[libvirt] [PATCH] qemu: Label uniqDir when probing capabilities

[Martin Kletzander]

On Fri, Apr 12, 2019 at 02:45:32PM +0100, Daniel P. Berrangé wrote:
>On Fri, Apr 12, 2019 at 03:32:21PM +0200, Martin Kletzander wrote:
>> This does not cause a problem in usual scenarios thanks to us allowing
>> CAP_DAC_OVERRIDE for the qemu process, however in some scenarios this might be
>> an issue because the directory is created with mkdtemp(3) which explicitly
>> creates that with 0700 permissions and qemu running as non-root cannot access
>> that.
>>
>> The scenarios include:
>>  - Builds without CAPNG
>
>This makes sense, since we're unable to give QEMU CAP_DAC_OVERRIDE
>
>>  - Running libvirtd in a container [1]
>
>I'm rather puzzelled why this is a problem unless libvirtd itself
>lacks permissions to give CAP_DAC_OVERRIDE, but if that was the
>case I would have expected an error from capng when trying to
>grant it/.
>
>>  - and possibly others.
>>
>> [1] https://github.com/kubevirt/kubevirt/pull/2181#issuecomment-481840304
>>
>> Signed-off-by: Martin Kletzander <mkletzan at redhat.com>
>> ---
>>  src/qemu/qemu_process.c | 16 ++++++++++++++++
>>  1 file changed, 16 insertions(+)
>>
>> diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
>> index 47d8ca2ff163..2e2c4812fef7 100644
>> --- a/src/qemu/qemu_process.c
>> +++ b/src/qemu/qemu_process.c
>> @@ -8447,6 +8447,19 @@ qemuProcessQMPNew(const char *binary,
>>  }
>>
>>
>> +static int
>> +qemuProcessQEMULabelUniqPath(qemuProcessQMPPtr proc) {

The bracket spacing is fixed locally in my branch and will be pushed as part of
this commit if this gets reviewed.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20190412/a9f85176/attachment-0001.sig>