[libvirt] [PATCH 0/2] Fix permissions for per-VM and qemu directories
This is basically v2 of: https://www.redhat.com/archives/libvir-list/2015-September/msg00295.html with some changes: - permissions for per-VM dirs are fixed as well - permissions for the /var/lib/libvirt/qemu directory are fixed in the install phase of Makefile.am in addition to the spec file We could also fix the permissions in qemuStateInitialize, but I chose to do it this way. Bear in mind, that both approaches have their pros and cons, of course. Martin Kletzander (2): qemu: Do not allow others into per-VM subdirectories qemu: Allow others to browse /var/lib/libvirt/qemu libvirt.spec.in | 4 ++-- src/Makefile.am | 2 +- src/qemu/qemu_process.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) -- 2.5.2
Signed-off-by: Martin Kletzander <mkletzan@redhat.com> --- src/qemu/qemu_process.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index d9a0942c4dfd..ce2c70cb3fd1 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -4734,7 +4734,7 @@ int qemuProcessStart(virConnectPtr conn, if (virAsprintf(&tmppath, "%s/domain-%s", cfg->libDir, vm->def->name) < 0) goto cleanup; - if (virFileMakePath(tmppath) < 0) { + if (virFileMakePathWithMode(tmppath, 0750) < 0) { virReportSystemError(errno, _("Cannot create directory '%s'"), tmppath); goto cleanup; } @@ -4749,7 +4749,7 @@ int qemuProcessStart(virConnectPtr conn, cfg->channelTargetDir, vm->def->name) < 0) goto cleanup; - if (virFileMakePath(tmppath) < 0) { + if (virFileMakePathWithMode(tmppath, 0750) < 0) { virReportSystemError(errno, _("Cannot create directory '%s'"), tmppath); goto cleanup; } -- 2.5.2
Commit f1f68ca33433 tried fixing running multiple domains under various users, but if the user can't browse the directory, it's hard for the qemu running under that user to create the monitor socket. The permissions need to be fixed in two places in the spec file due to support for both installations with and without driver modules. Creating a directory with '$(MKDIR_P) -m' shouldn't fail even on systems where autoconf needs to fallback to 'install-sh -d'. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1146886 Signed-off-by: Martin Kletzander <mkletzan@redhat.com> --- libvirt.spec.in | 4 ++-- src/Makefile.am | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index bb8bfc3c25c1..48461e865dc8 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -2002,7 +2002,7 @@ exit 0 %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd.qemu %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/qemu/ %ghost %dir %attr(0700, root, root) %{_localstatedir}/run/libvirt/qemu/ -%dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/ +%dir %attr(0751, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/ %dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/cache/libvirt/qemu/ %{_datadir}/augeas/lenses/libvirtd_qemu.aug %{_datadir}/augeas/lenses/tests/test_libvirtd_qemu.aug @@ -2110,7 +2110,7 @@ exit 0 %config(noreplace) %{_sysconfdir}/libvirt/qemu-lockd.conf %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd.qemu %ghost %dir %attr(0700, root, root) %{_localstatedir}/run/libvirt/qemu/ -%dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/ +%dir %attr(0751, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/ %dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/cache/libvirt/qemu/ %{_datadir}/augeas/lenses/libvirtd_qemu.aug %{_datadir}/augeas/lenses/tests/test_libvirtd_qemu.aug diff --git a/src/Makefile.am b/src/Makefile.am index 429137561c6f..060abe8e26e2 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -2805,7 +2805,7 @@ if WITH_SANLOCK $(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/sanlock" endif WITH_SANLOCK if WITH_QEMU - $(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/qemu" + $(MKDIR_P) -m 0751 "$(DESTDIR)$(localstatedir)/lib/libvirt/qemu" $(MKDIR_P) "$(DESTDIR)$(localstatedir)/run/libvirt/qemu" $(MKDIR_P) "$(DESTDIR)$(localstatedir)/cache/libvirt/qemu" $(MKDIR_P) "$(DESTDIR)$(localstatedir)/log/libvirt/qemu" -- 2.5.2
On 12.09.2015 16:31, Martin Kletzander wrote:
This is basically v2 of: https://www.redhat.com/archives/libvir-list/2015-September/msg00295.html with some changes:
- permissions for per-VM dirs are fixed as well
- permissions for the /var/lib/libvirt/qemu directory are fixed in the install phase of Makefile.am in addition to the spec file
We could also fix the permissions in qemuStateInitialize, but I chose to do it this way. Bear in mind, that both approaches have their pros and cons, of course.
Martin Kletzander (2): qemu: Do not allow others into per-VM subdirectories qemu: Allow others to browse /var/lib/libvirt/qemu
libvirt.spec.in | 4 ++-- src/Makefile.am | 2 +- src/qemu/qemu_process.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-)
ACK to both Michal
participants (2)
-
Martin Kletzander -
Michal Privoznik