[libvirt] [PATCH] security_dac: compute supplemental groups before fork

[Eric Blake]

On 07/15/2013 06:14 AM, Daniel P. Berrange wrote:
> On Fri, Jul 12, 2013 at 03:13:48PM -0600, Eric Blake wrote:
>> @@ -146,8 +149,12 @@ virSecurityManagerPtr virSecurityManagerNewDAC(const char *virtDriver,
>>      if (!mgr)
>>          return NULL;
>>
>> -    virSecurityDACSetUser(mgr, user);
>> -    virSecurityDACSetGroup(mgr, group);
>> +    if ((ngroups = virGetGroupList(user, group, &groups)) < 0) {
>> +        virObjectUnref(mgr);
>> +        return NULL;
>> +    }
>> +
>> +    virSecurityDACSetUIDGID(mgr, user, group, groups, ngroups);
> 
> Hmm, the virSecurityManagerNewDAC method is run once at libvirtd startup.
> Previously if you edited /etc/group to change a user's groups it would
> take effect the very next time a VM is started. With this change, it will
> only take effect if libvirtd is restarted, which is a regression in
> behaviour.

But we still want to avoid the deadlock possible when probing the group
database between fork and exec.  I guess that means I need to change
virSecurityManagerPreFork() to be the entry point where we probe
supplemental groups, so that the probe is done as late as possible
before the fork (and thus picks up the latest /etc changes).  I'll try
that for a v2.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 621 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20130715/945791e0/attachment-0001.sig>