]> xenbits.xensource.com Git - libvirt.git/commit
qemu: Label uniqDir when probing capabilities
authorMartin Kletzander <mkletzan@redhat.com>
Fri, 12 Apr 2019 13:22:48 +0000 (15:22 +0200)
committerMartin Kletzander <mkletzan@redhat.com>
Fri, 12 Apr 2019 22:56:45 +0000 (00:56 +0200)
commit673f805d4df2484bc2a5cc637524e92c0cbc5584
tree91f695895954f5c61a723ca1fdcc304760f81157
parentdf4b46737f43a1a67f9b5de2840213a1bd2b3cce
qemu: Label uniqDir when probing capabilities

This does not cause a problem in usual scenarios thanks to us allowing
CAP_DAC_OVERRIDE for the qemu process, however in some scenarios this might be
an issue because the directory is created with mkdtemp(3) which explicitly
creates that with 0700 permissions and qemu running as non-root cannot access
that.

The scenarios include:
 - Builds without CAPNG
 - Running libvirtd in certain container configurations [1]
 - and possibly others.

[1] https://github.com/kubevirt/kubevirt/pull/2181#issuecomment-481840304

Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
src/qemu/qemu_process.c