Re: [libvirt] [PATCH 13/14] Block all use of libvirt.so in setuid programs

From: "Daniel P. Berrange" <berrange(a)redhat.com&gt; Avoid people introducing security flaws in their apps by forbidding the use of libvirt.so in setuid programs, with a check in virInitialize. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com&gt; --- src/libvirt.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/libvirt.c b/src/libvirt.c index 96d8fdc..d76e537 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -409,6 +409,14 @@ virGlobalInit(void) virErrorInitialize() < 0) goto error; +#ifndef IN_VIRT_LOGIN_SHELL

+ if (virIsSUID()) {

+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("libvirt.so is not safe to use from setuid programs"));