[Libguestfs] [PATCH v2v] lib: Use an ACL to allow qemu to access the v2v directory

When using the libvirt backend and running as root, libvirt will run qemu as a non-root user (eg. qemu:qemu). The v2v directory stores NBD endpoints that qemu must be able to open and so we set the directory to mode 0711. Unfortunately this permits any non-root user to open the sockets (since, by design, they have predictable names within the directory). So instead of using directory permissions, use an ACL which allows us to precisely give access to the qemu user and no one else. Reported-by: Xiaodai Wang Thanks: Dr David Gilbert Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2066773 --- lib/utils.ml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/utils.ml b/lib/utils.ml index 757bc73c8e..5623250832 100644 --- a/lib/utils.ml +++ b/lib/utils.ml @@ -158,8 +158,12 @@ let error_if_no_ssh_agent () = (* Create the directory containing inX and outX sockets. *) let create_v2v_directory () = let d = Mkdtemp.temp_dir "v2v." in + (* If running as root, and if the backend is libvirt, libvirt + * will run qemu as a non-root user. Allow qemu to open the directory. + *) let running_as_root = Unix.geteuid () = 0 in - if running_as_root then Unix.chmod d 0o711; + if running_as_root && backend_is_libvirt () then + ignore (Sys.command (sprintf "setfacl -m user:qemu:rwx %s" (quote d))); On_exit.rmdir d; d -- 2.35.1