Re: [libvirt] [PATCH 2/3] Set basic capabilities needed for libvirtd
On Mon, Jun 22, 2009 at 08:58:27PM +0100, Daniel P. Berrange wrote:
This sets up some basic support in libvirtd for dropping privileges
by removing capabilities, or changing uid/gid of the process. It
needed a little movement of existing code to allow us to drop
privileges in between initializing the daemon and initializing the
drivers.
As I mentioned in the first mail, this patch doesn't really improve
security of the daemon, since we keep CAP_DAC_OVERRIDE, CAP_SYS_ADMIN
and CAP_NET_ADMIN. I've put comments inline showing why I chose to
keep/exclude each capability.
the problem is that the amound of capability we can drop is dependant
on the actual set of drivers installed. I have the feeling that each
driver should have a method exporting the capabilities it needs and
once we have initialized the set of drivers then we should drop to the
logical OR'ing of them. I think trying to maintain a global knowledge of
all drivers requirement in a central place won't scale well and that's
better left to the drivers maintainers.
I also added a helper to util.c for resolving a name to a gid/uid.
Ignore all the printfs() in the code, those will be removed later
before I submit this again...
That said as a first approach that looks fine to me.
Daniel
--
Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/
daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/
http://veillard.com/ | virtualization library http://libvirt.org/