mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-12-22 21:55:25 +00:00
qemu: don't change ownership of cache directory
Commit6bcf25017b
("virDomainMemoryPeek API") introduced memory peek and commit9936aecfd1
("qemu: Implement the driver methods") introduced screenshot. Both of them will put temporary files in /var/cache/libvirt/qemu, and the temporary files are created by QEMU. Therefore, the ownership of /var/cache/libvirt/qemu should be changed to user and group configured in qemu.conf to make sure that QEMU process can create and write files in the cache directory. Libvirt will only put the temporary files in /var/cache/libvirt/qemu until commitcbde35899b
("Cache result of QEMU capabilities extraction"), which will put the cache of QEMU capabilities in 'capabilities' subdir of the cache directory. Because the capabilities is used by libvirt, the ownership of both 'capabilities' subdir and capabilities files are root. However, when QEMU process runs as a regular user (e.g. qemu user), the ownership of /var/cache/libvirt/qemu will be changed to qemu:qemu while that of /var/cache/libvirt/qemu/capabilities will be still root:root. Then the regular user could spoof different capabilities, which maybe lead to denial of service. Since the previous patch has move the temp files of screenshot and memory peek to per-domain directory, no one except domain capabilities uses cacheDir currently. And since domain capabilities are used by libvirtd instead of QEMU, no need to change the ownership of cacheDir to qemu:qemu explicitly. Signed-off-by: Peng Liang <liangpeng10@huawei.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
This commit is contained in:
parent
a50c473ad6
commit
c4f3c955d5
@ -748,13 +748,6 @@ qemuStateInitialize(bool privileged,
|
||||
(int)cfg->group);
|
||||
goto error;
|
||||
}
|
||||
if (chown(cfg->cacheDir, cfg->user, cfg->group) < 0) {
|
||||
virReportSystemError(errno,
|
||||
_("unable to set ownership of '%s' to %d:%d"),
|
||||
cfg->cacheDir, (int)cfg->user,
|
||||
(int)cfg->group);
|
||||
goto error;
|
||||
}
|
||||
if (chown(cfg->saveDir, cfg->user, cfg->group) < 0) {
|
||||
virReportSystemError(errno,
|
||||
_("unable to set ownership of '%s' to %d:%d"),
|
||||
|
Loading…
Reference in New Issue
Block a user