The 0777 permission mask we use when creating most 'cfg' dirs does not match what we put on disk via the RPM spec file. Generally those dirs are more locked down.
Match driver startup permissions and owners with what we encode in the RPM spec. Presumably this is safe because this has been tested with real world usage. Some dirs are created here but not in the RPM spec. Leave their permission mask as is, we will deal with them in future patches. The 2 runtime changes for an RPM installed libvirt is that stateDir is now chown(qemu, qemu) and runDir is now chown(0, 0) where previously there was no chown() calls for these dirs. I don't think that should cause problems Signed-off-by: Cole Robinson <[email protected]> --- src/qemu/qemu_driver.c | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 5dff049d85..f351aab009 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -524,6 +524,9 @@ qemuStateInitializeDirs(bool privileged, { size_t i; + uid_t daemon_uid = geteuid(); + gid_t daemon_gid = getegid(); + struct dirperms { const char *dir; int mode; @@ -532,24 +535,24 @@ qemuStateInitializeDirs(bool privileged, }; struct dirperms dirs[] = { /* example: /var/cache/libvirt/qemu */ - { cfg->cacheDir, 0777, -1, -1 }, + { cfg->cacheDir, 0750, daemon_uid, daemon_gid }, /* example: /run/libvirt/qemu */ - { cfg->stateDir, 0777, -1, -1 }, - { cfg->slirpStateDir, 0777, cfg->user, cfg->group }, - { cfg->passtStateDir, 0777, cfg->user, cfg->group }, + { cfg->stateDir, 0755, cfg->user, cfg->group }, + { cfg->slirpStateDir, 0755, cfg->user, cfg->group }, + { cfg->passtStateDir, 0755, cfg->user, cfg->group }, { cfg->rdpStateDir, 0777, cfg->user, cfg->group }, { cfg->channelTargetDir, 0777, cfg->user, cfg->group }, /* example: /var/lib/libvirt/qemu */ - { cfg->libDir, 0777, cfg->user, cfg->group }, - { cfg->saveDir, 0777, cfg->user, cfg->group }, - { cfg->snapshotDir, 0777, cfg->user, cfg->group }, - { cfg->checkpointDir, 0777, cfg->user, cfg->group }, - { cfg->autoDumpPath, 0777, cfg->user, cfg->group }, - { cfg->nvramDir, 0777, cfg->user, cfg->group }, - { cfg->varstoreDir, 0777, cfg->user, cfg->group }, - { cfg->memoryBackingDir, 0777, cfg->user, cfg->group }, + { cfg->libDir, 0751, cfg->user, cfg->group }, + { cfg->saveDir, 0751, cfg->user, cfg->group }, + { cfg->snapshotDir, 0751, cfg->user, cfg->group }, + { cfg->checkpointDir, 0751, cfg->user, cfg->group }, + { cfg->autoDumpPath, 0751, cfg->user, cfg->group }, + { cfg->nvramDir, 0751, cfg->user, cfg->group }, + { cfg->varstoreDir, 0751, cfg->user, cfg->group }, + { cfg->memoryBackingDir, 0751, cfg->user, cfg->group }, }; for (i = 0; i < G_N_ELEMENTS(dirs); i++) { @@ -559,8 +562,7 @@ qemuStateInitializeDirs(bool privileged, return -1; } - if (privileged && - dirs[i].user != -1) { + if (privileged) { if (chown(dirs[i].dir, dirs[i].user, dirs[i].group) < 0) { virReportSystemError(errno, _("unable to set ownership of '%1$s' to %2$d:%3$d"), -- 2.53.0
