_kernel_permissions.yml
new file mode 100644
index 00000000..2cf5d9fe
--- /dev/null
+++ b/tasks/nova_kernel_permissions.yml
@@ -0,0 +1,39 @@
+---
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Find installed kernels
+  find:
+    paths: '/boot'
+    patterns: 'vmlinuz-*'
+  register: kernels
+
+- name: Determine latest installed kernel
+  set_fact:
+    latest_kernel: "{{ kernels.files | map(attribute='path') | sort(reverse=True) | first }}"
+
+- name: Latest kernel readable to nova group/user
+  command: 'dpkg-statoverride --update --add root nova 0640 {{ latest_kernel }}'
+  register: dpkg_statoverride_result
+  changed_when: >
+    'an override for \'{{ latest_kernel }}\' already exists; aborting'
+    not in dpkg_statoverride_result.stderr
+  failed_when: >
+    (dpkg_statoverride_result.rc != 0) and
+    ('an override for \'{{ latest_kernel }}\' already exists; aborting'
+    not in dpkg_statoverride_result.stderr)
+
+- name: Script installed to make future kernels readable to nova group/user
+  copy:
+    src: 'nova_kernel_permissions.sh'
+    dest: '/etc/kernel/postinst.d/nova_kernel_permissions.sh'
+    mode: '0755'