Re: [Libguestfs] [PATCH v2v v2] lib: Use an ACL to allow qemu to access the v2v directory

On 03/22/22 16:48, Richard W.M. Jones wrote: > When using the libvirt backend and running as root, libvirt will run > qemu as a non-root user (eg. qemu:qemu). The v2v directory stores NBD > endpoints that qemu must be able to open and so we set the directory > to mode 0711. Unfortunately this permits any non-root user to open > the sockets (since, by design, they have predictable names within the > directory). > > So instead of using directory permissions, use an ACL which allows us > to precisely give access to the qemu user and no one else. > > Reported-by: Xiaodai Wang > Thanks: Dr David Gilbert > Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2066773 > --- > lib/utils.ml | 34 +++++++++++++++++++++++++++++++++- > 1 file changed, 33 insertions(+), 1 deletion(-) > > diff --git a/lib/utils.ml b/lib/utils.ml > index 757bc73c8e..48e6b6c82d 100644 > --- a/lib/utils.ml > +++ b/lib/utils.ml > @@ -146,6 +146,26 @@ let backend_is_libvirt () = > let backend = fst (String.split ":" backend) in > backend = "libvirt" > > +(* Get the local user that libvirt uses to run qemu when we are > + * running as root. This is returned as an optional string > + * containing either the UID or username. > + * https://listman.redhat.com/archives/libguestfs/2022-March/028450.html > + *) > +let libvirt_qemu_uid () = > + let conn = Libvirt.Connect.connect_readonly () in > + let xml = Libvirt.Connect.get_capabilities conn in Huh, I didn't know this existed already :) > + let doc = Xml.parse_memory xml in > + let xpathctx = Xml.xpath_new_context doc in > + let expr = "//secmodel[./model=\"dac\"]/baselabel[@type=\"kvm\"]/text()" in So if you run "virsh capabilities", you get: <secmodel> <model>dac</model> <doi>0</doi> <baselabel type='kvm'>+107:+107</baselabel> <baselabel type='qemu'>+107:+107</baselabel> </secmodel> In case libvirt starts the domain with TCG, then I think the @type='qemu' filter should apply.