Re: [libvirt] [PATCH] qemu: Set umask before calling mknod()

When we populate the private /dev that's going to be used by an isolated QEMU process, we take care all metadata matches what's in the top-level namespace: in particular, we copy the file permissions directly. However, since the permissions passed to mknod() are still affected by the active umask, we need to set it to a very permissive value before creating device nodes to avoid file access issues. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1421036 --- src/qemu/qemu_domain.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index f62bf8f..7993acc 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -7040,6 +7040,7 @@ qemuDomainCreateDeviceRecursive(const char *device, #ifdef WITH_SELINUX char *tcon = NULL; #endif + mode_t oldUmask = umask((mode_t) 0); if (!ttl) { virReportSystemError(ELOOP, @@ -7205,6 +7206,7 @@ qemuDomainCreateDeviceRecursive(const char *device, #ifdef WITH_SELINUX freecon(tcon); #endif + umask(oldUmask); return ret; }