[libvirt] [PATCH] Ensure non-root can read /proc/meminfo file in LXC containers
From: "Daniel P. Berrange" <berrange@redhat.com> By default files in a FUSE mount can only be accessed by the user which created them, even if the file permissions would otherwise allow it. To allow other users to access the FUSE mount the 'allow_other' mount option must be used. This bug prevented non-root users in an LXC container from reading the /proc/meminfo file. https://bugzilla.redhat.com/show_bug.cgi?id=967977 Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- src/lxc/lxc_fuse.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/lxc/lxc_fuse.c b/src/lxc/lxc_fuse.c index b6df99c..32886cd 100644 --- a/src/lxc/lxc_fuse.c +++ b/src/lxc/lxc_fuse.c @@ -307,6 +307,7 @@ int lxcSetupFuse(virLXCFusePtr *f, virDomainDefPtr def) /* process name is libvirt_lxc */ if (fuse_opt_add_arg(&args, "libvirt_lxc") == -1 || fuse_opt_add_arg(&args, "-odirect_io") == -1 || + fuse_opt_add_arg(&args, "-oallow_other") == -1 || fuse_opt_add_arg(&args, "-ofsname=libvirt") == -1) goto cleanup1; -- 1.8.1.4
On 06/04/2013 11:10 AM, Daniel P. Berrange wrote:
From: "Daniel P. Berrange" <berrange@redhat.com>
By default files in a FUSE mount can only be accessed by the user which created them, even if the file permissions would otherwise allow it. To allow other users to access the FUSE mount the 'allow_other' mount option must be used. This bug prevented non-root users in an LXC container from reading the /proc/meminfo file.
https://bugzilla.redhat.com/show_bug.cgi?id=967977
Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- src/lxc/lxc_fuse.c | 1 + 1 file changed, 1 insertion(+)
ACK.
diff --git a/src/lxc/lxc_fuse.c b/src/lxc/lxc_fuse.c index b6df99c..32886cd 100644 --- a/src/lxc/lxc_fuse.c +++ b/src/lxc/lxc_fuse.c @@ -307,6 +307,7 @@ int lxcSetupFuse(virLXCFusePtr *f, virDomainDefPtr def) /* process name is libvirt_lxc */ if (fuse_opt_add_arg(&args, "libvirt_lxc") == -1 || fuse_opt_add_arg(&args, "-odirect_io") == -1 || + fuse_opt_add_arg(&args, "-oallow_other") == -1 || fuse_opt_add_arg(&args, "-ofsname=libvirt") == -1) goto cleanup1;
-- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org
On 06/05/2013 01:10 AM, Daniel P. Berrange wrote:
From: "Daniel P. Berrange" <berrange@redhat.com>
By default files in a FUSE mount can only be accessed by the user which created them, even if the file permissions would otherwise allow it. To allow other users to access the FUSE mount the 'allow_other' mount option must be used. This bug prevented non-root users in an LXC container from reading the /proc/meminfo file.
https://bugzilla.redhat.com/show_bug.cgi?id=967977
Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- src/lxc/lxc_fuse.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/src/lxc/lxc_fuse.c b/src/lxc/lxc_fuse.c index b6df99c..32886cd 100644 --- a/src/lxc/lxc_fuse.c +++ b/src/lxc/lxc_fuse.c @@ -307,6 +307,7 @@ int lxcSetupFuse(virLXCFusePtr *f, virDomainDefPtr def) /* process name is libvirt_lxc */ if (fuse_opt_add_arg(&args, "libvirt_lxc") == -1 || fuse_opt_add_arg(&args, "-odirect_io") == -1 || + fuse_opt_add_arg(&args, "-oallow_other") == -1 || fuse_opt_add_arg(&args, "-ofsname=libvirt") == -1) goto cleanup1;
ACK Thanks!
participants (3)
-
Daniel P. Berrange -
Eric Blake -
Gao feng