diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 845ecdca866e0ec5bb3443521d61b2c9ffe07f7a..3df3a0c5f21ef6a869f54947a3d213b00856c2da 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -329,10 +329,11 @@ qemuAutostartDomains(virQEMUDriverPtr driver)
 
 
 static int
-qemuSecurityChownCallback(virStorageSourcePtr src,
+qemuSecurityChownCallback(const virStorageSource *src,
                           uid_t uid,
                           gid_t gid)
 {
+    virStorageSourcePtr cpy = NULL;
     struct stat sb;
     int save_errno = 0;
     int ret = -1;
@@ -354,22 +355,28 @@ qemuSecurityChownCallback(virStorageSourcePtr src,
             }
         }
 
-        return chown(src->path, uid, gid);
-    }
+        if (chown(src->path, uid, gid) < 0)
+            goto cleanup;
+    } else {
+        if (!(cpy = virStorageSourceCopy(src, false)))
+            goto cleanup;
 
-    /* storage file init reports errors, return -2 on failure */
-    if (virStorageFileInit(src) < 0)
-        return -2;
+        /* src file init reports errors, return -2 on failure */
+        if (virStorageFileInit(cpy) < 0) {
+            ret = -2;
+            goto cleanup;
+        }
 
-    if (virStorageFileChown(src, uid, gid) < 0) {
-        save_errno = errno;
-        goto cleanup;
+        if (virStorageFileChown(cpy, uid, gid) < 0)
+            goto cleanup;
     }
 
     ret = 0;
 
  cleanup:
-    virStorageFileDeinit(src);
+    save_errno = errno;
+    virStorageFileDeinit(cpy);
+    virStorageSourceFree(cpy);
     errno = save_errno;
 
     return ret;
diff --git a/src/security/security_dac.c b/src/security/security_dac.c
index 649219e527b59171e2d49793b1fbf4e2283fb7e2..b6f75fe1dc377290227f4563307c579ae9dcc50b 100644
--- a/src/security/security_dac.c
+++ b/src/security/security_dac.c
@@ -279,8 +279,8 @@ virSecurityDACPreFork(virSecurityManagerPtr mgr)
 }
 
 static int
-virSecurityDACSetOwnershipInternal(virSecurityDACDataPtr priv,
-                                   virStorageSourcePtr src,
+virSecurityDACSetOwnershipInternal(const virSecurityDACData *priv,
+                                   const virStorageSource *src,
                                    const char *path,
                                    uid_t uid,
                                    gid_t gid)
diff --git a/src/security/security_manager.h b/src/security/security_manager.h
index 0d22cb15fcb2c496549248347fdae8839b03c45e..80fceddc84e3260645362a78e8df238db4e2d4eb 100644
--- a/src/security/security_manager.h
+++ b/src/security/security_manager.h
@@ -62,7 +62,7 @@ int virSecurityManagerStackAddNested(virSecurityManagerPtr stack,
  * @src. The callback shall return 0 on success, -1 on error and errno set (no
  * libvirt error reported) OR -2 and a libvirt error reported. */
 typedef int
-(*virSecurityManagerDACChownCallback)(virStorageSourcePtr src,
+(*virSecurityManagerDACChownCallback)(const virStorageSource *src,
                                       uid_t uid,
                                       gid_t gid);
 
diff --git a/src/storage/storage_backend.h b/src/storage/storage_backend.h
index 28e1a651705be14f981fedc0d4e5d21418311005..82fbbbf6d2c66df7be3e59c55d2c2ca760bc3aa1 100644
--- a/src/storage/storage_backend.h
+++ b/src/storage/storage_backend.h
@@ -285,7 +285,7 @@ typedef int
                                int mode);
 
 typedef int
-(*virStorageFileBackendChown)(virStorageSourcePtr src,
+(*virStorageFileBackendChown)(const virStorageSource *src,
                               uid_t uid,
                               gid_t gid);
 
diff --git a/src/storage/storage_backend_fs.c b/src/storage/storage_backend_fs.c
index de0e8d57df548fcec53372ff925fa005ac4df75e..9de0c17c06718c0cff1b22fbd24bbc756f63ee5c 100644
--- a/src/storage/storage_backend_fs.c
+++ b/src/storage/storage_backend_fs.c
@@ -1600,7 +1600,7 @@ virStorageFileBackendFileAccess(virStorageSourcePtr src,
 
 
 static int
-virStorageFileBackendFileChown(virStorageSourcePtr src,
+virStorageFileBackendFileChown(const virStorageSource *src,
                                uid_t uid,
                                gid_t gid)
 {
diff --git a/src/storage/storage_backend_gluster.c b/src/storage/storage_backend_gluster.c
index 8e867043e9c2da448b50e68cd0d68382565cdcda..ae0611543c9a733ce8108c58666f6210129b94d5 100644
--- a/src/storage/storage_backend_gluster.c
+++ b/src/storage/storage_backend_gluster.c
@@ -809,7 +809,7 @@ virStorageFileBackendGlusterGetUniqueIdentifier(virStorageSourcePtr src)
 
 
 static int
-virStorageFileBackendGlusterChown(virStorageSourcePtr src,
+virStorageFileBackendGlusterChown(const virStorageSource *src,
                                   uid_t uid,
                                   gid_t gid)
 {
diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c
index 5fc706634a5db1749b97a603f5f99c2efcf41e02..8f1d3f04c85b7c9690cc50e9845ec726480379ba 100644
--- a/src/storage/storage_driver.c
+++ b/src/storage/storage_driver.c
@@ -2848,7 +2848,7 @@ int storageRegister(void)
 
 /* ----------- file handlers cooperating with storage driver --------------- */
 static bool
-virStorageFileIsInitialized(virStorageSourcePtr src)
+virStorageFileIsInitialized(const virStorageSource *src)
 {
     return src && src->drv;
 }
@@ -2888,7 +2888,7 @@ virStorageFileSupportsBackingChainTraversal(virStorageSourcePtr src)
  * driver to perform labelling
  */
 bool
-virStorageFileSupportsSecurityDriver(virStorageSourcePtr src)
+virStorageFileSupportsSecurityDriver(const virStorageSource *src)
 {
     int actualType;
     virStorageFileBackendPtr backend;
@@ -3179,7 +3179,7 @@ virStorageFileAccess(virStorageSourcePtr src,
  * by libvirt storage backend.
  */
 int
-virStorageFileChown(virStorageSourcePtr src,
+virStorageFileChown(const virStorageSource *src,
                     uid_t uid,
                     gid_t gid)
 {
diff --git a/src/storage/storage_driver.h b/src/storage/storage_driver.h
index 3f2549da54b832201bee356122d1111fdb66e2a5..682c9ff827671a38b73ed4d5a695ba108f6e50c8 100644
--- a/src/storage/storage_driver.h
+++ b/src/storage/storage_driver.h
@@ -44,9 +44,9 @@ ssize_t virStorageFileReadHeader(virStorageSourcePtr src,
                                  char **buf);
 const char *virStorageFileGetUniqueIdentifier(virStorageSourcePtr src);
 int virStorageFileAccess(virStorageSourcePtr src, int mode);
-int virStorageFileChown(virStorageSourcePtr src, uid_t uid, gid_t gid);
+int virStorageFileChown(const virStorageSource *src, uid_t uid, gid_t gid);
 
-bool virStorageFileSupportsSecurityDriver(virStorageSourcePtr src);
+bool virStorageFileSupportsSecurityDriver(const virStorageSource *src);
 
 int virStorageFileGetMetadata(virStorageSourcePtr src,
                               uid_t uid, gid_t gid,
diff --git a/src/util/virstoragefile.c b/src/util/virstoragefile.c
index ce6d21388a7752b687908cff6491d2cf715484d6..3d4bda7002f3d267ea07e528a1e13d4dd23b772e 100644
--- a/src/util/virstoragefile.c
+++ b/src/util/virstoragefile.c
@@ -2082,7 +2082,7 @@ virStorageSourceGetActualType(const virStorageSource *def)
 
 
 bool
-virStorageSourceIsLocalStorage(virStorageSourcePtr src)
+virStorageSourceIsLocalStorage(const virStorageSource *src)
 {
     virStorageType type = virStorageSourceGetActualType(src);
 
diff --git a/src/util/virstoragefile.h b/src/util/virstoragefile.h
index 1f62244dbcbc7b839cbecf8a925b65132d7e2c5f..bea1c35a2d9e52229fafce53d22662bf26013b1b 100644
--- a/src/util/virstoragefile.h
+++ b/src/util/virstoragefile.h
@@ -349,7 +349,7 @@ int virStorageSourceInitChainElement(virStorageSourcePtr newelem,
 void virStorageSourcePoolDefFree(virStorageSourcePoolDefPtr def);
 void virStorageSourceClear(virStorageSourcePtr def);
 int virStorageSourceGetActualType(const virStorageSource *def);
-bool virStorageSourceIsLocalStorage(virStorageSourcePtr src);
+bool virStorageSourceIsLocalStorage(const virStorageSource *src);
 bool virStorageSourceIsEmpty(virStorageSourcePtr src);
 bool virStorageSourceIsBlockLocal(const virStorageSource *src);
 void virStorageSourceFree(virStorageSourcePtr def);